{"level":"info","ts":"2026-11-02T21:13:55.422Z","logger":"kuadrant-operator","msg":"go version: go1.26.7 (Red Hat 1.26.7-1.el9_8) X:strictfipsruntime"}
{"level":"info","ts":"2026-11-02T21:13:55.422Z","logger":"kuadrant-operator","msg":"go os/arch: linux/amd64"}
{"level":"info","ts":"2026-11-02T21:13:55.422Z","logger":"kuadrant-operator","msg":"base logger","log level":"info","log mode":"production"}
{"level":"info","ts":"2026-11-02T21:13:55.422Z","logger":"kuadrant-operator","msg":"build information","version":"1.5.3","commit":"00b87406469a6b16adaa60f149ee6ce78afcd07d","dirty":"false"}
{"level":"info","ts":"2026-11-02T21:13:55.816Z","logger":"kuadrant-operator","msg":"envoygateway is not installed, skipping related watches and reconcilers"}
{"level":"info","ts":"2026-11-02T21:13:55.816Z","logger":"kuadrant-operator.extensions","msg":"Discovered extension","name":"oidc-policy","path":"/extensions/oidc-policy/oidc-policy"}
{"level":"info","ts":"2026-11-02T21:13:55.816Z","logger":"kuadrant-operator.extensions","msg":"Discovered extension","name":"plan-policy","path":"/extensions/plan-policy/plan-policy"}
{"level":"info","ts":"2026-11-02T21:13:55.816Z","logger":"kuadrant-operator.extensions","msg":"Discovered extension","name":"telemetry-policy","path":"/extensions/telemetry-policy/telemetry-policy"}
{"level":"info","ts":"2026-11-02T21:13:55.817Z","logger":"kuadrant-operator","msg":"starting runnable","name":"peerauthentication watcher"}
{"level":"info","ts":"2026-11-02T21:13:55.817Z","logger":"kuadrant-operator","msg":"starting runnable","name":"topology configmap watcher"}
{"level":"info","ts":"2026-11-02T21:13:55.817Z","logger":"kuadrant-operator","msg":"starting runnable","name":"developer portal deployment watcher"}
{"level":"info","ts":"2026-11-02T21:13:55.817Z","logger":"kuadrant-operator","msg":"starting runnable","name":"tokenratelimitpolicy watcher"}
{"level":"info","ts":"2026-11-02T21:13:55.817Z","logger":"kuadrant-operator","msg":"starting runnable","name":"authconfig watcher"}
{"level":"info","ts":"2026-11-02T21:13:55.817Z","logger":"kuadrant-operator","msg":"starting runnable","name":"gatewayclass watcher"}
{"level":"info","ts":"2026-11-02T21:13:55.817Z","logger":"kuadrant-operator","msg":"starting runnable","name":"gateway watcher"}
{"level":"info","ts":"2026-11-02T21:13:55.817Z","logger":"kuadrant-operator","msg":"starting runnable","name":"authpolicy watcher"}
{"level":"info","ts":"2026-11-02T21:13:55.817Z","logger":"kuadrant-operator","msg":"starting runnable","name":"envoyfilter watcher"}
{"level":"info","ts":"2026-11-02T21:13:55.817Z","logger":"kuadrant-operator","msg":"starting runnable","name":"servicemonitor watcher"}
{"level":"info","ts":"2026-11-02T21:13:55.817Z","logger":"kuadrant-operator","msg":"starting runnable","name":"kuadrant watcher"}
{"level":"info","ts":"2026-11-02T21:13:55.817Z","logger":"kuadrant-operator","msg":"starting runnable","name":"certificate watcher"}
{"level":"info","ts":"2026-11-02T21:13:55.817Z","logger":"kuadrant-operator","msg":"starting runnable","name":"issuers watcher"}
{"level":"info","ts":"2026-11-02T21:13:55.817Z","logger":"kuadrant-operator","msg":"starting runnable","name":"clusterissuers watcher"}
{"level":"info","ts":"2026-11-02T21:13:55.817Z","logger":"kuadrant-operator","msg":"starting runnable","name":"extension manager"}
{"level":"info","ts":"2026-11-02T21:13:55.817Z","logger":"kuadrant-operator","msg":"starting runnable","name":"wasm server"}
{"level":"info","ts":"2026-11-02T21:13:55.817Z","logger":"kuadrant-operator","msg":"starting runnable","name":"cluster version watcher"}
{"level":"info","ts":"2026-11-02T21:13:55.817Z","logger":"kuadrant-operator","msg":"starting runnable","name":"authorino watcher"}
{"level":"info","ts":"2026-11-02T21:13:55.817Z","logger":"kuadrant-operator","msg":"starting runnable","name":"httproute watcher"}
{"level":"info","ts":"2026-11-02T21:13:55.817Z","logger":"kuadrant-operator","msg":"starting runnable","name":"tlspolicy watcher"}
{"level":"info","ts":"2026-11-02T21:13:55.817Z","logger":"kuadrant-operator","msg":"starting runnable","name":"consoleplugin watcher"}
{"level":"info","ts":"2026-11-02T21:13:55.817Z","logger":"kuadrant-operator","msg":"starting runnable","name":"dnspolicy watcher"}
{"level":"info","ts":"2026-11-02T21:13:55.817Z","logger":"kuadrant-operator","msg":"starting runnable","name":"ratelimitpolicy watcher"}
{"level":"info","ts":"2026-11-02T21:13:55.817Z","logger":"kuadrant-operator","msg":"starting runnable","name":"podmonitor watcher"}
{"level":"info","ts":"2026-11-02T21:13:55.817Z","logger":"kuadrant-operator","msg":"starting runnable","name":"dnsrecord watcher"}
{"level":"info","ts":"2026-11-02T21:13:55.817Z","logger":"kuadrant-operator","msg":"starting runnable","name":"limitador watcher"}
{"level":"info","ts":"2026-11-02T21:13:55.817Z","logger":"kuadrant-operator","msg":"starting runnable","name":"limitador deployment watcher"}
{"level":"info","ts":"2026-11-02T21:13:55.817Z","logger":"kuadrant-operator","msg":"starting runnable","name":"grpcroute watcher"}
{"level":"info","ts":"2026-11-02T21:13:55.817Z","logger":"kuadrant-operator.extensions.extension.oidc-policy","msg":"starting..."}
{"level":"info","ts":"2026-11-02T21:13:55.818Z","logger":"kuadrant-operator.extensions.extension.oidc-policy","msg":"started"}
{"level":"info","ts":"2026-11-02T21:13:55.818Z","logger":"kuadrant-operator.extensions.extension.plan-policy","msg":"starting..."}
{"level":"info","ts":"2026-11-02T21:13:55.818Z","logger":"kuadrant-operator.extensions.extension.plan-policy","msg":"started"}
{"level":"info","ts":"2026-11-02T21:13:55.818Z","logger":"kuadrant-operator.extensions.extension.telemetry-policy","msg":"starting..."}
{"level":"info","ts":"2026-11-02T21:13:55.819Z","logger":"kuadrant-operator.extensions.extension.telemetry-policy","msg":"started"}
{"level":"info","ts":"2026-11-02T21:13:55.819Z","logger":"kuadrant-operator.extensions.extension","msg":"starting descriptor service","port":50051}
{"level":"info","ts":"2026-11-02T21:13:55.840Z","logger":"kuadrant-operator.WasmServer","msg":"starting wasm server (h2c)","port":8082,"file":"/wasm/plugin.wasm","sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}
{"level":"info","ts":"2026-11-02T21:13:55Z","logger":"plan-policy-extension-controller","msg":"Starting EventSource","controller":"plan-policy-extension-controller","source":"channel source: 0x35037b190620"}
{"level":"info","ts":"2026-11-02T21:13:55Z","logger":"plan-policy-extension-controller","msg":"Starting EventSource","controller":"plan-policy-extension-controller","source":"kind source: *v1alpha1.PlanPolicy"}
{"level":"info","ts":"2026-11-02T21:13:55Z","logger":"plan-policy-extension-controller","msg":"Starting EventSource","controller":"plan-policy-extension-controller","source":"kind source: *v1.RateLimitPolicy"}
{"level":"info","ts":"2026-11-02T21:13:55Z","logger":"telemetry-policy-extension-controller","msg":"Starting EventSource","controller":"telemetry-policy-extension-controller","source":"channel source: 0x541bdc608c0"}
{"level":"info","ts":"2026-11-02T21:13:55Z","logger":"telemetry-policy-extension-controller","msg":"Starting EventSource","controller":"telemetry-policy-extension-controller","source":"kind source: *v1alpha1.TelemetryPolicy"}
{"level":"info","ts":"2026-11-02T21:13:55Z","logger":"oidc-policy-controller","msg":"Starting EventSource","controller":"oidc-policy-controller","source":"channel source: 0x2034a1c25b0"}
{"level":"info","ts":"2026-11-02T21:13:55Z","logger":"oidc-policy-controller","msg":"Starting EventSource","controller":"oidc-policy-controller","source":"kind source: *v1alpha1.OIDCPolicy"}
{"level":"info","ts":"2026-11-02T21:13:55Z","logger":"oidc-policy-controller","msg":"Starting EventSource","controller":"oidc-policy-controller","source":"kind source: *v1.HTTPRoute"}
{"level":"info","ts":"2026-11-02T21:13:55Z","logger":"oidc-policy-controller","msg":"Starting EventSource","controller":"oidc-policy-controller","source":"kind source: *v1.AuthPolicy"}
{"level":"info","ts":"2026-11-02T21:13:55.918Z","logger":"kuadrant-operator","msg":"starting server","name":"health probe","addr":"[::]:8081"}
{"level":"info","ts":"2026-11-02T21:13:55.918Z","logger":"kuadrant-operator.controller-runtime.metrics","msg":"Starting metrics server"}
{"level":"info","ts":"2026-11-02T21:13:55.918Z","logger":"kuadrant-operator","msg":"attempting to acquire leader lease kuadrant-system/f139389e.kuadrant.io..."}
{"level":"info","ts":"2026-11-02T21:13:55.918Z","logger":"kuadrant-operator.controller-runtime.metrics","msg":"Serving metrics server","bindAddress":":8080","secure":false}
{"level":"info","ts":"2026-11-02T21:13:56Z","logger":"plan-policy-extension-controller","msg":"Starting Controller","controller":"plan-policy-extension-controller"}
{"level":"info","ts":"2026-11-02T21:13:56Z","logger":"plan-policy-extension-controller","msg":"Starting workers","controller":"plan-policy-extension-controller","worker count":1}
{"level":"info","ts":"2026-11-02T21:13:56Z","logger":"telemetry-policy-extension-controller","msg":"Starting Controller","controller":"telemetry-policy-extension-controller"}
{"level":"info","ts":"2026-11-02T21:13:56Z","logger":"telemetry-policy-extension-controller","msg":"Starting workers","controller":"telemetry-policy-extension-controller","worker count":1}
{"level":"info","ts":"2026-11-02T21:13:56Z","logger":"oidc-policy-controller","msg":"Starting Controller","controller":"oidc-policy-controller"}
{"level":"info","ts":"2026-11-02T21:13:56Z","logger":"oidc-policy-controller","msg":"Starting workers","controller":"oidc-policy-controller","worker count":1}
{"level":"info","ts":"2026-11-02T21:14:24.866Z","logger":"kuadrant-operator","msg":"successfully acquired lease kuadrant-system/f139389e.kuadrant.io"}
{"level":"info","ts":"2026-11-02T21:14:24.866Z","logger":"kuadrant-operator","msg":"Starting EventSource","controller":"controller","source":"kind source: *v1alpha1.TokenRateLimitPolicy"}
{"level":"info","ts":"2026-11-02T21:14:24.866Z","logger":"kuadrant-operator","msg":"Starting EventSource","controller":"controller","source":"kind source: *v1.GRPCRoute"}
{"level":"info","ts":"2026-11-02T21:14:24.866Z","logger":"kuadrant-operator","msg":"Starting EventSource","controller":"controller","source":"kind source: *v1beta3.AuthConfig"}
{"level":"info","ts":"2026-11-02T21:14:24.867Z","logger":"kuadrant-operator","msg":"Starting EventSource","controller":"controller","source":"kind source: *v1alpha3.EnvoyFilter"}
{"level":"info","ts":"2026-11-02T21:14:24.867Z","logger":"kuadrant-operator","msg":"Starting EventSource","controller":"controller","source":"kind source: *v1.Gateway"}
{"level":"info","ts":"2026-11-02T21:14:24.867Z","logger":"kuadrant-operator","msg":"Starting EventSource","controller":"controller","source":"kind source: *v1.PeerAuthentication"}
{"level":"info","ts":"2026-11-02T21:14:24.867Z","logger":"kuadrant-operator","msg":"Starting EventSource","controller":"controller","source":"kind source: *v1.GatewayClass"}
{"level":"info","ts":"2026-11-02T21:14:24.867Z","logger":"kuadrant-operator","msg":"Starting EventSource","controller":"controller","source":"kind source: *v1.ConfigMap"}
{"level":"info","ts":"2026-11-02T21:14:24.867Z","logger":"kuadrant-operator","msg":"Starting EventSource","controller":"controller","source":"kind source: *v1.Deployment"}
{"level":"info","ts":"2026-11-02T21:14:24.867Z","logger":"kuadrant-operator","msg":"Starting EventSource","controller":"controller","source":"kind source: *v1.AuthPolicy"}
{"level":"info","ts":"2026-11-02T21:14:24.867Z","logger":"kuadrant-operator","msg":"Starting EventSource","controller":"controller","source":"kind source: *v1.ServiceMonitor"}
{"level":"info","ts":"2026-11-02T21:14:24.867Z","logger":"kuadrant-operator","msg":"Starting EventSource","controller":"controller","source":"kind source: *v1beta1.Kuadrant"}
{"level":"info","ts":"2026-11-02T21:14:24.867Z","logger":"kuadrant-operator","msg":"Starting EventSource","controller":"controller","source":"kind source: *v1.ClusterVersion"}
{"level":"info","ts":"2026-11-02T21:14:24.867Z","logger":"kuadrant-operator","msg":"Starting EventSource","controller":"controller","source":"kind source: *v1.Certificate"}
{"level":"info","ts":"2026-11-02T21:14:24.867Z","logger":"kuadrant-operator","msg":"Starting EventSource","controller":"controller","source":"kind source: *v1.Issuer"}
{"level":"info","ts":"2026-11-02T21:14:24.867Z","logger":"kuadrant-operator","msg":"Starting EventSource","controller":"controller","source":"kind source: *v1.ClusterIssuer"}
{"level":"info","ts":"2026-11-02T21:14:24.867Z","logger":"kuadrant-operator","msg":"Starting EventSource","controller":"controller","source":"kind source: *v1beta1.Authorino"}
{"level":"info","ts":"2026-11-02T21:14:24.867Z","logger":"kuadrant-operator","msg":"Starting EventSource","controller":"controller","source":"kind source: *v1.HTTPRoute"}
{"level":"info","ts":"2026-11-02T21:14:24.867Z","logger":"kuadrant-operator","msg":"Starting EventSource","controller":"controller","source":"kind source: *v1.TLSPolicy"}
{"level":"info","ts":"2026-11-02T21:14:24.867Z","logger":"kuadrant-operator","msg":"Starting EventSource","controller":"controller","source":"kind source: *v1.ConsolePlugin"}
{"level":"info","ts":"2026-11-02T21:14:24.867Z","logger":"kuadrant-operator","msg":"Starting EventSource","controller":"controller","source":"kind source: *v1.DNSPolicy"}
{"level":"info","ts":"2026-11-02T21:14:24.867Z","logger":"kuadrant-operator","msg":"Starting EventSource","controller":"controller","source":"kind source: *v1.RateLimitPolicy"}
{"level":"info","ts":"2026-11-02T21:14:24.867Z","logger":"kuadrant-operator","msg":"Starting EventSource","controller":"controller","source":"kind source: *v1.PodMonitor"}
{"level":"info","ts":"2026-11-02T21:14:24.867Z","logger":"kuadrant-operator","msg":"Starting EventSource","controller":"controller","source":"kind source: *v1alpha1.DNSRecord"}
{"level":"info","ts":"2026-11-02T21:14:24.867Z","logger":"kuadrant-operator","msg":"Starting EventSource","controller":"controller","source":"kind source: *v1alpha1.Limitador"}
{"level":"info","ts":"2026-11-02T21:14:24.867Z","logger":"kuadrant-operator","msg":"Starting EventSource","controller":"controller","source":"kind source: *v1.Deployment"}
{"level":"info","ts":"2026-11-02T21:14:25.375Z","logger":"kuadrant-operator","msg":"Starting Controller","controller":"controller"}
{"level":"info","ts":"2026-11-02T21:14:25.375Z","logger":"kuadrant-operator","msg":"Starting workers","controller":"controller","worker count":1}
{"level":"info","ts":"2026-11-02T21:14:26.828Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["HTTPRoute","GatewayClass","Gateway","ConsolePlugin","ConfigMap","ClusterVersion","Issuer","Kuadrant"],"eventTypes":{"create":12}}
{"level":"info","ts":"2026-11-02T21:14:26.887Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:14:26.887Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:14:26.887Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:14:26.887Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"update object","kind":"v1beta1.Kuadrant","name":"kuadrant","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:14:26.888Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:14:26.888Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:14:26.888Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:14:26.887Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:14:26.888Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:14:26.945Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"added finalizer to Kuadrant CR"}
{"level":"info","ts":"2026-11-02T21:14:26.945Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:14:26.952Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"created authorino resource","status":"acceptable"}
{"level":"info","ts":"2026-11-02T21:14:26.954Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:14:26.954Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:14:27.217Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"error","ts":"2026-11-02T21:14:27.273Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"updateKuadrantStatusError","status":"error","error":"Operation cannot be fulfilled on kuadrants.kuadrant.io \"kuadrant\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:14:27.273Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"Failed to update status: resource might just be outdated","status":"error"}
{"level":"info","ts":"2026-11-02T21:14:27.273Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:14:30.287Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","Limitador","Deployment","Kuadrant","Authorino"],"eventTypes":{"create":3,"update":2}}
{"level":"info","ts":"2026-11-02T21:14:30.347Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:14:30.347Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:14:30.347Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"update object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:14:30.347Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:14:30.347Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:14:30.347Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:14:30.348Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:14:30.348Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-02T21:14:30.348Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:14:30.348Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:14:30.348Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:14:30.348Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:14:30.348Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"update object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:14:30.405Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:14:30.405Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:14:30.408Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:14:30.411Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:14:30.470Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:14:30.471Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Authorino"],"eventTypes":{"update":1}}
{"level":"info","ts":"2026-11-02T21:14:30.531Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:14:30.588Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:14:30.588Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"error","ts":"2026-11-02T21:14:30.644Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"updateKuadrantStatusError","status":"error","error":"Operation cannot be fulfilled on kuadrants.kuadrant.io \"kuadrant\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:14:30.644Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"Failed to update status: resource might just be outdated","status":"error"}
{"level":"info","ts":"2026-11-02T21:14:30.644Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:14:33.538Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Kuadrant","Limitador","Gateway","ConfigMap","Authorino","HTTPRoute","Deployment"],"eventTypes":{"update":7}}
{"level":"info","ts":"2026-11-02T21:14:33.598Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:14:33.598Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:14:33.598Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:14:33.598Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:14:33.598Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:14:33.598Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:14:33.598Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-02T21:14:33.598Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:14:33.598Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:14:33.598Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:14:33.598Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:14:33.655Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:14:33.655Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:14:33.655Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:14:33.655Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:14:33.655Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:14:33.837Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["GatewayClass"],"eventTypes":{"update":1}}
{"level":"info","ts":"2026-11-02T21:14:33.896Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:14:33.896Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:14:33.896Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-02T21:14:33.896Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:14:33.896Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:14:33.896Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:14:33.896Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:14:33.896Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:14:33.896Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:14:39.313Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Authorino","ConfigMap"],"eventTypes":{"update":2}}
{"level":"info","ts":"2026-11-02T21:14:39.373Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:14:39.436Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:14:39.436Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:14:39.436Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:14:39.436Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway"],"eventTypes":{"update":1}}
{"level":"info","ts":"2026-11-02T21:14:39.496Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:14:39.496Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:14:39.496Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-02T21:14:39.496Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:14:39.496Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:14:39.496Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:14:39.496Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:14:39.496Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:14:39.496Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:14:42.561Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Authorino","ConfigMap","Gateway"],"eventTypes":{"update":3}}
{"level":"info","ts":"2026-11-02T21:14:42.621Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:14:42.621Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-02T21:14:42.621Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:14:42.621Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:14:42.621Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:14:42.621Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:14:42.621Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:14:42.678Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:14:42.678Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:14:42.678Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:14:42.864Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway"],"eventTypes":{"update":1}}
{"level":"info","ts":"2026-11-02T21:14:42.922Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:14:42.922Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:14:42.922Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-02T21:14:42.922Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:14:42.922Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:14:42.922Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:14:42.922Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:14:42.922Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:14:42.922Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:14:44.542Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Deployment","ConfigMap","Limitador"],"eventTypes":{"update":3}}
{"level":"info","ts":"2026-11-02T21:14:44.601Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:14:44.602Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:14:44.602Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:14:44.602Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:14:44.602Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:14:44.602Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-02T21:14:44.602Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:14:44.602Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:14:44.659Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:14:44.659Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:14:44.659Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:14:44.719Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:14:47.598Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Deployment","ConfigMap","Kuadrant","Limitador"],"eventTypes":{"update":4}}
{"level":"info","ts":"2026-11-02T21:14:47.658Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:14:47.658Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:14:47.658Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:14:47.658Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:14:47.658Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-02T21:14:47.658Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:14:47.658Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:14:47.658Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:14:47.658Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:14:47.658Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:14:47.658Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:14:47.715Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:14:47.715Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:14:47.715Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:14:47.716Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:14:47.774Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:14:49.217Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Limitador","ConfigMap","Kuadrant"],"eventTypes":{"update":3}}
{"level":"info","ts":"2026-11-02T21:14:49.277Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:14:49.277Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:14:49.277Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:14:49.277Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:14:49.277Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:14:49.277Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:14:49.277Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-02T21:14:49.277Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:14:49.277Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:14:49.277Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:14:49.277Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:14:49.334Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:14:49.334Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:14:49.334Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:14:49.334Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:14:49.334Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:15:11.484Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","Gateway"],"eventTypes":{"update":2}}
{"level":"info","ts":"2026-11-02T21:15:11.544Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:15:11.544Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:15:11.544Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-02T21:15:11.544Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:15:11.544Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:15:11.544Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:15:11.544Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:15:11.545Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:15:11.545Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:15:28.127Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","AuthPolicy"],"eventTypes":{"create":1,"update":1}}
{"level":"info","ts":"2026-11-02T21:15:28.187Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:15:28.187Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:15:28.187Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:15:30.008Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","Gateway","AuthPolicy"],"eventTypes":{"update":3}}
{"level":"info","ts":"2026-11-02T21:15:30.068Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:15:30.068Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:15:30.068Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-02T21:15:30.068Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:15:30.068Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:15:30.068Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:15:30.068Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:15:30.136Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:15:30.136Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:15:58.622Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthPolicy","ConfigMap"],"eventTypes":{"create":1,"update":1}}
{"level":"info","ts":"2026-11-02T21:15:58.682Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:15:58.682Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:15:58.682Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:16:01Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry","reconcileID":"b4851e6f-4e93-48f2-8ff1-ec923a2b665b","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:16:01Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry","event":"CREATE"}
{"level":"info","ts":"2026-11-02T21:16:01Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:16:02Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-02T21:16:02Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-02T21:16:02Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:16:02Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry","reconcileID":"65e5756d-6f61-4859-a59b-019eed753ebe","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:16:02Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T21:16:02Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:16:02Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-02T21:16:02Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-02T21:16:02Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-02T21:16:02Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:16:03.393Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway","HTTPRoute","ConfigMap","AuthPolicy"],"eventTypes":{"create":1,"update":4}}
{"level":"info","ts":"2026-11-02T21:16:03.455Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:16:03.455Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:16:03.455Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:16:03.457Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:16:03.457Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:16:03.458Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:16:03.519Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:16:04.010Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:16:04.010Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:16:04.210Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","Kuadrant"],"eventTypes":{"create":1,"update":1}}
{"level":"info","ts":"2026-11-02T21:16:04.270Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:16:04.270Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:16:04.270Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:16:04.270Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:16:04.271Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:16:04.272Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:16:04.272Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:16:04.273Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:16:04.273Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:16:04.273Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:16:04.328Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:16:04.328Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:16:04.328Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"error","ts":"2026-11-02T21:16:04.332Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:16:04.332Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T21:16:04.332Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/maas-default-gateway","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/ratelimit":"true"},"name":"kuadrant-ratelimiting-maas-default-gateway","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"maas-default-gateway","uid":"371b36ef-c4b7-499a-87db-1bdf4e8f92de"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"limitador-limitador.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-ratelimit-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"limitador-limitador.kuadrant-system.svc.cluster.local","port_value":8081}}}}]}]},"name":"kuadrant-ratelimit-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"maas-default-gateway"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-maas-default-gateway\" already exists"}
{"level":"error","ts":"2026-11-02T21:16:04.332Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/maas-default-gateway","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"kuadrant-auth-maas-default-gateway","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"maas-default-gateway","uid":"371b36ef-c4b7-499a-87db-1bdf4e8f92de"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-auth-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local","port_value":50051}}}}]}]},"name":"kuadrant-auth-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"maas-default-gateway"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-auth-maas-default-gateway\" already exists"}
{"level":"error","ts":"2026-11-02T21:16:04.341Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/maas-default-gateway","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"name":"kuadrant-maas-default-gateway","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"maas-default-gateway","uid":"371b36ef-c4b7-499a-87db-1bdf4e8f92de"}]},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7def4ca304ff3869be64c2c02523fd9d2ff43465099dcd1124399f293eb4480f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"a86375603000eab9b808785894e0e63f3e53024a46681e97c41a06c4e0c67023\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c6918972d1a7f8ad5201880b7d6d9c1191ca1f25376682f691def7868e3fd02\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"01cc37113b4d6c301e355f63decf46a21e93a023494bdfeaeed2890c97ec1f57\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a82769ff87473da04c27497e160e9b4b1a5dd93578e0cf2342be8b2f06845269\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e747b72d92315b743934153588614b27670cf0c9d9dc4fb380ea4965def7f235\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"06b05a8e4dd69bdc4f333ad9509ee8cad3c5c0f5dd48edbe94c1158b60f79ed3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"661962837510c6dc6d1faa64e61ec3086efa9e0a2e7315c6ded616c1879e5ba8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b4bfec1b33959dd0ebfc5cd6fb410688e820d4b55c7f149cb4acc4353f30a9b2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a7740f6e77d024a437502c023fb1d8939cb3cc2b9ed7f4073af7d779e19459eb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"f82564e076ea3e672592bab71e048537faba17a5e909884c2a0204e235905a69\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"maas-default-gateway"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-maas-default-gateway\" already exists"}
{"level":"error","ts":"2026-11-02T21:16:04.342Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route#rule-5"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"a82769ff87473da04c27497e160e9b4b1a5dd93578e0cf2342be8b2f06845269","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a82769ff87473da04c27497e160e9b4b1a5dd93578e0cf2342be8b2f06845269"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"a82769ff87473da04c27497e160e9b4b1a5dd93578e0cf2342be8b2f06845269\" already exists"}
{"level":"error","ts":"2026-11-02T21:16:04.408Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route#rule-4"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e\" already exists"}
{"level":"error","ts":"2026-11-02T21:16:04.474Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route#rule-1"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"a7740f6e77d024a437502c023fb1d8939cb3cc2b9ed7f4073af7d779e19459eb","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a7740f6e77d024a437502c023fb1d8939cb3cc2b9ed7f4073af7d779e19459eb"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"a7740f6e77d024a437502c023fb1d8939cb3cc2b9ed7f4073af7d779e19459eb\" already exists"}
{"level":"error","ts":"2026-11-02T21:16:04.544Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route#rule-2"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"5c6918972d1a7f8ad5201880b7d6d9c1191ca1f25376682f691def7868e3fd02","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["5c6918972d1a7f8ad5201880b7d6d9c1191ca1f25376682f691def7868e3fd02"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"5c6918972d1a7f8ad5201880b7d6d9c1191ca1f25376682f691def7868e3fd02\" already exists"}
{"level":"error","ts":"2026-11-02T21:16:04.611Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route#rule-6"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"7def4ca304ff3869be64c2c02523fd9d2ff43465099dcd1124399f293eb4480f","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["7def4ca304ff3869be64c2c02523fd9d2ff43465099dcd1124399f293eb4480f"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"7def4ca304ff3869be64c2c02523fd9d2ff43465099dcd1124399f293eb4480f\" already exists"}
{"level":"error","ts":"2026-11-02T21:16:04.677Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route#rule-3"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"06b05a8e4dd69bdc4f333ad9509ee8cad3c5c0f5dd48edbe94c1158b60f79ed3","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["06b05a8e4dd69bdc4f333ad9509ee8cad3c5c0f5dd48edbe94c1158b60f79ed3"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"06b05a8e4dd69bdc4f333ad9509ee8cad3c5c0f5dd48edbe94c1158b60f79ed3\" already exists"}
{"level":"error","ts":"2026-11-02T21:16:04.735Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny","namespace":"openshift-ingress","uid":"98334d41-e6d6-4f98-8ac9-43aeb1f2e054","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:16:04.810Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"maas-gateway-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"maas-gateway-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:16:04.810Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:16:04.810Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T21:16:04.869Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"maas-api-route","namespace":"odh-ai-gateway-infra","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"maas-api-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:16:04.931Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"maas-default-gateway","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"maas-default-gateway\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:16:08.003Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","Gateway","EnvoyFilter","HTTPRoute","TokenRateLimitPolicy","AuthPolicy","ConfigMap","Kuadrant","Limitador"],"eventTypes":{"create":9,"update":7}}
{"level":"info","ts":"2026-11-02T21:16:08.063Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:16:08.064Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:16:08.064Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:16:08.064Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:16:08.065Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:16:08.065Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:16:08.065Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:16:08.066Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:16:08.066Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-02T21:16:08.066Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:16:08.066Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:16:08.121Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:16:08.121Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:16:08.121Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:16:08.267Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:16:08.267Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:16:14.549Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","TokenRateLimitPolicy","AuthPolicy","Authorino"],"eventTypes":{"update":4}}
{"level":"info","ts":"2026-11-02T21:16:14.614Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:16:14.614Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:16:14.615Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-02T21:16:14.615Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:16:14.616Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:16:14.616Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:16:14.672Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:16:14.816Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:16:14.816Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:16:19.523Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Authorino","ConfigMap"],"eventTypes":{"update":2}}
{"level":"info","ts":"2026-11-02T21:16:19.587Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:16:19.645Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:16:19.645Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:16:19.646Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:16:19.648Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig"],"eventTypes":{"update":6}}
{"level":"info","ts":"2026-11-02T21:16:40.989Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ClusterVersion","ConfigMap"],"eventTypes":{"update":2}}
{"level":"info","ts":"2026-11-02T21:18:16.340Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["HTTPRoute","AuthPolicy","Gateway","ConfigMap"],"eventTypes":{"create":1,"update":3}}
{"level":"info","ts":"2026-11-02T21:18:16.404Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:18:16.404Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:18:16.405Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:18:16.405Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:18:16.404Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:18:16.406Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:18:16.465Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:18:17.883Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:18:17.883Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:18:21.083Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","Limitador","ConfigMap","TokenRateLimitPolicy","EnvoyFilter","AuthPolicy","HTTPRoute"],"eventTypes":{"create":12,"update":12}}
{"level":"info","ts":"2026-11-02T21:18:21.143Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:18:21.145Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:18:21.153Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:18:21.154Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:18:21.154Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:18:21.155Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:18:21.155Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:18:21.156Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:18:21.205Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:18:21.205Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"error","ts":"2026-11-02T21:18:21.211Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:18:21.211Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:18:22.094Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:18:22.094Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:18:22.280Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway","HTTPRoute"],"eventTypes":{"create":1,"update":1}}
{"level":"info","ts":"2026-11-02T21:18:22.361Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:18:22.362Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:18:22.363Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:18:22.363Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:18:22.363Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:18:22.364Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-11-02T21:18:22.419Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:18:22.419Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T21:18:22.428Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-completions-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"2ddbced6f2f51d410743da1d9db1257d0006d99f38986dd7cc7efd26620791ad","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["2ddbced6f2f51d410743da1d9db1257d0006d99f38986dd7cc7efd26620791ad"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"2ddbced6f2f51d410743da1d9db1257d0006d99f38986dd7cc7efd26620791ad\" already exists"}
{"level":"error","ts":"2026-11-02T21:18:22.493Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-completions-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"c4399a95e89654e5b2bb5fabe45bc947d11ccd1448ebf64c30b195b34f239d58","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["c4399a95e89654e5b2bb5fabe45bc947d11ccd1448ebf64c30b195b34f239d58"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"c4399a95e89654e5b2bb5fabe45bc947d11ccd1448ebf64c30b195b34f239d58\" already exists"}
{"level":"error","ts":"2026-11-02T21:18:22.514Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/maas-default-gateway","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T21:16:03Z","generation":2,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"371b36ef-c4b7-499a-87db-1bdf4e8f92de\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:18:16Z"}],"name":"kuadrant-maas-default-gateway","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"maas-default-gateway","uid":"371b36ef-c4b7-499a-87db-1bdf4e8f92de"}],"resourceVersion":"19893","uid":"86b5bad7-2bb7-41c9-b2c7-bb4c8f13292a"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"61b044087f8d56658ae99d15d4fab3cf1ad74e6636795c133e054a5aace0540d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e511d90f2140d9cde0b2100a0a488dacadd8f510bb901601d5e6fd25343a0f1c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5322619ef71b1d1ea3204f9014d0341d4402275b6ca23fca69d61cfc9a61e883\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"16b86e50920afda06ca195a717436238f5fca7f2e1bbe0939875bcb7d559cf31\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4902f5a84509d49ec2fb75275af9692b524b1334f7c919eff1d9f33957acd5c4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4f0e9d14c4d1857d5415458306310b00d6a94ce68179c717917d13d30ede9b87\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"c19d17a63dc280a83fa4dce8ef0f825a16118c6817d3126d095473335018edd0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"05aa8311318e9111c5925f4be454406e209ab832bc6e8ddf01725ebe4f1ffdcc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e5b5be5a42ead835fa1a13840fda21cf5afb14b8226da9a3008a321db777f685\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"a01c6bf1aa626b04ec6a9fc85abb6ced9b4a9c4cafe81d2176013cf3b0b4c4aa\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"3dbcd4467449162cad999d40988202fafebe535215351d004f1bf05937c76508\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"534f6056dec477fad33defb3049c84dc5497dacd9f6e3f2061b13ba089ed1cbd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"fa823b540319ebed6b9b488f79dda81b66933f7e616cfdaebe3543ae31b33b13\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"fb6ca2eee2169356e662d36e92b2b679a1235a86d976f9807297ad56386f6e2a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"014f0c5a15872002db778e7e40dfcf7dede4ab2db05bb6a08641f5d523cb3afc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"bdac37244e7b891cd2973e74c7b0db5110c344505a09a86e51fc6486ba35139d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7def4ca304ff3869be64c2c02523fd9d2ff43465099dcd1124399f293eb4480f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"a86375603000eab9b808785894e0e63f3e53024a46681e97c41a06c4e0c67023\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fac07f302f653115fda3d376325a268abaf66025ed0e4af73e88bea3f41fe933\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"aa28eac51fc5e37c385a11a534759b09fb7998ba74bb01195dd8ff89d9e9ec43\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model-2/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cad6ab5a81a65fd4cb03a0fefdab5de82aa18c30a5b95078b1d05214b0606f40\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"0629facd48a81e3c82281be4a3f8566f55e61d1a30a8516b23bbb63c58e8f6f8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"74b47f1aa1203aad58596cbaab10ae46e8fddd08ac49eb57a26bdba532d88e72\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"d1e427bebfc099de9df176c73ee76d5dbd6f77919e840913d3a10818678c7394\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model-2/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"98ec9d74d07c88c1e6923ed1cbafd4c5b41bf1763b3a942282f964f72425ae57\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"653f23106eb8a10791805e2f9355c750c56aa6873ef311fe707e76083d93d55d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model-2/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2ddbced6f2f51d410743da1d9db1257d0006d99f38986dd7cc7efd26620791ad\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"1e776cd43733621e16ebc27c91dbdeea062f73e4dde2f494701c85a6843faeed\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"67c67ce733de50e7b3d797bb248036b01badfe02e958f5f76af05b58a504989c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"f9b414e31cae5d16cc1ad22ba2462b8816d9369a97316f40f32a6e7912fc4f78\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model-2/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1704c6bc15d6f547acca888061680f2275f690cb79e5af6fee44747bcf278b95\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"6a8319194e2c2fc998268cdbab03a5aae2d83019f5ac30c316c4e548895b7c63\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"17002b7f0c8e62582ad262d9c2b8b038ee7f2a9327fe34f21fd4f47134b7b8cf\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5acde2b886749c1c54f99db5c33887e6fc5ed0caf412daacfb5df0f329882c66\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9e75e9fd02f51c2f043b145c5d6b82e95f1447b388ee529262aea27a6a2774ef\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b89d1075a79c93acaa097e4e6db4d6a4b23bf3ffe5e964409e29b258ed725a99\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-2-simulated/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"010adf02b2e7deb40c572f4729b6dd4619847c8e6344137326b72df28772fc1a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"c04f8a7c7387e6794115c41161cb001d8a07340d2878cb8f36774a8f6a200ba4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bf65ad13397c94660867eb0205e06d1c9bebda4b019f632c0d0b8ef989930381\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"d8d67afd40f17474755bd3f6b00e265761bf5154febca129bc3f2b0bcd749c41\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-simulated/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8d5571efc1d304f5bcfc2ffb4ac6819154ba5556c29ce33416d460b887427984\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5d6b359055267732253f201a1fe48f0abe6d5e22b011c70e1cb006eea672f535\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a402d1681ab35bace735c19b1d084a86eb3d741d4e1c14371cfdaa55d22c3ebe\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"7320c049419b863194fd55db5ebd887462dd24e1289e6308d79f047431f2bed9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-2-simulated/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"669658556fba0f45c2a82def2f57614416614ddf154ed8dc5f4f9188f10130f2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"692f39321f892929348fe56801dc14c8a35eaf749609a3a5f4b5e684edddf17c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-2-simulated/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c4399a95e89654e5b2bb5fabe45bc947d11ccd1448ebf64c30b195b34f239d58\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5b273834f06c6341dd07bba6c809b3297ba2514e6d3b9b5d0f4f8211c68ccf8b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-simulated/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a91faccafad197e2a4065ce3d12a052ac484d2e8fb2fc9265ee48f02b28e6dce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"fbfd0ada86117ffb0a134e591bf8b8390012983d25496ef188c6da73fef5eaec\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-2-simulated/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"028a8b5bd5d4e690eebb2f20c5fd47cf0b3c6e2a3619ba9e55322bbca7b94cc3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"8fe4100eab1f023f5b06dd8e19bcc80109b82503466d49576acc234cdda9bf0e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-simulated/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4d18a96899c43d55ee63d2ae1a7a938c7e873d88b2fd95f06b2e3aae2c7f1c84\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"44e38055536c3f0d49cb81abb42bfefcf2c78faf963a6160afbe459bbc04db39\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-simulated/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6687eb3cec74c6c51428ce3f3d22d50ba269f59015d1bc8f185da49eb095534e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"05ac0e89d0298398d3996609d7c22b514bdf08bfa3787653bc739995c5942441\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-2-simulated')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2f53b030326b8e1f5908c601aecd3fffcb6d08a8337d0bdc53ee1fc699a4cd71\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5c3bcd9fb119b0fd45f3b4ba5de5f905cacbb4963fec309a0961a40f76a7a7a9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-simulated')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c6918972d1a7f8ad5201880b7d6d9c1191ca1f25376682f691def7868e3fd02\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"01cc37113b4d6c301e355f63decf46a21e93a023494bdfeaeed2890c97ec1f57\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a82769ff87473da04c27497e160e9b4b1a5dd93578e0cf2342be8b2f06845269\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e747b72d92315b743934153588614b27670cf0c9d9dc4fb380ea4965def7f235\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"06b05a8e4dd69bdc4f333ad9509ee8cad3c5c0f5dd48edbe94c1158b60f79ed3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"661962837510c6dc6d1faa64e61ec3086efa9e0a2e7315c6ded616c1879e5ba8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b4bfec1b33959dd0ebfc5cd6fb410688e820d4b55c7f149cb4acc4353f30a9b2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a7740f6e77d024a437502c023fb1d8939cb3cc2b9ed7f4073af7d779e19459eb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"f82564e076ea3e672592bab71e048537faba17a5e909884c2a0204e235905a69\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a908063c86927e6bf07b7d793aad9f277ac3c2a8f5f5d468b116cb9e07929b14\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"fbdfff5b213f506d78434055d011cf63d616653e502ee04408a43578986e1e5c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d1d232e06f90d479cd9b802f24889e83af58c51cf54ba273d5e24dcb8a297688\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b49f2d7e152d4de959577465d2494ee11771b4c439cb6eae71c90bff26224fb4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"maas-default-gateway"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-maas-default-gateway\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:18:22.560Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-responses-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"028a8b5bd5d4e690eebb2f20c5fd47cf0b3c6e2a3619ba9e55322bbca7b94cc3","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["028a8b5bd5d4e690eebb2f20c5fd47cf0b3c6e2a3619ba9e55322bbca7b94cc3"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"028a8b5bd5d4e690eebb2f20c5fd47cf0b3c6e2a3619ba9e55322bbca7b94cc3\" already exists"}
{"level":"error","ts":"2026-11-02T21:18:22.627Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-messages-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"17002b7f0c8e62582ad262d9c2b8b038ee7f2a9327fe34f21fd4f47134b7b8cf","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["17002b7f0c8e62582ad262d9c2b8b038ee7f2a9327fe34f21fd4f47134b7b8cf"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"17002b7f0c8e62582ad262d9c2b8b038ee7f2a9327fe34f21fd4f47134b7b8cf\" already exists"}
{"level":"error","ts":"2026-11-02T21:18:22.693Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"8d5571efc1d304f5bcfc2ffb4ac6819154ba5556c29ce33416d460b887427984","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["8d5571efc1d304f5bcfc2ffb4ac6819154ba5556c29ce33416d460b887427984"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"8d5571efc1d304f5bcfc2ffb4ac6819154ba5556c29ce33416d460b887427984\" already exists"}
{"level":"error","ts":"2026-11-02T21:18:22.759Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-messages-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"4d18a96899c43d55ee63d2ae1a7a938c7e873d88b2fd95f06b2e3aae2c7f1c84","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["4d18a96899c43d55ee63d2ae1a7a938c7e873d88b2fd95f06b2e3aae2c7f1c84"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"4d18a96899c43d55ee63d2ae1a7a938c7e873d88b2fd95f06b2e3aae2c7f1c84\" already exists"}
{"level":"error","ts":"2026-11-02T21:18:22.825Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"cad6ab5a81a65fd4cb03a0fefdab5de82aa18c30a5b95078b1d05214b0606f40","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["cad6ab5a81a65fd4cb03a0fefdab5de82aa18c30a5b95078b1d05214b0606f40"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"cad6ab5a81a65fd4cb03a0fefdab5de82aa18c30a5b95078b1d05214b0606f40\" already exists"}
{"level":"error","ts":"2026-11-02T21:18:22.890Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-responses-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"1704c6bc15d6f547acca888061680f2275f690cb79e5af6fee44747bcf278b95","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["1704c6bc15d6f547acca888061680f2275f690cb79e5af6fee44747bcf278b95"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"1704c6bc15d6f547acca888061680f2275f690cb79e5af6fee44747bcf278b95\" already exists"}
{"level":"error","ts":"2026-11-02T21:18:22.958Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-chat-completions-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"bf65ad13397c94660867eb0205e06d1c9bebda4b019f632c0d0b8ef989930381","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["bf65ad13397c94660867eb0205e06d1c9bebda4b019f632c0d0b8ef989930381"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"bf65ad13397c94660867eb0205e06d1c9bebda4b019f632c0d0b8ef989930381\" already exists"}
{"level":"error","ts":"2026-11-02T21:18:23.027Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"d1d232e06f90d479cd9b802f24889e83af58c51cf54ba273d5e24dcb8a297688","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d1d232e06f90d479cd9b802f24889e83af58c51cf54ba273d5e24dcb8a297688"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"d1d232e06f90d479cd9b802f24889e83af58c51cf54ba273d5e24dcb8a297688\" already exists"}
{"level":"error","ts":"2026-11-02T21:18:23.094Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-model-routing"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\" already exists"}
{"level":"error","ts":"2026-11-02T21:18:23.160Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-catch-all-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"2f53b030326b8e1f5908c601aecd3fffcb6d08a8337d0bdc53ee1fc699a4cd71","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["2f53b030326b8e1f5908c601aecd3fffcb6d08a8337d0bdc53ee1fc699a4cd71"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"2f53b030326b8e1f5908c601aecd3fffcb6d08a8337d0bdc53ee1fc699a4cd71\" already exists"}
{"level":"error","ts":"2026-11-02T21:18:23.289Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"maas-gateway-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"maas-gateway-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:18:23.289Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:18:23.289Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T21:18:23.348Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"maas-default-gateway","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"maas-default-gateway\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:18:23.352Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"e2e-distinct-simulated-kserve-route","namespace":"llm","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"e2e-distinct-simulated-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:18:26.576Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","EnvoyFilter","HTTPRoute","Gateway","ConfigMap","Limitador","AuthPolicy"],"eventTypes":{"create":13,"update":6}}
{"level":"info","ts":"2026-11-02T21:18:26.638Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:18:26.640Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:18:26.668Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:18:26.668Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:18:26.668Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:18:26.669Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:18:26.669Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:18:26.669Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:18:26.697Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:18:26.697Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:18:26.728Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:18:27.655Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:18:27.655Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T21:18:27.775Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"maas-default-gateway","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"maas-default-gateway\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:18:31.057Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["EnvoyFilter","AuthConfig","HTTPRoute","Limitador","AuthPolicy","Gateway","ConfigMap"],"eventTypes":{"create":13,"update":6}}
{"level":"info","ts":"2026-11-02T21:18:31.120Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:18:31.126Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:18:31.165Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:18:31.166Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:18:31.166Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:18:31.167Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:18:31.168Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:18:31.169Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:18:31.186Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:18:31.186Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"error","ts":"2026-11-02T21:18:31.224Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:18:31.224Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:18:32.119Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:18:32.119Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T21:18:32.178Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"maas-default-gateway","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"maas-default-gateway\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:18:32.309Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig"],"eventTypes":{"update":1}}
{"level":"error","ts":"2026-11-02T21:18:32.497Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-completions-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"0e042276580ed8976d8ad3afd87a71640025c28b9b48f5c88eb159ec9998209f","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["0e042276580ed8976d8ad3afd87a71640025c28b9b48f5c88eb159ec9998209f"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"0e042276580ed8976d8ad3afd87a71640025c28b9b48f5c88eb159ec9998209f\" already exists"}
{"level":"error","ts":"2026-11-02T21:18:32.563Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-responses-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"7c924aa2b37ea38067b4e69052d541ea2e7c86fbdaa79b19f9ea09e87adbe4ff","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["7c924aa2b37ea38067b4e69052d541ea2e7c86fbdaa79b19f9ea09e87adbe4ff"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"7c924aa2b37ea38067b4e69052d541ea2e7c86fbdaa79b19f9ea09e87adbe4ff\" already exists"}
{"level":"error","ts":"2026-11-02T21:18:32.631Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-chat-completions-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"75fd86e2a4870af5fd78f2ad7aa2a9d79aff977b3678d81954b1e207a9315f2c","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["75fd86e2a4870af5fd78f2ad7aa2a9d79aff977b3678d81954b1e207a9315f2c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"75fd86e2a4870af5fd78f2ad7aa2a9d79aff977b3678d81954b1e207a9315f2c\" already exists"}
{"level":"error","ts":"2026-11-02T21:18:32.699Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-messages-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"2416d7b42d11a09d7152746be0e114f8fdc87d0fbd0efa9dec5b52b011082194","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["2416d7b42d11a09d7152746be0e114f8fdc87d0fbd0efa9dec5b52b011082194"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"2416d7b42d11a09d7152746be0e114f8fdc87d0fbd0efa9dec5b52b011082194\" already exists"}
{"level":"error","ts":"2026-11-02T21:18:32.765Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-catch-all-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"d303c788902ad4467c7ae545d65cbef45564d1c0d56396c93057df3909461aa1","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d303c788902ad4467c7ae545d65cbef45564d1c0d56396c93057df3909461aa1"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"d303c788902ad4467c7ae545d65cbef45564d1c0d56396c93057df3909461aa1\" already exists"}
{"level":"error","ts":"2026-11-02T21:18:32.831Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-model-routing"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\" already exists"}
{"level":"error","ts":"2026-11-02T21:18:32.897Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"726a74c13fee356e859d9317271facbb60b066acbc5571de22d056f13c60878f","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["726a74c13fee356e859d9317271facbb60b066acbc5571de22d056f13c60878f"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"726a74c13fee356e859d9317271facbb60b066acbc5571de22d056f13c60878f\" already exists"}
{"level":"error","ts":"2026-11-02T21:18:32.963Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-completions-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"c82a1a3dc2ce54c0b664f79a2cd895a3c40f774b3694999badae8cedd328292e","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["c82a1a3dc2ce54c0b664f79a2cd895a3c40f774b3694999badae8cedd328292e"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"c82a1a3dc2ce54c0b664f79a2cd895a3c40f774b3694999badae8cedd328292e\" already exists"}
{"level":"error","ts":"2026-11-02T21:18:33.029Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"4f800155f293f82eeaf5fd6a9553c0a1bee90f47a295bba8d7a04b3f11faea33","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["4f800155f293f82eeaf5fd6a9553c0a1bee90f47a295bba8d7a04b3f11faea33"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"4f800155f293f82eeaf5fd6a9553c0a1bee90f47a295bba8d7a04b3f11faea33\" already exists"}
{"level":"error","ts":"2026-11-02T21:18:33.096Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"596921ddc7ba8523386263c5cffcbd6ad9b6a385318ed7e24f72be06f36fc398","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["596921ddc7ba8523386263c5cffcbd6ad9b6a385318ed7e24f72be06f36fc398"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"596921ddc7ba8523386263c5cffcbd6ad9b6a385318ed7e24f72be06f36fc398\" already exists"}
{"level":"error","ts":"2026-11-02T21:18:33.163Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-messages-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"135ffad9bbcd33779a0b9a1c0dc5d5f547356be21489762803640aca855c728a","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["135ffad9bbcd33779a0b9a1c0dc5d5f547356be21489762803640aca855c728a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"135ffad9bbcd33779a0b9a1c0dc5d5f547356be21489762803640aca855c728a\" already exists"}
{"level":"error","ts":"2026-11-02T21:18:33.230Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-responses-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"23672b974f0dbc05100a34c78d2b029e41f1d5a3752f3fcb52915f56db360e25","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["23672b974f0dbc05100a34c78d2b029e41f1d5a3752f3fcb52915f56db360e25"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"23672b974f0dbc05100a34c78d2b029e41f1d5a3752f3fcb52915f56db360e25\" already exists"}
{"level":"error","ts":"2026-11-02T21:18:33.295Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"maas-gateway-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"maas-gateway-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:18:38.274Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Limitador","AuthConfig","Gateway","HTTPRoute","ConfigMap","AuthPolicy","EnvoyFilter"],"eventTypes":{"create":13,"update":6}}
{"level":"info","ts":"2026-11-02T21:18:38.339Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:18:38.349Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:18:38.442Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:18:38.442Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:18:38.471Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:18:38.471Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:18:38.472Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:18:38.473Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:18:38.473Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:18:38.473Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:18:38.533Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:18:40.287Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:18:40.287Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:18:40.484Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway","HTTPRoute"],"eventTypes":{"create":1,"update":1}}
{"level":"info","ts":"2026-11-02T21:18:40.727Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:18:40.727Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:18:40.729Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:18:40.730Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:18:40.730Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:18:40.730Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-11-02T21:18:40.786Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:18:40.786Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T21:18:40.794Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-responses-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"0829dbf2b5dc0900de272826295adf351de381b46fa6fba00b896213530780f6","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["0829dbf2b5dc0900de272826295adf351de381b46fa6fba00b896213530780f6"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"0829dbf2b5dc0900de272826295adf351de381b46fa6fba00b896213530780f6\" already exists"}
{"level":"error","ts":"2026-11-02T21:18:40.868Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-responses-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"92917da87eaba4f2684cd45947a3698434b99ff4ca6d3ddde51d6573aecb1600","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["92917da87eaba4f2684cd45947a3698434b99ff4ca6d3ddde51d6573aecb1600"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"92917da87eaba4f2684cd45947a3698434b99ff4ca6d3ddde51d6573aecb1600\" already exists"}
{"level":"error","ts":"2026-11-02T21:18:40.935Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-responses-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"3167d3bf853032a93e8569019dcd3e5aa33af9cb580cf9ca138990567fc9d857","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["3167d3bf853032a93e8569019dcd3e5aa33af9cb580cf9ca138990567fc9d857"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"3167d3bf853032a93e8569019dcd3e5aa33af9cb580cf9ca138990567fc9d857\" already exists"}
{"level":"error","ts":"2026-11-02T21:18:41.004Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"5e4821ff903ad6ca2e1c42162432e34d8b0a2a78052961e753d36b742193432f","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["5e4821ff903ad6ca2e1c42162432e34d8b0a2a78052961e753d36b742193432f"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"5e4821ff903ad6ca2e1c42162432e34d8b0a2a78052961e753d36b742193432f\" already exists"}
{"level":"error","ts":"2026-11-02T21:18:41.009Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/maas-default-gateway","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T21:16:03Z","generation":5,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"371b36ef-c4b7-499a-87db-1bdf4e8f92de\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:18:31Z"}],"name":"kuadrant-maas-default-gateway","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"maas-default-gateway","uid":"371b36ef-c4b7-499a-87db-1bdf4e8f92de"}],"resourceVersion":"20334","uid":"86b5bad7-2bb7-41c9-b2c7-bb4c8f13292a"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"61b044087f8d56658ae99d15d4fab3cf1ad74e6636795c133e054a5aace0540d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e511d90f2140d9cde0b2100a0a488dacadd8f510bb901601d5e6fd25343a0f1c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"1e42d143d6033a677e2aa0de97c78600094e515d7c0d3f86b4925ef8be636163\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"26b7799af8a40e8b9585c255ec018a63b0074c27282d4dccebed45f14e703b5e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"ce74c295ef1588342c7308478a1dc6f6aa2cefc063e489a124e536ac32ecfdba\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"fbe95a07558afcf05ef68ff5beb293f527d6ab93dfe79956b5406dc463d78363\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5322619ef71b1d1ea3204f9014d0341d4402275b6ca23fca69d61cfc9a61e883\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"16b86e50920afda06ca195a717436238f5fca7f2e1bbe0939875bcb7d559cf31\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5da9070dfa3a5637213b5443376170dda26f57f381af542891ff3b19cc7a9d06\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"00ac1aeee65e93fab2ccfd89c11167f4d954e1cfb3e8b09ad3371a4fab4b6369\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"55c23b9552cb66c175ed2202220df6480eae89be2cda2e925458acf31c5bdbce\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"99f16470bd82ba57465b128d1c0fe73ef189001d77c6ead3fc34c98ad3ce27a2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4902f5a84509d49ec2fb75275af9692b524b1334f7c919eff1d9f33957acd5c4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4f0e9d14c4d1857d5415458306310b00d6a94ce68179c717917d13d30ede9b87\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"29d1c55f30b76c66bfb15588c297271fac7d5e9ca415f0c938d63e524a8187e5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"df729ecdaa88f0abfee16b94ea7be9c5aa7ccdfe91fbe0676e22ca4bfae35f29\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"69baf76a5f2e8f4f8d3e40025586b942794274a22455dc40e0b7c0116f0d2297\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"8199294e302361a6898546d62809d67d522e9c2b375c8b8727f0d966f7ad4d39\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"c19d17a63dc280a83fa4dce8ef0f825a16118c6817d3126d095473335018edd0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"05aa8311318e9111c5925f4be454406e209ab832bc6e8ddf01725ebe4f1ffdcc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e680857c19914d59f115788ea93836704a1ddab04f5e495bf863d62ad8a5aa8e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"96b761d418352e3f8d172aa80bfb5542df670414bec97704e615f2e3e665c8aa\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4a199d441e37ffe8d62509ae7048cfd055df0de5619e9be81a8f47f9a64a7051\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"f17cbb57db714a7faf03a7e4ef3921069096709486e13c6b84b4b75ded84ca96\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e5b5be5a42ead835fa1a13840fda21cf5afb14b8226da9a3008a321db777f685\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"a01c6bf1aa626b04ec6a9fc85abb6ced9b4a9c4cafe81d2176013cf3b0b4c4aa\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"0eb9568cf0385cf054d8f3ebcce089d8b225a9fe1b6061e3689f7bd26415f872\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"633e4cdca29207ccc8220565a86635db5bf3f227ef564ee1a0da6a5d6076231e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"ecaead2c94524df89be70a7c961f93dee41ef96545655d22914542a89dffe341\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b9f3d06eb6a92218fa1757dab6cb8e66e42102d46c94e6c0db854f694d6d855c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"3dbcd4467449162cad999d40988202fafebe535215351d004f1bf05937c76508\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"534f6056dec477fad33defb3049c84dc5497dacd9f6e3f2061b13ba089ed1cbd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"fa823b540319ebed6b9b488f79dda81b66933f7e616cfdaebe3543ae31b33b13\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"fb6ca2eee2169356e662d36e92b2b679a1235a86d976f9807297ad56386f6e2a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"0427c8054235bfb15b63a5a467ab470ce1cca867b5a232117e73059a4ec8891c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4aa2417057e81c2889811e45d786ab1591e3dfafc889b838aad26a3ec2cbfe9b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"acb4b8def068bc86711642e3242fd621a66a54452bf86a82586fc6bf69e8192b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"66831c252eeacbf3e19995c48be4a005b1726766550076c58cb47b979bece639\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"a80090acc18b7b092f5e9f2d49fd8643f16514df89a716f8f69afe4a7afebb76\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"f85e753996f9e90384b461c5504814ca0cada63ea0f44d6630a619ab36edbe08\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b72a3d2d64d0ddc05f076a7fcf59d924552b45080846c09e1084e67867a76e9c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"cd58d9e2c4a744adbc8ab336cd016f27bc1f14a1de2e975afa26b7f5113d1bfe\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"014f0c5a15872002db778e7e40dfcf7dede4ab2db05bb6a08641f5d523cb3afc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"bdac37244e7b891cd2973e74c7b0db5110c344505a09a86e51fc6486ba35139d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"ea8a88726b68ceff7de514d89e12df024a67856b697e02c26b6e762395fdaf0d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"81df9bef1abee093a91a2eaab4b1a53122eb16d4150f27c879439ca5d99112f3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b3be2474c46178c0c39839b29d8d7c87b103574b042bb23175ac0e9786fde158\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"13fe2d56bb22ec9a1307da7bad05cdda8724fe788533352aa581ffdc96874c78\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7def4ca304ff3869be64c2c02523fd9d2ff43465099dcd1124399f293eb4480f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"a86375603000eab9b808785894e0e63f3e53024a46681e97c41a06c4e0c67023\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"54eea38241838159e47386cb814ad20fc30631ee8c42d57f0ff8da80fbbf62a0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"d5b69938a04a8020c8a8d10df4921f2989326ca4811c3843a7201bdb1d5cb848\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-unconfigured-model/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c5a685f2a5ebdef5f1dee488990c0798a45ddce399cf99e7d0c505a5f46c69ac\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"0fcfc87f76b773c6a38375e46d76e569a372370e3ae2e7003932ed8ef776f5bd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fac07f302f653115fda3d376325a268abaf66025ed0e4af73e88bea3f41fe933\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"aa28eac51fc5e37c385a11a534759b09fb7998ba74bb01195dd8ff89d9e9ec43\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model-2/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ad8714d3b8aed2a9ffd68fbcf0288557e9c1c059c1b59ad3e9a09910b37fd61b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"c4353817d988db43a8dd6b0d5c29305f9dcda76e19c9ef2c820808b0384a0bf4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-embedding-model/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"726a74c13fee356e859d9317271facbb60b066acbc5571de22d056f13c60878f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"1415e0d2aa117656e44a7d6aeaaf16aa87f18bdeee129f7e6757b2e1c7f996d3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-trlp-test-model/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cad6ab5a81a65fd4cb03a0fefdab5de82aa18c30a5b95078b1d05214b0606f40\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"0629facd48a81e3c82281be4a3f8566f55e61d1a30a8516b23bbb63c58e8f6f8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e5f81c7f7812462ebef000c68dc043013159f22201d2eeecf05c220e809f96ed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"2e292ccc99f990aa723c04a99267923f5b62fb8f3e0ab1a978e8334b9397ada0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-unconfigured-model/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"68502d1c1143a647ad56f2759ea89a4c5b3c74a8054739f7e7ea9ba6535e3b74\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"2b69b629cb2b5224adc61a8925f43333ba0b52ab39260c124057e9e82898937f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"74b47f1aa1203aad58596cbaab10ae46e8fddd08ac49eb57a26bdba532d88e72\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"d1e427bebfc099de9df176c73ee76d5dbd6f77919e840913d3a10818678c7394\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model-2/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3167d3bf853032a93e8569019dcd3e5aa33af9cb580cf9ca138990567fc9d857\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"482d2a79771eafe7f8d177701f43a13c6c4916251440ca00830042e050247443\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-unconfigured-model/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5d590119308c6f848b12dd3ecdfb1b06cc2fe172af702455c342075944a045ff\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"caf1a50009b65f25df3a996283d38ada17bb57a2ebed842a552f137f6121c63a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-embedding-model/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0e042276580ed8976d8ad3afd87a71640025c28b9b48f5c88eb159ec9998209f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e17697b7e023603155a06feebe0602591826e794ee2f5189abf795c259be1b37\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-trlp-test-model/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0829dbf2b5dc0900de272826295adf351de381b46fa6fba00b896213530780f6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"1e772a79f4b1660c75cf3493e21c9ddb58d2de640363115c57dac03a10f22c33\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cc1ffc2ee4e05618c28c108cac668c0c02eb8e658953439e47a733edab44a1a0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4fe1d1c6df78a26f30e2392ae9da7fc67b0845dfda48a89e247bee6aa536d8e1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-unconfigured-model/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"486615827938fa99814e929fe7dc62bc16f7563179fef855074eb73dc7ce4724\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"ee2f6a8baeba450552a3e168b9df1808bba4e2c59106ad0881ae78aee4fcbd40\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-echo-model/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"98ec9d74d07c88c1e6923ed1cbafd4c5b41bf1763b3a942282f964f72425ae57\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"653f23106eb8a10791805e2f9355c750c56aa6873ef311fe707e76083d93d55d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model-2/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2ddbced6f2f51d410743da1d9db1257d0006d99f38986dd7cc7efd26620791ad\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"1e776cd43733621e16ebc27c91dbdeea062f73e4dde2f494701c85a6843faeed\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d752a44ad8df3a50b5a1147110eb89039ed764e1fed197b1f77e0935c424a90b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"62f67bf9885222d9a86a95e02ed17ae26ad7cf71e15aae0a7517e647c29618ca\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"67c67ce733de50e7b3d797bb248036b01badfe02e958f5f76af05b58a504989c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"f9b414e31cae5d16cc1ad22ba2462b8816d9369a97316f40f32a6e7912fc4f78\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model-2/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2d4a2275e6cbab5c26d5c3cf2d75aa2776066390e5b66f5498b16b26bc596af7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e33110b3dae1dd80b2bfa573def0b488a6fd4f1243962fe81d58e1853ed2d3f5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-embedding-model/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"23672b974f0dbc05100a34c78d2b029e41f1d5a3752f3fcb52915f56db360e25\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"a6183db94e49e3ba0149a19f4e52ff19aebb55d6261b0cacec0656136bd2adf4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-trlp-test-model/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1704c6bc15d6f547acca888061680f2275f690cb79e5af6fee44747bcf278b95\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"6a8319194e2c2fc998268cdbab03a5aae2d83019f5ac30c316c4e548895b7c63\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"eaeb360b41b3f9e0bd6b247d4dae3eef1ffc3355d6e9408df3f8f71bc7f033b5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"32cfee4e66c307d5ebed6a406d2260f4374553d184b5486fc53cb64bc6ffcd8d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-embedding-model/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"135ffad9bbcd33779a0b9a1c0dc5d5f547356be21489762803640aca855c728a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"3194cef788c3fa9898599a57480aeaed07c6eac2edf957788235b37d22918588\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-trlp-test-model/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"17002b7f0c8e62582ad262d9c2b8b038ee7f2a9327fe34f21fd4f47134b7b8cf\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5acde2b886749c1c54f99db5c33887e6fc5ed0caf412daacfb5df0f329882c66\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a6a6232fd5656520e75d100c41add5f1637dde9705a4ec608bbb90b724c258a5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"37a71c27032e51fdbc7ca688064a47abb86230a8138af6eb55e8069fad975a93\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-echo-model/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"92917da87eaba4f2684cd45947a3698434b99ff4ca6d3ddde51d6573aecb1600\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b2b26e0af9ad7defb486e5d1db19af6bbdd0998559d16f3776651669aeb4d067\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-echo-model/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"dc061bec60bd28b1c132bf30965b4810124429576337bcc4a6030617600d1714\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b188b939a496049e47b8ef664d7c7c490722f1753404a08d89ccec1dcb87b8fa\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-echo-model/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3386c5e86c72abcdab369776ccd7182024ab8681cbe497e81724868f101a3c0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"58e90354179740b1af406b2911c9997f3f3283475aeb77ce7918f3b3239a293f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9e75e9fd02f51c2f043b145c5d6b82e95f1447b388ee529262aea27a6a2774ef\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b89d1075a79c93acaa097e4e6db4d6a4b23bf3ffe5e964409e29b258ed725a99\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-2-simulated/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0913a452a02695c6681f1037232199b40b64236fed4d29cdbb41561695826340\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5c0b495d1a10c1cf1548ef17998cb18c0ca25371ad42d5ffe1aed42bd55e31ad\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-unconfigured-facebook-opt-125m-simulated')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"010adf02b2e7deb40c572f4729b6dd4619847c8e6344137326b72df28772fc1a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"c04f8a7c7387e6794115c41161cb001d8a07340d2878cb8f36774a8f6a200ba4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"105cf4dd91a8abf4a93abd65b255521c3d37b560b5d23f3ec59757b5b362fae6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"7e7d1a0ec6d957a4d4de94f93078f10e836b23442c9cfa90f11c8520cca12e87\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-embedding-simulated/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"75fd86e2a4870af5fd78f2ad7aa2a9d79aff977b3678d81954b1e207a9315f2c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"c3cfc634a11046a837448628e2f17db0ed3466194da289a808544d874ecf6451\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-trlp-test-simulated/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bf65ad13397c94660867eb0205e06d1c9bebda4b019f632c0d0b8ef989930381\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"d8d67afd40f17474755bd3f6b00e265761bf5154febca129bc3f2b0bcd749c41\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-simulated/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f9fa9cfc2b4e701183573419a92c79384cd30210289602f0115c75c5029d55aa\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"ac2105eead12bb02dd7d1691cc77fc8a580b903f98564a8fd585dfa345dec1dd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"596921ddc7ba8523386263c5cffcbd6ad9b6a385318ed7e24f72be06f36fc398\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"f4ae34c5c82a0969651301a535f404653a60a5d75f20c7ea56ad9bb89b67e9fb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8d5571efc1d304f5bcfc2ffb4ac6819154ba5556c29ce33416d460b887427984\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5d6b359055267732253f201a1fe48f0abe6d5e22b011c70e1cb006eea672f535\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a402d1681ab35bace735c19b1d084a86eb3d741d4e1c14371cfdaa55d22c3ebe\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"7320c049419b863194fd55db5ebd887462dd24e1289e6308d79f047431f2bed9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-2-simulated/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a9800464506c58f005016df354e160757732171ff4d19747202524955329b998\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4984a24eb707d1b965a79974a98ed4afc271f2ca356b150cbc8943de1ddcfef8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-embedding-simulated/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c82a1a3dc2ce54c0b664f79a2cd895a3c40f774b3694999badae8cedd328292e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"276f5d5d67b2bd83c05c2b39e4a262885498e6807e3129a866eff0651b3604a9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-trlp-test-simulated/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"669658556fba0f45c2a82def2f57614416614ddf154ed8dc5f4f9188f10130f2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"692f39321f892929348fe56801dc14c8a35eaf749609a3a5f4b5e684edddf17c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-2-simulated/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c4399a95e89654e5b2bb5fabe45bc947d11ccd1448ebf64c30b195b34f239d58\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5b273834f06c6341dd07bba6c809b3297ba2514e6d3b9b5d0f4f8211c68ccf8b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-simulated/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5e4821ff903ad6ca2e1c42162432e34d8b0a2a78052961e753d36b742193432f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"f35ed2fb168a3a608435006c8c1b103242765d7d37f41bf1dbdb7bbc0331da89\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a91faccafad197e2a4065ce3d12a052ac484d2e8fb2fc9265ee48f02b28e6dce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"fbfd0ada86117ffb0a134e591bf8b8390012983d25496ef188c6da73fef5eaec\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-2-simulated/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0020c64019ffd1a0bdcc75e6441e6a30e6d8bb08f463f67bd2408a1e82b95b2a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e78a4964c93ec23890e62f7f50201f5b832b4c714066a914dc734d8ef60e8213\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-embedding-simulated/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7c924aa2b37ea38067b4e69052d541ea2e7c86fbdaa79b19f9ea09e87adbe4ff\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"d5cf96eeeaa56bb891ea0cba28f7beabf17a8c0f061ea01c768ed842dd26334f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-trlp-test-simulated/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"028a8b5bd5d4e690eebb2f20c5fd47cf0b3c6e2a3619ba9e55322bbca7b94cc3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"8fe4100eab1f023f5b06dd8e19bcc80109b82503466d49576acc234cdda9bf0e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-simulated/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"80056c658070f49140955cb6eabdbd252857a614af6b0f2f2de7a1ab1cd47949\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"53aad0199369eb8c8f787ea099e93092089c04344e8f910dcff366f54bc831cb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-embedding-simulated/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2416d7b42d11a09d7152746be0e114f8fdc87d0fbd0efa9dec5b52b011082194\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e0cfec53d1f17771317082d9a7d69806ae3468971bac79a1135f2b0d51ecdc07\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-trlp-test-simulated/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4d18a96899c43d55ee63d2ae1a7a938c7e873d88b2fd95f06b2e3aae2c7f1c84\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"44e38055536c3f0d49cb81abb42bfefcf2c78faf963a6160afbe459bbc04db39\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-simulated/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8d34bd12ba2030284fcb69127f53b8158bbdd4a1432bfe619165b4c2c96cc061\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"c9dd9c233e43b53241ee27e937246e51b8f3331f30a7fba22640617c1b0bf47a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/echo-simulator/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"319e246831bdaf5e765e63d5511b516594fd2b64527850e2ddabd2a4a85532ea\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"7cfd2ed5cb8a5913fa5f55b92b02805c6778991c01c80eb14a0962cc710a56ff\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/echo-simulator/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a8c8220ad6f1387002e262ace5db78a2c4bb39e5953306702a228215174f6796\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"87e1712d02794c6d66ec1a932f02901d7a4369f46d0f041178cd3efadb7f59b7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/echo-simulator/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3f23315aacd6e16f4ab41f96aeedc9549d1abdfc9476577a47d45d12875dec5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"165d3b8e224f71685dee07aadd133117aeeed097eae99437d561d5bfa2d22233\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/echo-simulator/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6687eb3cec74c6c51428ce3f3d22d50ba269f59015d1bc8f185da49eb095534e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"05ac0e89d0298398d3996609d7c22b514bdf08bfa3787653bc739995c5942441\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-2-simulated')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bfd36c5ed73eb81df97258ffa1aa36d8cbf6f3e7a8096c33ca4ff417be59d002\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"d5ac583036f3821c88111dd82571eab1fc94aa4e9fcd045b27336f798e26075d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-embedding-simulated')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d303c788902ad4467c7ae545d65cbef45564d1c0d56396c93057df3909461aa1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4a6b0d84cc35c0f532405eea81056481fd54e7ad71284a97ce8f6a2424eac819\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-trlp-test-simulated')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2f53b030326b8e1f5908c601aecd3fffcb6d08a8337d0bdc53ee1fc699a4cd71\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5c3bcd9fb119b0fd45f3b4ba5de5f905cacbb4963fec309a0961a40f76a7a7a9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-simulated')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"94ddc5e77f082c32bebc7a36bcebf621518ebf303e83b9c540da1352d04e620b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"50057c9a2acf4ae7152e8c97f7778cb04340d1470974e5272422d0bf244a4e5c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/echo-simulator')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c6918972d1a7f8ad5201880b7d6d9c1191ca1f25376682f691def7868e3fd02\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"01cc37113b4d6c301e355f63decf46a21e93a023494bdfeaeed2890c97ec1f57\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a82769ff87473da04c27497e160e9b4b1a5dd93578e0cf2342be8b2f06845269\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e747b72d92315b743934153588614b27670cf0c9d9dc4fb380ea4965def7f235\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"06b05a8e4dd69bdc4f333ad9509ee8cad3c5c0f5dd48edbe94c1158b60f79ed3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"661962837510c6dc6d1faa64e61ec3086efa9e0a2e7315c6ded616c1879e5ba8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b4bfec1b33959dd0ebfc5cd6fb410688e820d4b55c7f149cb4acc4353f30a9b2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a7740f6e77d024a437502c023fb1d8939cb3cc2b9ed7f4073af7d779e19459eb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"f82564e076ea3e672592bab71e048537faba17a5e909884c2a0204e235905a69\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a908063c86927e6bf07b7d793aad9f277ac3c2a8f5f5d468b116cb9e07929b14\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"fbdfff5b213f506d78434055d011cf63d616653e502ee04408a43578986e1e5c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d1d232e06f90d479cd9b802f24889e83af58c51cf54ba273d5e24dcb8a297688\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b49f2d7e152d4de959577465d2494ee11771b4c439cb6eae71c90bff26224fb4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"810f299b76daf089b33c92cfbe0445ab5cc89a48d38e36df0cc89ed6cd1fe8df\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b27d6255cac73fc039120e157e1f3ce0e99e86995ac5a66974d5e8744df6c64d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4f800155f293f82eeaf5fd6a9553c0a1bee90f47a295bba8d7a04b3f11faea33\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b1ccc7ca46f6a14e90afe1dddfab8763f07f30549ce1cda0bae985581f063098\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ce7d381faee9ff949d68d825ffa1dcb9247dad19667ec59a8e91847320dacbe0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5d72fc7cc241ffd60d83142a900be014cc5d57320142e013493b21ecc86cb534\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6565c4085b3917d5390fe1b0194fb3d8319f1d56b45867e3c68ff740b5c16ef3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"be1ccea8a4cc19c7190600de6631fcb661b63db81e2862348a6ef4f90bf33fa3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"maas-default-gateway"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-maas-default-gateway\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:18:41.070Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"486615827938fa99814e929fe7dc62bc16f7563179fef855074eb73dc7ce4724","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["486615827938fa99814e929fe7dc62bc16f7563179fef855074eb73dc7ce4724"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"486615827938fa99814e929fe7dc62bc16f7563179fef855074eb73dc7ce4724\" already exists"}
{"level":"error","ts":"2026-11-02T21:18:41.139Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-model-routing"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\" already exists"}
{"level":"error","ts":"2026-11-02T21:18:41.205Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"3386c5e86c72abcdab369776ccd7182024ab8681cbe497e81724868f101a3c0c","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["3386c5e86c72abcdab369776ccd7182024ab8681cbe497e81724868f101a3c0c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"3386c5e86c72abcdab369776ccd7182024ab8681cbe497e81724868f101a3c0c\" already exists"}
{"level":"error","ts":"2026-11-02T21:18:41.272Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"54eea38241838159e47386cb814ad20fc30631ee8c42d57f0ff8da80fbbf62a0","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["54eea38241838159e47386cb814ad20fc30631ee8c42d57f0ff8da80fbbf62a0"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"54eea38241838159e47386cb814ad20fc30631ee8c42d57f0ff8da80fbbf62a0\" already exists"}
{"level":"error","ts":"2026-11-02T21:18:41.338Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-messages-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"3f23315aacd6e16f4ab41f96aeedc9549d1abdfc9476577a47d45d12875dec5a","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["3f23315aacd6e16f4ab41f96aeedc9549d1abdfc9476577a47d45d12875dec5a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"3f23315aacd6e16f4ab41f96aeedc9549d1abdfc9476577a47d45d12875dec5a\" already exists"}
{"level":"error","ts":"2026-11-02T21:18:41.405Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-completions-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"a6a6232fd5656520e75d100c41add5f1637dde9705a4ec608bbb90b724c258a5","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a6a6232fd5656520e75d100c41add5f1637dde9705a4ec608bbb90b724c258a5"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"a6a6232fd5656520e75d100c41add5f1637dde9705a4ec608bbb90b724c258a5\" already exists"}
{"level":"error","ts":"2026-11-02T21:18:41.471Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"6565c4085b3917d5390fe1b0194fb3d8319f1d56b45867e3c68ff740b5c16ef3","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["6565c4085b3917d5390fe1b0194fb3d8319f1d56b45867e3c68ff740b5c16ef3"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"6565c4085b3917d5390fe1b0194fb3d8319f1d56b45867e3c68ff740b5c16ef3\" already exists"}
{"level":"error","ts":"2026-11-02T21:18:41.537Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-catch-all-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"94ddc5e77f082c32bebc7a36bcebf621518ebf303e83b9c540da1352d04e620b","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["94ddc5e77f082c32bebc7a36bcebf621518ebf303e83b9c540da1352d04e620b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"94ddc5e77f082c32bebc7a36bcebf621518ebf303e83b9c540da1352d04e620b\" already exists"}
{"level":"error","ts":"2026-11-02T21:18:41.605Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-messages-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"cc1ffc2ee4e05618c28c108cac668c0c02eb8e658953439e47a733edab44a1a0","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["cc1ffc2ee4e05618c28c108cac668c0c02eb8e658953439e47a733edab44a1a0"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"cc1ffc2ee4e05618c28c108cac668c0c02eb8e658953439e47a733edab44a1a0\" already exists"}
{"level":"error","ts":"2026-11-02T21:18:41.672Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-completions-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"e5f81c7f7812462ebef000c68dc043013159f22201d2eeecf05c220e809f96ed","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["e5f81c7f7812462ebef000c68dc043013159f22201d2eeecf05c220e809f96ed"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"e5f81c7f7812462ebef000c68dc043013159f22201d2eeecf05c220e809f96ed\" already exists"}
{"level":"error","ts":"2026-11-02T21:18:41.739Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"ce7d381faee9ff949d68d825ffa1dcb9247dad19667ec59a8e91847320dacbe0","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["ce7d381faee9ff949d68d825ffa1dcb9247dad19667ec59a8e91847320dacbe0"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"ce7d381faee9ff949d68d825ffa1dcb9247dad19667ec59a8e91847320dacbe0\" already exists"}
{"level":"error","ts":"2026-11-02T21:18:41.805Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-chat-completions-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"c5a685f2a5ebdef5f1dee488990c0798a45ddce399cf99e7d0c505a5f46c69ac","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["c5a685f2a5ebdef5f1dee488990c0798a45ddce399cf99e7d0c505a5f46c69ac"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"c5a685f2a5ebdef5f1dee488990c0798a45ddce399cf99e7d0c505a5f46c69ac\" already exists"}
{"level":"error","ts":"2026-11-02T21:18:41.871Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-completions-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"319e246831bdaf5e765e63d5511b516594fd2b64527850e2ddabd2a4a85532ea","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["319e246831bdaf5e765e63d5511b516594fd2b64527850e2ddabd2a4a85532ea"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"319e246831bdaf5e765e63d5511b516594fd2b64527850e2ddabd2a4a85532ea\" already exists"}
{"level":"error","ts":"2026-11-02T21:18:41.940Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-messages-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"dc061bec60bd28b1c132bf30965b4810124429576337bcc4a6030617600d1714","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["dc061bec60bd28b1c132bf30965b4810124429576337bcc4a6030617600d1714"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"dc061bec60bd28b1c132bf30965b4810124429576337bcc4a6030617600d1714\" already exists"}
{"level":"error","ts":"2026-11-02T21:18:42.007Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-catch-all-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"0913a452a02695c6681f1037232199b40b64236fed4d29cdbb41561695826340","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["0913a452a02695c6681f1037232199b40b64236fed4d29cdbb41561695826340"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"0913a452a02695c6681f1037232199b40b64236fed4d29cdbb41561695826340\" already exists"}
{"level":"error","ts":"2026-11-02T21:18:42.074Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-responses-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"a8c8220ad6f1387002e262ace5db78a2c4bb39e5953306702a228215174f6796","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a8c8220ad6f1387002e262ace5db78a2c4bb39e5953306702a228215174f6796"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"a8c8220ad6f1387002e262ace5db78a2c4bb39e5953306702a228215174f6796\" already exists"}
{"level":"error","ts":"2026-11-02T21:18:42.139Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-model-routing"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\" already exists"}
{"level":"error","ts":"2026-11-02T21:18:42.205Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-completions-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"68502d1c1143a647ad56f2759ea89a4c5b3c74a8054739f7e7ea9ba6535e3b74","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["68502d1c1143a647ad56f2759ea89a4c5b3c74a8054739f7e7ea9ba6535e3b74"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"68502d1c1143a647ad56f2759ea89a4c5b3c74a8054739f7e7ea9ba6535e3b74\" already exists"}
{"level":"error","ts":"2026-11-02T21:18:42.271Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-messages-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"d752a44ad8df3a50b5a1147110eb89039ed764e1fed197b1f77e0935c424a90b","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d752a44ad8df3a50b5a1147110eb89039ed764e1fed197b1f77e0935c424a90b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"d752a44ad8df3a50b5a1147110eb89039ed764e1fed197b1f77e0935c424a90b\" already exists"}
{"level":"error","ts":"2026-11-02T21:18:42.342Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-chat-completions-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"8d34bd12ba2030284fcb69127f53b8158bbdd4a1432bfe619165b4c2c96cc061","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["8d34bd12ba2030284fcb69127f53b8158bbdd4a1432bfe619165b4c2c96cc061"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"8d34bd12ba2030284fcb69127f53b8158bbdd4a1432bfe619165b4c2c96cc061\" already exists"}
{"level":"error","ts":"2026-11-02T21:18:42.408Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"maas-gateway-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"maas-gateway-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:18:42.472Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:18:42.472Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T21:18:42.535Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","namespace":"llm","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:18:42.595Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"echo-simulator-kserve-route","namespace":"llm","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"echo-simulator-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:18:42.653Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"maas-default-gateway","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"maas-default-gateway\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:18:47.876Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","HTTPRoute","Gateway","ConfigMap","EnvoyFilter","Limitador","AuthPolicy","TokenRateLimitPolicy"],"eventTypes":{"create":26,"update":7}}
{"level":"info","ts":"2026-11-02T21:18:47.939Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:18:47.950Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:18:48.063Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:18:48.063Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:18:48.068Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:18:48.069Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:18:48.069Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:18:48.070Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:18:48.072Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:18:48.073Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-11-02T21:18:48.129Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:18:48.129Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:18:49.940Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:18:49.940Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:18:50.169Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","Gateway","HTTPRoute"],"eventTypes":{"create":2,"update":1}}
{"level":"info","ts":"2026-11-02T21:18:50.450Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:18:50.451Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:18:50.451Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:18:50.454Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:18:50.457Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:18:50.458Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-11-02T21:18:50.535Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:18:50.535Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T21:18:50.535Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-messages-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"f9b535aed6243496a67741936e53a0d303bea1b872a06fb62f1f9c27150edc40","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f9b535aed6243496a67741936e53a0d303bea1b872a06fb62f1f9c27150edc40"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"f9b535aed6243496a67741936e53a0d303bea1b872a06fb62f1f9c27150edc40\" already exists"}
{"level":"error","ts":"2026-11-02T21:18:50.608Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-responses-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"75612d85af2bae456dadd78163b2d2f9015c0a0bf4e20bcb8a555e6a5ab3b8c0","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["75612d85af2bae456dadd78163b2d2f9015c0a0bf4e20bcb8a555e6a5ab3b8c0"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"75612d85af2bae456dadd78163b2d2f9015c0a0bf4e20bcb8a555e6a5ab3b8c0\" already exists"}
{"level":"error","ts":"2026-11-02T21:18:50.691Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-completions-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"99606c4eac496429be47144db9f3f48867815df12eb99d7be8073b767d7e44de","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["99606c4eac496429be47144db9f3f48867815df12eb99d7be8073b767d7e44de"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"99606c4eac496429be47144db9f3f48867815df12eb99d7be8073b767d7e44de\" already exists"}
{"level":"error","ts":"2026-11-02T21:18:50.759Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-responses-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"a4493fc88328eba553ef36791fbf4706bffae04a1ac501d099b12309ebc85c6b","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a4493fc88328eba553ef36791fbf4706bffae04a1ac501d099b12309ebc85c6b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"a4493fc88328eba553ef36791fbf4706bffae04a1ac501d099b12309ebc85c6b\" already exists"}
{"level":"error","ts":"2026-11-02T21:18:50.828Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-completions-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"aa7038625b8f43b0c002f79637065e5ab90468f50f998759d08f2c4640c07c04","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["aa7038625b8f43b0c002f79637065e5ab90468f50f998759d08f2c4640c07c04"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"aa7038625b8f43b0c002f79637065e5ab90468f50f998759d08f2c4640c07c04\" already exists"}
{"level":"error","ts":"2026-11-02T21:18:50.896Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-chat-completions-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"2d953f7313807988e63546aa32431d96f77e6989c672f8ab42827c1c21918630","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["2d953f7313807988e63546aa32431d96f77e6989c672f8ab42827c1c21918630"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"2d953f7313807988e63546aa32431d96f77e6989c672f8ab42827c1c21918630\" already exists"}
{"level":"error","ts":"2026-11-02T21:18:50.914Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/maas-default-gateway","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T21:16:03Z","generation":6,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"371b36ef-c4b7-499a-87db-1bdf4e8f92de\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:18:38Z"}],"name":"kuadrant-maas-default-gateway","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"maas-default-gateway","uid":"371b36ef-c4b7-499a-87db-1bdf4e8f92de"}],"resourceVersion":"20513","uid":"86b5bad7-2bb7-41c9-b2c7-bb4c8f13292a"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"61b044087f8d56658ae99d15d4fab3cf1ad74e6636795c133e054a5aace0540d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e511d90f2140d9cde0b2100a0a488dacadd8f510bb901601d5e6fd25343a0f1c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"1e42d143d6033a677e2aa0de97c78600094e515d7c0d3f86b4925ef8be636163\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"26b7799af8a40e8b9585c255ec018a63b0074c27282d4dccebed45f14e703b5e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"ce74c295ef1588342c7308478a1dc6f6aa2cefc063e489a124e536ac32ecfdba\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"fbe95a07558afcf05ef68ff5beb293f527d6ab93dfe79956b5406dc463d78363\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"40a29ce438b5ca497e4389ce52025a9b91c0cf3177b1bd5c8519b041cfdcf75f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"845137604829fbc62550504d7bbe5ae8d55ea1cf474160cd789a72e811000e4b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5322619ef71b1d1ea3204f9014d0341d4402275b6ca23fca69d61cfc9a61e883\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"16b86e50920afda06ca195a717436238f5fca7f2e1bbe0939875bcb7d559cf31\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5da9070dfa3a5637213b5443376170dda26f57f381af542891ff3b19cc7a9d06\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"00ac1aeee65e93fab2ccfd89c11167f4d954e1cfb3e8b09ad3371a4fab4b6369\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"55c23b9552cb66c175ed2202220df6480eae89be2cda2e925458acf31c5bdbce\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"99f16470bd82ba57465b128d1c0fe73ef189001d77c6ead3fc34c98ad3ce27a2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"a6d134df42d4d90d93840f63dc770cadabd22dc22af01f991b6c067e96733c95\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"0be74a5083c4760789001949965ce7020664f6347b769f9f20735f95f9d34989\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4902f5a84509d49ec2fb75275af9692b524b1334f7c919eff1d9f33957acd5c4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4f0e9d14c4d1857d5415458306310b00d6a94ce68179c717917d13d30ede9b87\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"29d1c55f30b76c66bfb15588c297271fac7d5e9ca415f0c938d63e524a8187e5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"df729ecdaa88f0abfee16b94ea7be9c5aa7ccdfe91fbe0676e22ca4bfae35f29\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"69baf76a5f2e8f4f8d3e40025586b942794274a22455dc40e0b7c0116f0d2297\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"8199294e302361a6898546d62809d67d522e9c2b375c8b8727f0d966f7ad4d39\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"61ef91ec2e76cc107813a7351d7e38bb32d1ebbff452efa771b01f8a512fb99e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"f2d9c20918355999f92bc489c836e0d17ed8acb713739da4b73fc8ee019fc8a4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"c19d17a63dc280a83fa4dce8ef0f825a16118c6817d3126d095473335018edd0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"05aa8311318e9111c5925f4be454406e209ab832bc6e8ddf01725ebe4f1ffdcc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e680857c19914d59f115788ea93836704a1ddab04f5e495bf863d62ad8a5aa8e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"96b761d418352e3f8d172aa80bfb5542df670414bec97704e615f2e3e665c8aa\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4a199d441e37ffe8d62509ae7048cfd055df0de5619e9be81a8f47f9a64a7051\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"f17cbb57db714a7faf03a7e4ef3921069096709486e13c6b84b4b75ded84ca96\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"d8631ed26c63871d1138b31e9c971d72ad1152273309b27ee33862700ff4fb0c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"67a5fec0fb2398a03579a732c5e4640c9f9c5db5385b91db90ffb49522369904\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e5b5be5a42ead835fa1a13840fda21cf5afb14b8226da9a3008a321db777f685\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"a01c6bf1aa626b04ec6a9fc85abb6ced9b4a9c4cafe81d2176013cf3b0b4c4aa\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"0eb9568cf0385cf054d8f3ebcce089d8b225a9fe1b6061e3689f7bd26415f872\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"633e4cdca29207ccc8220565a86635db5bf3f227ef564ee1a0da6a5d6076231e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"ecaead2c94524df89be70a7c961f93dee41ef96545655d22914542a89dffe341\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b9f3d06eb6a92218fa1757dab6cb8e66e42102d46c94e6c0db854f694d6d855c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"7054423a069def7a36dcb993faa1143223d985021782b2552d55a522caf2eba9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"deac1d64e5b84f2fc26848a49153d512090eb1e2bffb72dd7091fd21a1234e18\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"3dbcd4467449162cad999d40988202fafebe535215351d004f1bf05937c76508\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"534f6056dec477fad33defb3049c84dc5497dacd9f6e3f2061b13ba089ed1cbd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"fa823b540319ebed6b9b488f79dda81b66933f7e616cfdaebe3543ae31b33b13\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"fb6ca2eee2169356e662d36e92b2b679a1235a86d976f9807297ad56386f6e2a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"0427c8054235bfb15b63a5a467ab470ce1cca867b5a232117e73059a4ec8891c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4aa2417057e81c2889811e45d786ab1591e3dfafc889b838aad26a3ec2cbfe9b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"acb4b8def068bc86711642e3242fd621a66a54452bf86a82586fc6bf69e8192b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"66831c252eeacbf3e19995c48be4a005b1726766550076c58cb47b979bece639\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"a80090acc18b7b092f5e9f2d49fd8643f16514df89a716f8f69afe4a7afebb76\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"f85e753996f9e90384b461c5504814ca0cada63ea0f44d6630a619ab36edbe08\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b72a3d2d64d0ddc05f076a7fcf59d924552b45080846c09e1084e67867a76e9c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"cd58d9e2c4a744adbc8ab336cd016f27bc1f14a1de2e975afa26b7f5113d1bfe\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"29c80f1787fdadd41eb24cbda56972d49e35d261e06b4f4fcd5851c7e2de3068\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"277489d8f3c2c5149e18b965c81958774efa7e81299a66265853d6af2e16037b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"7c211141c74fe1e91cc494ac860a81616dc49e2a5d1951dc70bf0f42824d53e5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"17df13edb14ef5c49ef0cc29deaea97728695c57b5ccad8feb2b23589083e083\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"014f0c5a15872002db778e7e40dfcf7dede4ab2db05bb6a08641f5d523cb3afc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"bdac37244e7b891cd2973e74c7b0db5110c344505a09a86e51fc6486ba35139d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"ea8a88726b68ceff7de514d89e12df024a67856b697e02c26b6e762395fdaf0d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"81df9bef1abee093a91a2eaab4b1a53122eb16d4150f27c879439ca5d99112f3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b3be2474c46178c0c39839b29d8d7c87b103574b042bb23175ac0e9786fde158\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"13fe2d56bb22ec9a1307da7bad05cdda8724fe788533352aa581ffdc96874c78\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"fbd262e90a5eaaf98d72db889488cbe13bdac9381f78343ea46c402679569fb2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"9794c132b0cd770efeb9723db862265df6a3584117821e44e2a5660a971c59eb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7def4ca304ff3869be64c2c02523fd9d2ff43465099dcd1124399f293eb4480f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"a86375603000eab9b808785894e0e63f3e53024a46681e97c41a06c4e0c67023\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"54eea38241838159e47386cb814ad20fc30631ee8c42d57f0ff8da80fbbf62a0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"d5b69938a04a8020c8a8d10df4921f2989326ca4811c3843a7201bdb1d5cb848\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-unconfigured-model/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c5a685f2a5ebdef5f1dee488990c0798a45ddce399cf99e7d0c505a5f46c69ac\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"0fcfc87f76b773c6a38375e46d76e569a372370e3ae2e7003932ed8ef776f5bd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fac07f302f653115fda3d376325a268abaf66025ed0e4af73e88bea3f41fe933\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"aa28eac51fc5e37c385a11a534759b09fb7998ba74bb01195dd8ff89d9e9ec43\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model-2/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"06165835c4461c0b16a2bc5bae936aff3c2f351edbef8aa378f1110874acedfc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"17390f436804c5d305f1dcb9ea78a72032310736cf630bb9589448f605bd1fd6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m-premium/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ad8714d3b8aed2a9ffd68fbcf0288557e9c1c059c1b59ad3e9a09910b37fd61b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"c4353817d988db43a8dd6b0d5c29305f9dcda76e19c9ef2c820808b0384a0bf4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-embedding-model/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"726a74c13fee356e859d9317271facbb60b066acbc5571de22d056f13c60878f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"1415e0d2aa117656e44a7d6aeaaf16aa87f18bdeee129f7e6757b2e1c7f996d3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-trlp-test-model/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cad6ab5a81a65fd4cb03a0fefdab5de82aa18c30a5b95078b1d05214b0606f40\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"0629facd48a81e3c82281be4a3f8566f55e61d1a30a8516b23bbb63c58e8f6f8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e5f81c7f7812462ebef000c68dc043013159f22201d2eeecf05c220e809f96ed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"2e292ccc99f990aa723c04a99267923f5b62fb8f3e0ab1a978e8334b9397ada0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-unconfigured-model/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"68502d1c1143a647ad56f2759ea89a4c5b3c74a8054739f7e7ea9ba6535e3b74\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"2b69b629cb2b5224adc61a8925f43333ba0b52ab39260c124057e9e82898937f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"74b47f1aa1203aad58596cbaab10ae46e8fddd08ac49eb57a26bdba532d88e72\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"d1e427bebfc099de9df176c73ee76d5dbd6f77919e840913d3a10818678c7394\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model-2/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3167d3bf853032a93e8569019dcd3e5aa33af9cb580cf9ca138990567fc9d857\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"482d2a79771eafe7f8d177701f43a13c6c4916251440ca00830042e050247443\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-unconfigured-model/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"99606c4eac496429be47144db9f3f48867815df12eb99d7be8073b767d7e44de\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"e635ba9dc59ae1e09b34ee6e0f2718b1c31e6f6b6ff2bc6d05c094fedc42c40b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m-premium/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5d590119308c6f848b12dd3ecdfb1b06cc2fe172af702455c342075944a045ff\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"caf1a50009b65f25df3a996283d38ada17bb57a2ebed842a552f137f6121c63a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-embedding-model/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0e042276580ed8976d8ad3afd87a71640025c28b9b48f5c88eb159ec9998209f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e17697b7e023603155a06feebe0602591826e794ee2f5189abf795c259be1b37\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-trlp-test-model/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0829dbf2b5dc0900de272826295adf351de381b46fa6fba00b896213530780f6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"1e772a79f4b1660c75cf3493e21c9ddb58d2de640363115c57dac03a10f22c33\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cc1ffc2ee4e05618c28c108cac668c0c02eb8e658953439e47a733edab44a1a0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4fe1d1c6df78a26f30e2392ae9da7fc67b0845dfda48a89e247bee6aa536d8e1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-unconfigured-model/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"486615827938fa99814e929fe7dc62bc16f7563179fef855074eb73dc7ce4724\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"ee2f6a8baeba450552a3e168b9df1808bba4e2c59106ad0881ae78aee4fcbd40\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-echo-model/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"98ec9d74d07c88c1e6923ed1cbafd4c5b41bf1763b3a942282f964f72425ae57\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"653f23106eb8a10791805e2f9355c750c56aa6873ef311fe707e76083d93d55d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model-2/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2ddbced6f2f51d410743da1d9db1257d0006d99f38986dd7cc7efd26620791ad\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"1e776cd43733621e16ebc27c91dbdeea062f73e4dde2f494701c85a6843faeed\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d752a44ad8df3a50b5a1147110eb89039ed764e1fed197b1f77e0935c424a90b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"62f67bf9885222d9a86a95e02ed17ae26ad7cf71e15aae0a7517e647c29618ca\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3083301b5359be118f04faaefcd72fd127f2297a3374ef7231b59a59a31b405c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"e85460469045801c3e6927ab49333ff01612a4899d5a7c29ec27824b9942f3b9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m-premium/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"67c67ce733de50e7b3d797bb248036b01badfe02e958f5f76af05b58a504989c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"f9b414e31cae5d16cc1ad22ba2462b8816d9369a97316f40f32a6e7912fc4f78\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model-2/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2d4a2275e6cbab5c26d5c3cf2d75aa2776066390e5b66f5498b16b26bc596af7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e33110b3dae1dd80b2bfa573def0b488a6fd4f1243962fe81d58e1853ed2d3f5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-embedding-model/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"23672b974f0dbc05100a34c78d2b029e41f1d5a3752f3fcb52915f56db360e25\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"a6183db94e49e3ba0149a19f4e52ff19aebb55d6261b0cacec0656136bd2adf4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-trlp-test-model/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8274337fc3f0de48e5213819aeb4a46559c4f8b3428c1bae43c0d75207ef5264\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"efcdf81b8f74d74207beb897f447376d1f950ae12e8a330f1ae67b0d9dc6a545\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0e89fc4b75d3a5dd95fca2c4d8ae33c7826f05a8016c44eb39e28c3c1860fcfb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"7f0f599e497ae797f3b5922614ceddb3375c007237412d01b520bb7498ef288d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/premium-simulated-simulated-premium/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ab505bdf28287fe00099987c1bde2c2f297c40c792a7f6cb5fbfa5adc44754d3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"06c1aa31be81b1f5c6266514c955712865b30117291a39dd749994f4ce931145\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m-premium/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1704c6bc15d6f547acca888061680f2275f690cb79e5af6fee44747bcf278b95\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"6a8319194e2c2fc998268cdbab03a5aae2d83019f5ac30c316c4e548895b7c63\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"eaeb360b41b3f9e0bd6b247d4dae3eef1ffc3355d6e9408df3f8f71bc7f033b5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"32cfee4e66c307d5ebed6a406d2260f4374553d184b5486fc53cb64bc6ffcd8d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-embedding-model/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"135ffad9bbcd33779a0b9a1c0dc5d5f547356be21489762803640aca855c728a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"3194cef788c3fa9898599a57480aeaed07c6eac2edf957788235b37d22918588\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-trlp-test-model/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"17002b7f0c8e62582ad262d9c2b8b038ee7f2a9327fe34f21fd4f47134b7b8cf\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5acde2b886749c1c54f99db5c33887e6fc5ed0caf412daacfb5df0f329882c66\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a6a6232fd5656520e75d100c41add5f1637dde9705a4ec608bbb90b724c258a5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"37a71c27032e51fdbc7ca688064a47abb86230a8138af6eb55e8069fad975a93\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-echo-model/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"92917da87eaba4f2684cd45947a3698434b99ff4ca6d3ddde51d6573aecb1600\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b2b26e0af9ad7defb486e5d1db19af6bbdd0998559d16f3776651669aeb4d067\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-echo-model/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aa7038625b8f43b0c002f79637065e5ab90468f50f998759d08f2c4640c07c04\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"2a62f0614f6526bc3f195f838aebd1abe29514f2707db40d9ef738d645ccf001\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"de97dd5d45c6eb12b4a1112ed1f362d8544427428d2249a399e26ba069d6aadb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"22b2ec7ec96ee09c9e07a84cd3d313c2223af42433bbb28c5846401f64d5e3c1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/premium-simulated-simulated-premium/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"dc061bec60bd28b1c132bf30965b4810124429576337bcc4a6030617600d1714\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b188b939a496049e47b8ef664d7c7c490722f1753404a08d89ccec1dcb87b8fa\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-echo-model/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"75612d85af2bae456dadd78163b2d2f9015c0a0bf4e20bcb8a555e6a5ab3b8c0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"96bc4fc13cb63707a942ca33034f78d2b39476a10860398523789db3990584d1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a4493fc88328eba553ef36791fbf4706bffae04a1ac501d099b12309ebc85c6b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"d84e45c7a3e370ea510e8e0294e009b29bc2f2ea789c47559293007b6c4410d2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/premium-simulated-simulated-premium/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2d953f7313807988e63546aa32431d96f77e6989c672f8ab42827c1c21918630\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"dd2f15d9a08862ab664dadf9bf5da25828d327a11a07849fa919713f034c2b0d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/facebook-opt-125m-simulated/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d69b9c128f599c9ea1af84bb3e783ed71688baf6b3ad2b86f2b7183f9a4208b9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"4dfeb9ff2318af8f84e70b11545800bb83948c080a97ae1ece5780d4022bb383\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"dd89509e97b96670685602ae2d08749226db8693944d2c6f868af9d3e0a5feb5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"1025db78adc8b9c9592b692cc227b1a306a99ac5502300d9ed4ed7615f5e3ef8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/premium-simulated-simulated-premium/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3386c5e86c72abcdab369776ccd7182024ab8681cbe497e81724868f101a3c0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"58e90354179740b1af406b2911c9997f3f3283475aeb77ce7918f3b3239a293f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9e75e9fd02f51c2f043b145c5d6b82e95f1447b388ee529262aea27a6a2774ef\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b89d1075a79c93acaa097e4e6db4d6a4b23bf3ffe5e964409e29b258ed725a99\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-2-simulated/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0913a452a02695c6681f1037232199b40b64236fed4d29cdbb41561695826340\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5c0b495d1a10c1cf1548ef17998cb18c0ca25371ad42d5ffe1aed42bd55e31ad\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-unconfigured-facebook-opt-125m-simulated')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"010adf02b2e7deb40c572f4729b6dd4619847c8e6344137326b72df28772fc1a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"c04f8a7c7387e6794115c41161cb001d8a07340d2878cb8f36774a8f6a200ba4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"105cf4dd91a8abf4a93abd65b255521c3d37b560b5d23f3ec59757b5b362fae6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"7e7d1a0ec6d957a4d4de94f93078f10e836b23442c9cfa90f11c8520cca12e87\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-embedding-simulated/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"75fd86e2a4870af5fd78f2ad7aa2a9d79aff977b3678d81954b1e207a9315f2c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"c3cfc634a11046a837448628e2f17db0ed3466194da289a808544d874ecf6451\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-trlp-test-simulated/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"54cd0149b818480305f3d0024b3c95629cafb641b48195d003b2b7006d5c6bcd\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"f5bc618bde549671e84473b23ef3632426f8606e2045744a860c603f2a7675d3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bf65ad13397c94660867eb0205e06d1c9bebda4b019f632c0d0b8ef989930381\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"d8d67afd40f17474755bd3f6b00e265761bf5154febca129bc3f2b0bcd749c41\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-simulated/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f9fa9cfc2b4e701183573419a92c79384cd30210289602f0115c75c5029d55aa\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"ac2105eead12bb02dd7d1691cc77fc8a580b903f98564a8fd585dfa345dec1dd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"596921ddc7ba8523386263c5cffcbd6ad9b6a385318ed7e24f72be06f36fc398\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"f4ae34c5c82a0969651301a535f404653a60a5d75f20c7ea56ad9bb89b67e9fb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f95805f0e9b755664735d898c1d644d571943be553204d3f86136bc35719ff13\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"95c39f44eae69bd53f57e5ff93243887dafd591c9b8cf2e736f0ab034e67021d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/facebook-opt-125m-simulated/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8d5571efc1d304f5bcfc2ffb4ac6819154ba5556c29ce33416d460b887427984\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5d6b359055267732253f201a1fe48f0abe6d5e22b011c70e1cb006eea672f535\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e91aceffc2d4f6d6b120625bd3ca23781b74a1cae6cf1da26bda310bbed0ef07\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"c8475d27649a649c955538ff79eb001372050ff4f1d4ad295b01dc6fcc69ba2a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/facebook-opt-125m-simulated/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a402d1681ab35bace735c19b1d084a86eb3d741d4e1c14371cfdaa55d22c3ebe\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"7320c049419b863194fd55db5ebd887462dd24e1289e6308d79f047431f2bed9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-2-simulated/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f9b535aed6243496a67741936e53a0d303bea1b872a06fb62f1f9c27150edc40\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"5eeab80447ec6c71797517b4d94c6623353e89097743360eadd7f31115976dfe\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/facebook-opt-125m-simulated/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a9800464506c58f005016df354e160757732171ff4d19747202524955329b998\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4984a24eb707d1b965a79974a98ed4afc271f2ca356b150cbc8943de1ddcfef8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-embedding-simulated/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c82a1a3dc2ce54c0b664f79a2cd895a3c40f774b3694999badae8cedd328292e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"276f5d5d67b2bd83c05c2b39e4a262885498e6807e3129a866eff0651b3604a9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-trlp-test-simulated/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"669658556fba0f45c2a82def2f57614416614ddf154ed8dc5f4f9188f10130f2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"692f39321f892929348fe56801dc14c8a35eaf749609a3a5f4b5e684edddf17c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-2-simulated/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c4399a95e89654e5b2bb5fabe45bc947d11ccd1448ebf64c30b195b34f239d58\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5b273834f06c6341dd07bba6c809b3297ba2514e6d3b9b5d0f4f8211c68ccf8b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-simulated/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5e4821ff903ad6ca2e1c42162432e34d8b0a2a78052961e753d36b742193432f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"f35ed2fb168a3a608435006c8c1b103242765d7d37f41bf1dbdb7bbc0331da89\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a91faccafad197e2a4065ce3d12a052ac484d2e8fb2fc9265ee48f02b28e6dce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"fbfd0ada86117ffb0a134e591bf8b8390012983d25496ef188c6da73fef5eaec\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-2-simulated/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0020c64019ffd1a0bdcc75e6441e6a30e6d8bb08f463f67bd2408a1e82b95b2a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e78a4964c93ec23890e62f7f50201f5b832b4c714066a914dc734d8ef60e8213\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-embedding-simulated/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7c924aa2b37ea38067b4e69052d541ea2e7c86fbdaa79b19f9ea09e87adbe4ff\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"d5cf96eeeaa56bb891ea0cba28f7beabf17a8c0f061ea01c768ed842dd26334f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-trlp-test-simulated/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"028a8b5bd5d4e690eebb2f20c5fd47cf0b3c6e2a3619ba9e55322bbca7b94cc3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"8fe4100eab1f023f5b06dd8e19bcc80109b82503466d49576acc234cdda9bf0e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-simulated/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"80056c658070f49140955cb6eabdbd252857a614af6b0f2f2de7a1ab1cd47949\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"53aad0199369eb8c8f787ea099e93092089c04344e8f910dcff366f54bc831cb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-embedding-simulated/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2416d7b42d11a09d7152746be0e114f8fdc87d0fbd0efa9dec5b52b011082194\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e0cfec53d1f17771317082d9a7d69806ae3468971bac79a1135f2b0d51ecdc07\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-trlp-test-simulated/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"50c2058cf11e07a931b06ac4446a56eee86855f00badf26618abe486a7bdcfd7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"f3b6e6c38a521fae8ef5c7fddf3b3178baba88effb4e5338e0b387e28ecc468d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"134a7a790ba665547ca14f80f917549f66ee5063fc41096471c0778399db6dd5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"4ddd3fa1f54c642a57a48737e710ec0116705776084d8cebd8134dfa49accdde\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/premium-simulated-simulated-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4d18a96899c43d55ee63d2ae1a7a938c7e873d88b2fd95f06b2e3aae2c7f1c84\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"44e38055536c3f0d49cb81abb42bfefcf2c78faf963a6160afbe459bbc04db39\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-simulated/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8d34bd12ba2030284fcb69127f53b8158bbdd4a1432bfe619165b4c2c96cc061\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"c9dd9c233e43b53241ee27e937246e51b8f3331f30a7fba22640617c1b0bf47a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/echo-simulator/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"319e246831bdaf5e765e63d5511b516594fd2b64527850e2ddabd2a4a85532ea\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"7cfd2ed5cb8a5913fa5f55b92b02805c6778991c01c80eb14a0962cc710a56ff\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/echo-simulator/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a8c8220ad6f1387002e262ace5db78a2c4bb39e5953306702a228215174f6796\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"87e1712d02794c6d66ec1a932f02901d7a4369f46d0f041178cd3efadb7f59b7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/echo-simulator/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1e077a716d89a43572a3c16e8d0b0436816baa48a2ea227603701f10cad6d6f4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"ae9eac2a2b8c8311bb8c6ea82ab445a5d6f50d2d51c3f79962be9d82007097ad\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/facebook-opt-125m-simulated')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3f23315aacd6e16f4ab41f96aeedc9549d1abdfc9476577a47d45d12875dec5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"165d3b8e224f71685dee07aadd133117aeeed097eae99437d561d5bfa2d22233\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/echo-simulator/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6687eb3cec74c6c51428ce3f3d22d50ba269f59015d1bc8f185da49eb095534e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"05ac0e89d0298398d3996609d7c22b514bdf08bfa3787653bc739995c5942441\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-2-simulated')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bfd36c5ed73eb81df97258ffa1aa36d8cbf6f3e7a8096c33ca4ff417be59d002\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"d5ac583036f3821c88111dd82571eab1fc94aa4e9fcd045b27336f798e26075d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-embedding-simulated')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d303c788902ad4467c7ae545d65cbef45564d1c0d56396c93057df3909461aa1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4a6b0d84cc35c0f532405eea81056481fd54e7ad71284a97ce8f6a2424eac819\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-trlp-test-simulated')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2f53b030326b8e1f5908c601aecd3fffcb6d08a8337d0bdc53ee1fc699a4cd71\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5c3bcd9fb119b0fd45f3b4ba5de5f905cacbb4963fec309a0961a40f76a7a7a9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-simulated')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"94ddc5e77f082c32bebc7a36bcebf621518ebf303e83b9c540da1352d04e620b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"50057c9a2acf4ae7152e8c97f7778cb04340d1470974e5272422d0bf244a4e5c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/echo-simulator')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c6918972d1a7f8ad5201880b7d6d9c1191ca1f25376682f691def7868e3fd02\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"01cc37113b4d6c301e355f63decf46a21e93a023494bdfeaeed2890c97ec1f57\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a82769ff87473da04c27497e160e9b4b1a5dd93578e0cf2342be8b2f06845269\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e747b72d92315b743934153588614b27670cf0c9d9dc4fb380ea4965def7f235\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"06b05a8e4dd69bdc4f333ad9509ee8cad3c5c0f5dd48edbe94c1158b60f79ed3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"661962837510c6dc6d1faa64e61ec3086efa9e0a2e7315c6ded616c1879e5ba8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b4bfec1b33959dd0ebfc5cd6fb410688e820d4b55c7f149cb4acc4353f30a9b2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a7740f6e77d024a437502c023fb1d8939cb3cc2b9ed7f4073af7d779e19459eb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"f82564e076ea3e672592bab71e048537faba17a5e909884c2a0204e235905a69\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a908063c86927e6bf07b7d793aad9f277ac3c2a8f5f5d468b116cb9e07929b14\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"fbdfff5b213f506d78434055d011cf63d616653e502ee04408a43578986e1e5c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d1d232e06f90d479cd9b802f24889e83af58c51cf54ba273d5e24dcb8a297688\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b49f2d7e152d4de959577465d2494ee11771b4c439cb6eae71c90bff26224fb4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"810f299b76daf089b33c92cfbe0445ab5cc89a48d38e36df0cc89ed6cd1fe8df\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b27d6255cac73fc039120e157e1f3ce0e99e86995ac5a66974d5e8744df6c64d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4f800155f293f82eeaf5fd6a9553c0a1bee90f47a295bba8d7a04b3f11faea33\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b1ccc7ca46f6a14e90afe1dddfab8763f07f30549ce1cda0bae985581f063098\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ce7d381faee9ff949d68d825ffa1dcb9247dad19667ec59a8e91847320dacbe0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5d72fc7cc241ffd60d83142a900be014cc5d57320142e013493b21ecc86cb534\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6565c4085b3917d5390fe1b0194fb3d8319f1d56b45867e3c68ff740b5c16ef3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"be1ccea8a4cc19c7190600de6631fcb661b63db81e2862348a6ef4f90bf33fa3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8d8c8aae1332bb0300ac2d65be9b8708fbfde6d4b5599ec52380cf1f70956045\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"ca48ea5d9ee701ac5383800306378d945e66ca5427eba33396e6805ebbdc1ea7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f6df6bc14432fdc346191db86ee06e75c8090ed87a32c984493c837e97a10be6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"fc54a1d4f18d4d59e58b6a3aa31dbfaddda2b89e5c28dc9eacf14ff38a414021\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"maas-default-gateway"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-maas-default-gateway\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:18:50.964Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"54cd0149b818480305f3d0024b3c95629cafb641b48195d003b2b7006d5c6bcd","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["54cd0149b818480305f3d0024b3c95629cafb641b48195d003b2b7006d5c6bcd"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"54cd0149b818480305f3d0024b3c95629cafb641b48195d003b2b7006d5c6bcd\" already exists"}
{"level":"error","ts":"2026-11-02T21:18:51.034Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-completions-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"f95805f0e9b755664735d898c1d644d571943be553204d3f86136bc35719ff13","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f95805f0e9b755664735d898c1d644d571943be553204d3f86136bc35719ff13"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"f95805f0e9b755664735d898c1d644d571943be553204d3f86136bc35719ff13\" already exists"}
{"level":"error","ts":"2026-11-02T21:18:51.103Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"8274337fc3f0de48e5213819aeb4a46559c4f8b3428c1bae43c0d75207ef5264","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["8274337fc3f0de48e5213819aeb4a46559c4f8b3428c1bae43c0d75207ef5264"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"8274337fc3f0de48e5213819aeb4a46559c4f8b3428c1bae43c0d75207ef5264\" already exists"}
{"level":"error","ts":"2026-11-02T21:18:51.171Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-catch-all-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"134a7a790ba665547ca14f80f917549f66ee5063fc41096471c0778399db6dd5","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["134a7a790ba665547ca14f80f917549f66ee5063fc41096471c0778399db6dd5"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"134a7a790ba665547ca14f80f917549f66ee5063fc41096471c0778399db6dd5\" already exists"}
{"level":"error","ts":"2026-11-02T21:18:51.239Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"50c2058cf11e07a931b06ac4446a56eee86855f00badf26618abe486a7bdcfd7","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["50c2058cf11e07a931b06ac4446a56eee86855f00badf26618abe486a7bdcfd7"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"50c2058cf11e07a931b06ac4446a56eee86855f00badf26618abe486a7bdcfd7\" already exists"}
{"level":"error","ts":"2026-11-02T21:18:51.309Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-messages-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"d69b9c128f599c9ea1af84bb3e783ed71688baf6b3ad2b86f2b7183f9a4208b9","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d69b9c128f599c9ea1af84bb3e783ed71688baf6b3ad2b86f2b7183f9a4208b9"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"d69b9c128f599c9ea1af84bb3e783ed71688baf6b3ad2b86f2b7183f9a4208b9\" already exists"}
{"level":"error","ts":"2026-11-02T21:18:51.376Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-catch-all-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"1e077a716d89a43572a3c16e8d0b0436816baa48a2ea227603701f10cad6d6f4","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["1e077a716d89a43572a3c16e8d0b0436816baa48a2ea227603701f10cad6d6f4"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"1e077a716d89a43572a3c16e8d0b0436816baa48a2ea227603701f10cad6d6f4\" already exists"}
{"level":"error","ts":"2026-11-02T21:18:51.445Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-messages-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"ab505bdf28287fe00099987c1bde2c2f297c40c792a7f6cb5fbfa5adc44754d3","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["ab505bdf28287fe00099987c1bde2c2f297c40c792a7f6cb5fbfa5adc44754d3"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"ab505bdf28287fe00099987c1bde2c2f297c40c792a7f6cb5fbfa5adc44754d3\" already exists"}
{"level":"error","ts":"2026-11-02T21:18:51.537Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"8d8c8aae1332bb0300ac2d65be9b8708fbfde6d4b5599ec52380cf1f70956045","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["8d8c8aae1332bb0300ac2d65be9b8708fbfde6d4b5599ec52380cf1f70956045"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"8d8c8aae1332bb0300ac2d65be9b8708fbfde6d4b5599ec52380cf1f70956045\" already exists"}
{"level":"error","ts":"2026-11-02T21:18:51.613Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"06165835c4461c0b16a2bc5bae936aff3c2f351edbef8aa378f1110874acedfc","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["06165835c4461c0b16a2bc5bae936aff3c2f351edbef8aa378f1110874acedfc"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"06165835c4461c0b16a2bc5bae936aff3c2f351edbef8aa378f1110874acedfc\" already exists"}
{"level":"error","ts":"2026-11-02T21:18:51.685Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-responses-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"e91aceffc2d4f6d6b120625bd3ca23781b74a1cae6cf1da26bda310bbed0ef07","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["e91aceffc2d4f6d6b120625bd3ca23781b74a1cae6cf1da26bda310bbed0ef07"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"e91aceffc2d4f6d6b120625bd3ca23781b74a1cae6cf1da26bda310bbed0ef07\" already exists"}
{"level":"error","ts":"2026-11-02T21:18:51.753Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-model-routing"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\" already exists"}
{"level":"error","ts":"2026-11-02T21:18:51.820Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-responses-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"3083301b5359be118f04faaefcd72fd127f2297a3374ef7231b59a59a31b405c","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["3083301b5359be118f04faaefcd72fd127f2297a3374ef7231b59a59a31b405c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"3083301b5359be118f04faaefcd72fd127f2297a3374ef7231b59a59a31b405c\" already exists"}
{"level":"error","ts":"2026-11-02T21:18:51.886Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-chat-completions-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"0e89fc4b75d3a5dd95fca2c4d8ae33c7826f05a8016c44eb39e28c3c1860fcfb","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["0e89fc4b75d3a5dd95fca2c4d8ae33c7826f05a8016c44eb39e28c3c1860fcfb"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"0e89fc4b75d3a5dd95fca2c4d8ae33c7826f05a8016c44eb39e28c3c1860fcfb\" already exists"}
{"level":"error","ts":"2026-11-02T21:18:51.952Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-completions-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"de97dd5d45c6eb12b4a1112ed1f362d8544427428d2249a399e26ba069d6aadb","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["de97dd5d45c6eb12b4a1112ed1f362d8544427428d2249a399e26ba069d6aadb"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"de97dd5d45c6eb12b4a1112ed1f362d8544427428d2249a399e26ba069d6aadb\" already exists"}
{"level":"error","ts":"2026-11-02T21:18:52.019Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-model-routing"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\" already exists"}
{"level":"error","ts":"2026-11-02T21:18:52.087Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-messages-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"dd89509e97b96670685602ae2d08749226db8693944d2c6f868af9d3e0a5feb5","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["dd89509e97b96670685602ae2d08749226db8693944d2c6f868af9d3e0a5feb5"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"dd89509e97b96670685602ae2d08749226db8693944d2c6f868af9d3e0a5feb5\" already exists"}
{"level":"error","ts":"2026-11-02T21:18:52.155Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"f6df6bc14432fdc346191db86ee06e75c8090ed87a32c984493c837e97a10be6","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f6df6bc14432fdc346191db86ee06e75c8090ed87a32c984493c837e97a10be6"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"f6df6bc14432fdc346191db86ee06e75c8090ed87a32c984493c837e97a10be6\" already exists"}
{"level":"error","ts":"2026-11-02T21:18:52.213Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-simulated-simulated-premium","namespace":"llm","uid":"447993be-3c57-4e68-8ffa-6fc998a39c77","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-simulated-simulated-premium\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:18:52.223Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"maas-gateway-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"maas-gateway-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:18:52.270Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-facebook-opt-125m-simulated","namespace":"llm","uid":"da8edb1a-ed61-454d-939f-fc7cd235d9fb","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-facebook-opt-125m-simulated\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:18:52.327Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny","namespace":"openshift-ingress","uid":"98334d41-e6d6-4f98-8ac9-43aeb1f2e054","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:18:52.327Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:18:52.327Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T21:18:52.393Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"facebook-opt-125m-simulated-kserve-route","namespace":"llm","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"facebook-opt-125m-simulated-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:18:52.458Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"premium-simulated-simulated-premium-kserve-route","namespace":"llm","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"premium-simulated-simulated-premium-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:18:56.153Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","TokenRateLimitPolicy","Limitador","HTTPRoute","ConfigMap","AuthPolicy","EnvoyFilter"],"eventTypes":{"create":24,"update":9}}
{"level":"info","ts":"2026-11-02T21:18:56.218Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:18:56.238Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:18:56.441Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:18:56.441Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:18:56.461Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:18:56.461Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:18:56.463Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:18:56.464Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:18:56.464Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:18:56.470Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:18:56.524Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:18:56.877Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:18:56.877Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:19:00.794Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Limitador","AuthPolicy","ConfigMap"],"eventTypes":{"update":3}}
{"level":"info","ts":"2026-11-02T21:19:00.859Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:19:00.905Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:19:01.033Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:19:01.033Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:19:01.051Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:19:01.051Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:19:01.051Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:19:01.057Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:19:01.057Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:19:01.060Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-02T21:19:01.060Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:19:01.500Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:19:01.500Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:19:03.663Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","ConfigMap","Limitador"],"eventTypes":{"update":4}}
{"level":"info","ts":"2026-11-02T21:19:03.731Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:19:03.881Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:19:03.966Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:19:03.966Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:19:04.071Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:19:04.072Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:19:04.072Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:19:04.073Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-02T21:19:04.073Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:19:04.073Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:19:04.506Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:19:04.506Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:19:13.632Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","Authorino"],"eventTypes":{"update":2}}
{"level":"info","ts":"2026-11-02T21:19:13.767Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:19:13.770Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:19:13.770Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:19:13.770Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:19:20.616Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","ConfigMap"],"eventTypes":{"update":7}}
{"level":"info","ts":"2026-11-02T21:19:21.078Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig"],"eventTypes":{"update":39}}
{"level":"error","ts":"2026-11-02T21:19:21.427Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"maas-gateway-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"maas-gateway-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:19:25.187Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","AuthPolicy","ConfigMap"],"eventTypes":{"update":17}}
{"level":"info","ts":"2026-11-02T21:19:25.455Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:19:25.456Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:19:25.456Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:19:49.249Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway","AuthPolicy","ConfigMap"],"eventTypes":{"create":3,"update":2}}
{"level":"info","ts":"2026-11-02T21:19:49.567Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:19:49.568Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:19:49.568Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:19:49.576Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:19:49.577Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-02T21:19:49.577Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:19:49.578Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:19:49.993Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:19:49.993Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:19:50.448Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway"],"eventTypes":{"create":1,"update":3}}
{"level":"info","ts":"2026-11-02T21:19:50.854Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:19:50.856Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-02T21:19:50.856Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:19:50.860Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:19:50.860Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:19:50.854Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:19:50.869Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:19:51.277Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:19:51.277Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:19:55.444Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","Gateway"],"eventTypes":{"create":1,"update":1}}
{"level":"info","ts":"2026-11-02T21:19:55.678Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:19:55.678Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:19:55.723Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:19:55.724Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:19:55.724Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:19:55.736Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-02T21:19:55.736Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:19:56.117Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:19:56.117Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:19:56.633Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway"],"eventTypes":{"update":1}}
{"level":"info","ts":"2026-11-02T21:19:56.952Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:19:56.952Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:19:56.956Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-02T21:19:56.956Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:19:56.963Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:19:56.963Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:19:56.972Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:19:57.386Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:19:57.386Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T21:19:57.581Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-ait-170b4fea","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-ait-170b4fea\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:19:58Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ait-170b4fea","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ait-170b4fea","reconcileID":"aad27975-3d81-4296-b333-d2ad1b33dbcf","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-ait-170b4fea","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:19:58Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-ait-170b4fea","event":"CREATE"}
{"level":"info","ts":"2026-11-02T21:19:58Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:19:59Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-02T21:19:59Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-02T21:19:59Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:19:59Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ait-170b4fea","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ait-170b4fea","reconcileID":"aa660cc5-05fa-4889-8d11-4f657185f63e","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-ait-170b4fea","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:19:59Z","logger":"telemetry-policy-extension-controller","msg":"Warning: Reconciler returned both a non-zero result and a non-nil error. The result will always be ignored if the error is non-nil and the non-nil error causes requeuing with exponential backoff. For more details, see: https://pkg.go.dev/sigs.k8s.io/controller-runtime/pkg/reconcile#Reconciler","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ait-170b4fea","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ait-170b4fea","reconcileID":"aa660cc5-05fa-4889-8d11-4f657185f63e"}
{"level":"error","ts":"2026-11-02T21:19:59Z","logger":"telemetry-policy-extension-controller","msg":"Reconciler error","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ait-170b4fea","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ait-170b4fea","reconcileID":"aa660cc5-05fa-4889-8d11-4f657185f63e","error":"Operation cannot be fulfilled on telemetrypolicies.extensions.kuadrant.io \"maas-telemetry-e2e-ait-170b4fea\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:353\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-02T21:19:59Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ait-170b4fea","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ait-170b4fea","reconcileID":"2c895948-c537-43df-854d-35315117e125","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-ait-170b4fea","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:19:59Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-ait-170b4fea","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T21:19:59Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:19:59.805Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","Gateway","HTTPRoute"],"eventTypes":{"create":1,"update":2}}
{"level":"info","ts":"2026-11-02T21:20:00.069Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:20:00.069Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:20:00.072Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-02T21:20:00.072Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:20:00.123Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:20:00.124Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:20:00.124Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:20:00Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-02T21:20:00Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-02T21:20:00Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-02T21:20:00Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:20:00Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-ait-170b4fea","event":"UNKNOWN"}
{"level":"info","ts":"2026-11-02T21:20:00Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:20:00.526Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:20:00.526Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:20:00Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-02T21:20:00Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-02T21:20:00Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-02T21:20:00Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:20:06.612Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Kuadrant","TokenRateLimitPolicy","ConfigMap","AuthPolicy"],"eventTypes":{"create":2,"update":2}}
{"level":"info","ts":"2026-11-02T21:20:06.690Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:20:06.715Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:20:06.715Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:20:06.765Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:20:06.836Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:20:06.836Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:20:06.836Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:20:06.949Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:20:06.951Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:20:06.953Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:20:06.953Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:20:06.949Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:20:06.954Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:20:07.026Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:20:08.096Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:20:08.096Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T21:20:08.358Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-ait-84de7f3a","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-ait-84de7f3a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:20:08.654Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway","AuthPolicy","HTTPRoute","TokenRateLimitPolicy"],"eventTypes":{"create":3,"update":1}}
{"level":"info","ts":"2026-11-02T21:20:09.067Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:20:09.070Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:20:09.123Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:20:09.123Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:20:09.123Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:20:09.123Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-02T21:20:09.133Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-ait-170b4fea","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"kuadrant-auth-e2e-ait-170b4fea","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-ait-170b4fea","uid":"e09fe579-ee4a-47b2-a12e-6a7b9f2f543d"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-auth-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local","port_value":50051}}}}]}]},"name":"kuadrant-auth-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-ait-170b4fea"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-ait-170b4fea\" already exists"}
{"level":"error","ts":"2026-11-02T21:20:09.137Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-ait-170b4fea","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/ratelimit":"true"},"name":"kuadrant-ratelimiting-e2e-ait-170b4fea","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-ait-170b4fea","uid":"e09fe579-ee4a-47b2-a12e-6a7b9f2f543d"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"limitador-limitador.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-ratelimit-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"limitador-limitador.kuadrant-system.svc.cluster.local","port_value":8081}}}}]}]},"name":"kuadrant-ratelimit-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-ait-170b4fea"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-ait-170b4fea\" already exists"}
{"level":"error","ts":"2026-11-02T21:20:09.139Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-migrate-5478da31","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-migrate-5478da31#rule-6"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"2d8bc18ed9cc4eecc678cbd3e81b4c6500e6413361b69f85beffd83f39de5a74","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"oidc-identities":{"credentials":{},"jwt":{"issuerUrl":"https://issuer.example.com/realms/e2e","ttl":600},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\") && request.headers.authorization.matches(\"^Bearer ****\\\\.[^.]+\\\\.[^.]+$\")"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"oidc-client-bound":{"patternMatching":{"patterns":[{"operator":"eq","selector":"auth.identity.iss","value":"https://issuer.example.com/realms/e2e"},{"operator":"eq","selector":"auth.identity.azp","value":"e2e-client"}]},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\") && request.headers.authorization.matches(\"^Bearer ****\\\\.[^.]+\\\\.[^.]+$\") && has(auth.identity.iss)"}]},"oidc-groups-safe":{"opa":{"rego":"unsafe_group[g] {\n\tg := input.auth.identity.groups[_]\n\tnot regex.match(\"^[A-Za-z0-9:#._/ -]+$\", g)\n}\n\nallow {\n\tcount(unsafe_group) == 0\n}"},"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\") && has(auth.identity.groups) && size(auth.identity.groups) > 0"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["2d8bc18ed9cc4eecc678cbd3e81b4c6500e6413361b69f85beffd83f39de5a74"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-migrate-5478da31.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-migrate-5478da31.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"(request.path == \"/v1/me\" ||\nrequest.path == \"/maas-api/v1/me\" ||\nrequest.path == \"/v1/subscriptions\" ||\nrequest.path.startsWith(\"/v1/subscriptions/\") ||\nrequest.path.startsWith(\"/v1/model/\") && request.path.endsWith(\"/subscriptions\") ||\nrequest.path.startsWith(\"/v1/api-keys\") ||\nrequest.path.startsWith(\"/maas-api/v1/subscriptions\") ||\nrequest.path.startsWith(\"/maas-api/v1/model/\") && request.path.endsWith(\"/subscriptions\") ||\nrequest.path.startsWith(\"/maas-api/v1/api-keys\")) && (!request.headers.authorization.startsWith(\"Bearer ****\") && request.headers.authorization.matches(\"^Bearer ****\\\\.[^.]+\\\\.[^.]+$\") && has(auth.identity.iss))"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"2d8bc18ed9cc4eecc678cbd3e81b4c6500e6413361b69f85beffd83f39de5a74\" already exists"}
{"level":"error","ts":"2026-11-02T21:20:09.180Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:20:09.180Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T21:20:09.194Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-migrate-5478da31-gw","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"kuadrant-auth-e2e-migrate-5478da31-gw","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-migrate-5478da31-gw","uid":"bd96a700-0813-4426-9fc9-385e6f32300c"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-auth-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local","port_value":50051}}}}]}]},"name":"kuadrant-auth-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-migrate-5478da31-gw"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-migrate-5478da31-gw\" already exists"}
{"level":"error","ts":"2026-11-02T21:20:09.196Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-migrate-5478da31-gw","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/ratelimit":"true"},"name":"kuadrant-ratelimiting-e2e-migrate-5478da31-gw","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-migrate-5478da31-gw","uid":"bd96a700-0813-4426-9fc9-385e6f32300c"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"limitador-limitador.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-ratelimit-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"limitador-limitador.kuadrant-system.svc.cluster.local","port_value":8081}}}}]}]},"name":"kuadrant-ratelimit-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-migrate-5478da31-gw"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-migrate-5478da31-gw\" already exists"}
{"level":"error","ts":"2026-11-02T21:20:09.207Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-ait-170b4fea","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-ait-170b4fea#rule-3"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"2831c42a19436249a27619217043793522ee826dd49f811e5827ed170f680dd3","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["2831c42a19436249a27619217043793522ee826dd49f811e5827ed170f680dd3"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ait-170b4fea.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ait-170b4fea.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"2831c42a19436249a27619217043793522ee826dd49f811e5827ed170f680dd3\" already exists"}
{"level":"error","ts":"2026-11-02T21:20:09.251Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-migrate-5478da31-gw","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"name":"kuadrant-e2e-migrate-5478da31-gw","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-migrate-5478da31-gw","uid":"bd96a700-0813-4426-9fc9-385e6f32300c"}]},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2d8bc18ed9cc4eecc678cbd3e81b4c6500e6413361b69f85beffd83f39de5a74\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-migrate-5478da31-gw-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0fbbbf84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-migrate-5478da31\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-migrate-5478da31\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0fbbbf84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-migrate-5478da31\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-migrate-5478da31\"]}],\"name\":\"8efd92b8eeb534d11265c296b5a335d22570c1de7c8c8973e44c6c8fa80b4158\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7a352330852f11e1366d8253747086f455301e9d2eb3a3bab5f6dc913cbc36dd\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-migrate-5478da31-gw-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0fbbbf84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-migrate-5478da31\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-migrate-5478da31\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0fbbbf84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-migrate-5478da31\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-migrate-5478da31\"]}],\"name\":\"5a4ce94acb0bf6c4c9f5ecca1e91921b268ed09811b34ba06a360743a50c440a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a90116036f499c46c0370b64becdb1ffb38e95d4022ee7bed85e07e343fcd8da\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-migrate-5478da31-gw-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0fbbbf84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-migrate-5478da31\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-migrate-5478da31\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0fbbbf84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-migrate-5478da31\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-migrate-5478da31\"]}],\"name\":\"a43a227d4ca4f0a111c15b6c085919c0d2b23f50e62a9de0de860f087b299f53\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"24027c02a4583498aa6f81a43568c41b5e1cd0edb8dceb7fcabee9ab42b15291\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-migrate-5478da31-gw-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0fbbbf84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-migrate-5478da31\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-migrate-5478da31\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0fbbbf84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-migrate-5478da31\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-migrate-5478da31\"]}],\"name\":\"5d86db82e317dbe745a041b0493e84a6635f6b50f4f478bc047d8e50a7d523d9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"45aaa0f77536368a87ccc0e532ee12ea1375a3ac80250a09d473ce16a09b49c6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-migrate-5478da31-gw-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0fbbbf84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-migrate-5478da31\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-migrate-5478da31\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0fbbbf84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-migrate-5478da31\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-migrate-5478da31\"]}],\"name\":\"89037c1187409017a830ef6aa1e5d90a6f986828f62f93618f13ba945ff7ca33\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"119b797469fb50f10c4aa0ab7b5e0db431adfa81674efb66d2967b76f37a6ecd\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-migrate-5478da31-gw-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0fbbbf84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-migrate-5478da31\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-migrate-5478da31\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__0fbbbf84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-migrate-5478da31\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-migrate-5478da31\"]}],\"name\":\"9026db243a0b57f68404e9094190da4808393aca1a7aff2aa5616322531d65da\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}}],\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-migrate-5478da31-gw"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-e2e-migrate-5478da31-gw\" already exists"}
{"level":"error","ts":"2026-11-02T21:20:09.275Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-migrate-5478da31","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-migrate-5478da31#rule-2"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"7a352330852f11e1366d8253747086f455301e9d2eb3a3bab5f6dc913cbc36dd","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"oidc-identities":{"credentials":{},"jwt":{"issuerUrl":"https://issuer.example.com/realms/e2e","ttl":600},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\") && request.headers.authorization.matches(\"^Bearer ****\\\\.[^.]+\\\\.[^.]+$\")"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"oidc-client-bound":{"patternMatching":{"patterns":[{"operator":"eq","selector":"auth.identity.iss","value":"https://issuer.example.com/realms/e2e"},{"operator":"eq","selector":"auth.identity.azp","value":"e2e-client"}]},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\") && request.headers.authorization.matches(\"^Bearer ****\\\\.[^.]+\\\\.[^.]+$\") && has(auth.identity.iss)"}]},"oidc-groups-safe":{"opa":{"rego":"unsafe_group[g] {\n\tg := input.auth.identity.groups[_]\n\tnot regex.match(\"^[A-Za-z0-9:#._/ -]+$\", g)\n}\n\nallow {\n\tcount(unsafe_group) == 0\n}"},"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\") && has(auth.identity.groups) && size(auth.identity.groups) > 0"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["7a352330852f11e1366d8253747086f455301e9d2eb3a3bab5f6dc913cbc36dd"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-migrate-5478da31.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-migrate-5478da31.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"(request.path == \"/v1/me\" ||\nrequest.path == \"/maas-api/v1/me\" ||\nrequest.path == \"/v1/subscriptions\" ||\nrequest.path.startsWith(\"/v1/subscriptions/\") ||\nrequest.path.startsWith(\"/v1/model/\") && request.path.endsWith(\"/subscriptions\") ||\nrequest.path.startsWith(\"/v1/api-keys\") ||\nrequest.path.startsWith(\"/maas-api/v1/subscriptions\") ||\nrequest.path.startsWith(\"/maas-api/v1/model/\") && request.path.endsWith(\"/subscriptions\") ||\nrequest.path.startsWith(\"/maas-api/v1/api-keys\")) && (!request.headers.authorization.startsWith(\"Bearer ****\") && request.headers.authorization.matches(\"^Bearer ****\\\\.[^.]+\\\\.[^.]+$\") && has(auth.identity.iss))"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"7a352330852f11e1366d8253747086f455301e9d2eb3a3bab5f6dc913cbc36dd\" already exists"}
{"level":"error","ts":"2026-11-02T21:20:09.315Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-ait-170b4fea","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"name":"kuadrant-e2e-ait-170b4fea","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-ait-170b4fea","uid":"e09fe579-ee4a-47b2-a12e-6a7b9f2f543d"}]},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1fbe2fb204eec57d92b46c554aac8ef9399bcbee6fc1a0898c1330fb6e490446\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ait-170b4fea-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bde1f383\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ait-170b4fea\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ait-170b4fea\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bde1f383\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ait-170b4fea\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ait-170b4fea\"]}],\"name\":\"e899eb89fe02dbf7fdb5be845b59b0b845375de7c95e3a08e12bc088dcb26c5c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7e78eecab02e1fd809cd8937f47dd685bd8416e8bea268e4aafb7c23f9e267bf\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ait-170b4fea-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bde1f383\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ait-170b4fea\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ait-170b4fea\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bde1f383\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ait-170b4fea\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ait-170b4fea\"]}],\"name\":\"2044d2d0aabc15fe446831436962cee277f79713a89c25fffdee63ee10472e8e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7b68d94071435f75656ff8074db2774ad9ed15dddaf6862b3900065ddc6a11b2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ait-170b4fea-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bde1f383\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ait-170b4fea\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ait-170b4fea\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bde1f383\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ait-170b4fea\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ait-170b4fea\"]}],\"name\":\"3edb70504e31425891549eea2a33846dd9c51fc6d0080929340741dd27b0f1d4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2831c42a19436249a27619217043793522ee826dd49f811e5827ed170f680dd3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ait-170b4fea-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bde1f383\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ait-170b4fea\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ait-170b4fea\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bde1f383\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ait-170b4fea\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ait-170b4fea\"]}],\"name\":\"6d11ae87fe5dc7b275c5da3db03a70dc91d2c7e0ffcfad8c936128c52b55877f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f79a67059485d7c175d20633d82aabe70b4d1d84be145221b0214efd85a59820\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ait-170b4fea-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bde1f383\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ait-170b4fea\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ait-170b4fea\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bde1f383\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ait-170b4fea\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ait-170b4fea\"]}],\"name\":\"48193cca9f77574db1b7230195ad4928c30a165f1bd6ea263446d1f97036dd4e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6bf80d5681d0b7284fc57805d1a8d49f34a5a111b4ae9f47de5635430b72573f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ait-170b4fea-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bde1f383\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ait-170b4fea\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ait-170b4fea\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bde1f383\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ait-170b4fea\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ait-170b4fea\"]}],\"name\":\"87ed2bd29a8db733f3056f14ef7404d9c30a03fc860223c62283a41bae3d8db7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-ait-170b4fea"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-e2e-ait-170b4fea\" already exists"}
{"level":"error","ts":"2026-11-02T21:20:09.343Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-migrate-5478da31","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-migrate-5478da31#rule-5"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"a90116036f499c46c0370b64becdb1ffb38e95d4022ee7bed85e07e343fcd8da","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"oidc-identities":{"credentials":{},"jwt":{"issuerUrl":"https://issuer.example.com/realms/e2e","ttl":600},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\") && request.headers.authorization.matches(\"^Bearer ****\\\\.[^.]+\\\\.[^.]+$\")"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"oidc-client-bound":{"patternMatching":{"patterns":[{"operator":"eq","selector":"auth.identity.iss","value":"https://issuer.example.com/realms/e2e"},{"operator":"eq","selector":"auth.identity.azp","value":"e2e-client"}]},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\") && request.headers.authorization.matches(\"^Bearer ****\\\\.[^.]+\\\\.[^.]+$\") && has(auth.identity.iss)"}]},"oidc-groups-safe":{"opa":{"rego":"unsafe_group[g] {\n\tg := input.auth.identity.groups[_]\n\tnot regex.match(\"^[A-Za-z0-9:#._/ -]+$\", g)\n}\n\nallow {\n\tcount(unsafe_group) == 0\n}"},"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\") && has(auth.identity.groups) && size(auth.identity.groups) > 0"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a90116036f499c46c0370b64becdb1ffb38e95d4022ee7bed85e07e343fcd8da"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-migrate-5478da31.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-migrate-5478da31.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"(request.path == \"/v1/me\" ||\nrequest.path == \"/maas-api/v1/me\" ||\nrequest.path == \"/v1/subscriptions\" ||\nrequest.path.startsWith(\"/v1/subscriptions/\") ||\nrequest.path.startsWith(\"/v1/model/\") && request.path.endsWith(\"/subscriptions\") ||\nrequest.path.startsWith(\"/v1/api-keys\") ||\nrequest.path.startsWith(\"/maas-api/v1/subscriptions\") ||\nrequest.path.startsWith(\"/maas-api/v1/model/\") && request.path.endsWith(\"/subscriptions\") ||\nrequest.path.startsWith(\"/maas-api/v1/api-keys\")) && (!request.headers.authorization.startsWith(\"Bearer ****\") && request.headers.authorization.matches(\"^Bearer ****\\\\.[^.]+\\\\.[^.]+$\") && has(auth.identity.iss))"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"a90116036f499c46c0370b64becdb1ffb38e95d4022ee7bed85e07e343fcd8da\" already exists"}
{"level":"error","ts":"2026-11-02T21:20:09.410Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-ait-170b4fea","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-ait-170b4fea#rule-2"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"7e78eecab02e1fd809cd8937f47dd685bd8416e8bea268e4aafb7c23f9e267bf","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["7e78eecab02e1fd809cd8937f47dd685bd8416e8bea268e4aafb7c23f9e267bf"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ait-170b4fea.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ait-170b4fea.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"7e78eecab02e1fd809cd8937f47dd685bd8416e8bea268e4aafb7c23f9e267bf\" already exists"}
{"level":"error","ts":"2026-11-02T21:20:09.489Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-ait-170b4fea","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-ait-170b4fea#rule-4"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"f79a67059485d7c175d20633d82aabe70b4d1d84be145221b0214efd85a59820","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f79a67059485d7c175d20633d82aabe70b4d1d84be145221b0214efd85a59820"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ait-170b4fea.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ait-170b4fea.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"f79a67059485d7c175d20633d82aabe70b4d1d84be145221b0214efd85a59820\" already exists"}
{"level":"error","ts":"2026-11-02T21:20:09.557Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-ait-170b4fea","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-ait-170b4fea#rule-5"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"7b68d94071435f75656ff8074db2774ad9ed15dddaf6862b3900065ddc6a11b2","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["7b68d94071435f75656ff8074db2774ad9ed15dddaf6862b3900065ddc6a11b2"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ait-170b4fea.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ait-170b4fea.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"7b68d94071435f75656ff8074db2774ad9ed15dddaf6862b3900065ddc6a11b2\" already exists"}
{"level":"error","ts":"2026-11-02T21:20:09.626Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-ait-170b4fea","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-ait-170b4fea#rule-1"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"6bf80d5681d0b7284fc57805d1a8d49f34a5a111b4ae9f47de5635430b72573f","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["6bf80d5681d0b7284fc57805d1a8d49f34a5a111b4ae9f47de5635430b72573f"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ait-170b4fea.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ait-170b4fea.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"6bf80d5681d0b7284fc57805d1a8d49f34a5a111b4ae9f47de5635430b72573f\" already exists"}
{"level":"error","ts":"2026-11-02T21:20:09.694Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-ait-170b4fea","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-ait-170b4fea#rule-6"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"1fbe2fb204eec57d92b46c554aac8ef9399bcbee6fc1a0898c1330fb6e490446","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["1fbe2fb204eec57d92b46c554aac8ef9399bcbee6fc1a0898c1330fb6e490446"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ait-170b4fea.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ait-170b4fea.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"1fbe2fb204eec57d92b46c554aac8ef9399bcbee6fc1a0898c1330fb6e490446\" already exists"}
{"level":"error","ts":"2026-11-02T21:20:09.763Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-migrate-5478da31","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-migrate-5478da31#rule-4"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"45aaa0f77536368a87ccc0e532ee12ea1375a3ac80250a09d473ce16a09b49c6","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"oidc-identities":{"credentials":{},"jwt":{"issuerUrl":"https://issuer.example.com/realms/e2e","ttl":600},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\") && request.headers.authorization.matches(\"^Bearer ****\\\\.[^.]+\\\\.[^.]+$\")"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"oidc-client-bound":{"patternMatching":{"patterns":[{"operator":"eq","selector":"auth.identity.iss","value":"https://issuer.example.com/realms/e2e"},{"operator":"eq","selector":"auth.identity.azp","value":"e2e-client"}]},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\") && request.headers.authorization.matches(\"^Bearer ****\\\\.[^.]+\\\\.[^.]+$\") && has(auth.identity.iss)"}]},"oidc-groups-safe":{"opa":{"rego":"unsafe_group[g] {\n\tg := input.auth.identity.groups[_]\n\tnot regex.match(\"^[A-Za-z0-9:#._/ -]+$\", g)\n}\n\nallow {\n\tcount(unsafe_group) == 0\n}"},"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\") && has(auth.identity.groups) && size(auth.identity.groups) > 0"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["45aaa0f77536368a87ccc0e532ee12ea1375a3ac80250a09d473ce16a09b49c6"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-migrate-5478da31.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-migrate-5478da31.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"(request.path == \"/v1/me\" ||\nrequest.path == \"/maas-api/v1/me\" ||\nrequest.path == \"/v1/subscriptions\" ||\nrequest.path.startsWith(\"/v1/subscriptions/\") ||\nrequest.path.startsWith(\"/v1/model/\") && request.path.endsWith(\"/subscriptions\") ||\nrequest.path.startsWith(\"/v1/api-keys\") ||\nrequest.path.startsWith(\"/maas-api/v1/subscriptions\") ||\nrequest.path.startsWith(\"/maas-api/v1/model/\") && request.path.endsWith(\"/subscriptions\") ||\nrequest.path.startsWith(\"/maas-api/v1/api-keys\")) && (!request.headers.authorization.startsWith(\"Bearer ****\") && request.headers.authorization.matches(\"^Bearer ****\\\\.[^.]+\\\\.[^.]+$\") && has(auth.identity.iss))"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"45aaa0f77536368a87ccc0e532ee12ea1375a3ac80250a09d473ce16a09b49c6\" already exists"}
{"level":"error","ts":"2026-11-02T21:20:09.835Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-migrate-5478da31","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-migrate-5478da31#rule-1"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"119b797469fb50f10c4aa0ab7b5e0db431adfa81674efb66d2967b76f37a6ecd","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"oidc-identities":{"credentials":{},"jwt":{"issuerUrl":"https://issuer.example.com/realms/e2e","ttl":600},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\") && request.headers.authorization.matches(\"^Bearer ****\\\\.[^.]+\\\\.[^.]+$\")"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"oidc-client-bound":{"patternMatching":{"patterns":[{"operator":"eq","selector":"auth.identity.iss","value":"https://issuer.example.com/realms/e2e"},{"operator":"eq","selector":"auth.identity.azp","value":"e2e-client"}]},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\") && request.headers.authorization.matches(\"^Bearer ****\\\\.[^.]+\\\\.[^.]+$\") && has(auth.identity.iss)"}]},"oidc-groups-safe":{"opa":{"rego":"unsafe_group[g] {\n\tg := input.auth.identity.groups[_]\n\tnot regex.match(\"^[A-Za-z0-9:#._/ -]+$\", g)\n}\n\nallow {\n\tcount(unsafe_group) == 0\n}"},"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\") && has(auth.identity.groups) && size(auth.identity.groups) > 0"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["119b797469fb50f10c4aa0ab7b5e0db431adfa81674efb66d2967b76f37a6ecd"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-migrate-5478da31.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-migrate-5478da31.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"(request.path == \"/v1/me\" ||\nrequest.path == \"/maas-api/v1/me\" ||\nrequest.path == \"/v1/subscriptions\" ||\nrequest.path.startsWith(\"/v1/subscriptions/\") ||\nrequest.path.startsWith(\"/v1/model/\") && request.path.endsWith(\"/subscriptions\") ||\nrequest.path.startsWith(\"/v1/api-keys\") ||\nrequest.path.startsWith(\"/maas-api/v1/subscriptions\") ||\nrequest.path.startsWith(\"/maas-api/v1/model/\") && request.path.endsWith(\"/subscriptions\") ||\nrequest.path.startsWith(\"/maas-api/v1/api-keys\")) && (!request.headers.authorization.startsWith(\"Bearer ****\") && request.headers.authorization.matches(\"^Bearer ****\\\\.[^.]+\\\\.[^.]+$\") && has(auth.identity.iss))"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"119b797469fb50f10c4aa0ab7b5e0db431adfa81674efb66d2967b76f37a6ecd\" already exists"}
{"level":"error","ts":"2026-11-02T21:20:09.904Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-migrate-5478da31","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-migrate-5478da31#rule-3"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"24027c02a4583498aa6f81a43568c41b5e1cd0edb8dceb7fcabee9ab42b15291","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"oidc-identities":{"credentials":{},"jwt":{"issuerUrl":"https://issuer.example.com/realms/e2e","ttl":600},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\") && request.headers.authorization.matches(\"^Bearer ****\\\\.[^.]+\\\\.[^.]+$\")"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"oidc-client-bound":{"patternMatching":{"patterns":[{"operator":"eq","selector":"auth.identity.iss","value":"https://issuer.example.com/realms/e2e"},{"operator":"eq","selector":"auth.identity.azp","value":"e2e-client"}]},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\") && request.headers.authorization.matches(\"^Bearer ****\\\\.[^.]+\\\\.[^.]+$\") && has(auth.identity.iss)"}]},"oidc-groups-safe":{"opa":{"rego":"unsafe_group[g] {\n\tg := input.auth.identity.groups[_]\n\tnot regex.match(\"^[A-Za-z0-9:#._/ -]+$\", g)\n}\n\nallow {\n\tcount(unsafe_group) == 0\n}"},"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\") && has(auth.identity.groups) && size(auth.identity.groups) > 0"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["24027c02a4583498aa6f81a43568c41b5e1cd0edb8dceb7fcabee9ab42b15291"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-migrate-5478da31.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-migrate-5478da31.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"(request.path == \"/v1/me\" ||\nrequest.path == \"/maas-api/v1/me\" ||\nrequest.path == \"/v1/subscriptions\" ||\nrequest.path.startsWith(\"/v1/subscriptions/\") ||\nrequest.path.startsWith(\"/v1/model/\") && request.path.endsWith(\"/subscriptions\") ||\nrequest.path.startsWith(\"/v1/api-keys\") ||\nrequest.path.startsWith(\"/maas-api/v1/subscriptions\") ||\nrequest.path.startsWith(\"/maas-api/v1/model/\") && request.path.endsWith(\"/subscriptions\") ||\nrequest.path.startsWith(\"/maas-api/v1/api-keys\")) && (!request.headers.authorization.startsWith(\"Bearer ****\") && request.headers.authorization.matches(\"^Bearer ****\\\\.[^.]+\\\\.[^.]+$\") && has(auth.identity.iss))"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"24027c02a4583498aa6f81a43568c41b5e1cd0edb8dceb7fcabee9ab42b15291\" already exists"}
{"level":"error","ts":"2026-11-02T21:20:09.963Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-migrate-5478da31","namespace":"openshift-ingress","uid":"321ee9d7-ae75-4cec-a128-7692c5c72070","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-migrate-5478da31\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:20:09.969Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-ait-170b4fea-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-ait-170b4fea-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:20:10.022Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-simulated-simulated-premium","namespace":"llm","uid":"447993be-3c57-4e68-8ffa-6fc998a39c77","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-simulated-simulated-premium\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:20:10.110Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-migrate-5478da31-gw-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-migrate-5478da31-gw-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:20:10.146Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-ait-170b4fea","namespace":"openshift-ingress","uid":"b9e479b0-1d70-4023-a0f9-2895edc98442","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-ait-170b4fea\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:20:10Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ait-84de7f3a","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ait-84de7f3a","reconcileID":"9d87380e-2ebb-4dcf-8ba9-cacb7e3493fb","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-ait-84de7f3a","namespace":"openshift-ingress"}
{"level":"error","ts":"2026-11-02T21:20:10.203Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-facebook-opt-125m-simulated","namespace":"llm","uid":"da8edb1a-ed61-454d-939f-fc7cd235d9fb","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-facebook-opt-125m-simulated\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:20:10.203Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:20:10.203Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:20:10Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-ait-84de7f3a","event":"CREATE"}
{"level":"info","ts":"2026-11-02T21:20:10Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-02T21:20:10.266Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"maas-api-route-e2e-ait-170b4fea","namespace":"odh-ai-gateway-infra","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"maas-api-route-e2e-ait-170b4fea\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:20:10.337Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"maas-api-route-e2e-migrate-5478da31","namespace":"odh-ai-gateway-infra","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"maas-api-route-e2e-migrate-5478da31\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:20:10.512Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-migrate-5478da31-gw","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-migrate-5478da31-gw\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:20:10.575Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-ait-170b4fea","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-ait-170b4fea\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:20:10Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-02T21:20:10Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"error","ts":"2026-11-02T21:20:10.699Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-ait-84de7f3a","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-ait-84de7f3a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:20:10Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:20:10Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ait-84de7f3a","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ait-84de7f3a","reconcileID":"46e1ae42-8753-4408-bc95-5602a068d5fe","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-ait-84de7f3a","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:20:10Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-ait-84de7f3a","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T21:20:10Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:20:11Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-02T21:20:11Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-02T21:20:11Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-02T21:20:11Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:20:15Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ait-6f4fe932","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ait-6f4fe932","reconcileID":"b7794b23-366c-4279-9ae3-902fe8b46163","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-ait-6f4fe932","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:20:15Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-ait-6f4fe932","event":"CREATE"}
{"level":"info","ts":"2026-11-02T21:20:15Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:20:15Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-02T21:20:15Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-02T21:20:16Z","logger":"telemetry-policy-extension-controller","msg":"Failed to update status: resource might just be outdated"}
{"level":"info","ts":"2026-11-02T21:20:16Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:20:16Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ait-6f4fe932","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ait-6f4fe932","reconcileID":"d2362387-cd7f-4201-a72b-7afe8528834a","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-ait-6f4fe932","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:20:16Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-ait-6f4fe932","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T21:20:16Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:20:16.485Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","EnvoyFilter","Gateway","HTTPRoute","TokenRateLimitPolicy","AuthPolicy","Kuadrant","ConfigMap","Limitador"],"eventTypes":{"create":21,"update":14}}
{"level":"info","ts":"2026-11-02T21:20:16.568Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:20:16.590Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:20:16.662Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:20:16.729Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:20:16Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-02T21:20:16Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-02T21:20:16Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:20:16Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ait-6f4fe932","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ait-6f4fe932","reconcileID":"9cea44fd-5c86-4d5e-8cc1-ecbe40519660","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-ait-6f4fe932","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:20:16.831Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:20:16.831Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:20:16.831Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:20:16Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-ait-6f4fe932","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T21:20:16Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:20:17.046Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:20:17.047Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:20:17.047Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:20:17.048Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:20:17.050Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:20:17.051Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-11-02T21:20:17.107Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:20:17.107Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:20:17Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-02T21:20:17Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-02T21:20:17Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-02T21:20:17Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:20:17.876Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:20:17.876Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:20:18.419Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Kuadrant","Gateway","HTTPRoute"],"eventTypes":{"create":1,"update":2}}
{"level":"info","ts":"2026-11-02T21:20:18.486Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:20:18.502Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:20:18.546Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:20:18.573Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:20:18.666Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:20:18.666Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:20:18.666Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:20:18.853Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:20:18.854Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:20:18.854Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:20:18.856Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:20:18.858Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:20:18.859Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-11-02T21:20:18.924Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-ait-84de7f3a","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/ratelimit":"true"},"name":"kuadrant-ratelimiting-e2e-ait-84de7f3a","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-ait-84de7f3a","uid":"b52b81e2-bf27-4ed2-b957-1177d1fb8b34"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"limitador-limitador.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-ratelimit-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"limitador-limitador.kuadrant-system.svc.cluster.local","port_value":8081}}}}]}]},"name":"kuadrant-ratelimit-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-ait-84de7f3a"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-ait-84de7f3a\" already exists"}
{"level":"error","ts":"2026-11-02T21:20:18.924Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:20:18.924Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T21:20:18.924Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-ait-84de7f3a","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"kuadrant-auth-e2e-ait-84de7f3a","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-ait-84de7f3a","uid":"b52b81e2-bf27-4ed2-b957-1177d1fb8b34"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-auth-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local","port_value":50051}}}}]}]},"name":"kuadrant-auth-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-ait-84de7f3a"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-ait-84de7f3a\" already exists"}
{"level":"error","ts":"2026-11-02T21:20:18.927Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-ait-84de7f3a","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-ait-84de7f3a#rule-4"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"eb07ca64b26b7d38355ff795867271a17ed10f6c9102c3916d9ca95b620d6b3e","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["eb07ca64b26b7d38355ff795867271a17ed10f6c9102c3916d9ca95b620d6b3e"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ait-84de7f3a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ait-84de7f3a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"eb07ca64b26b7d38355ff795867271a17ed10f6c9102c3916d9ca95b620d6b3e\" already exists"}
{"level":"error","ts":"2026-11-02T21:20:19.000Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-ait-84de7f3a","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-ait-84de7f3a#rule-5"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"b2774e83fd7be8cadbe91ef268ad972ab5a0d2fd97c27176866f86e842de8e08","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["b2774e83fd7be8cadbe91ef268ad972ab5a0d2fd97c27176866f86e842de8e08"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ait-84de7f3a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ait-84de7f3a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"b2774e83fd7be8cadbe91ef268ad972ab5a0d2fd97c27176866f86e842de8e08\" already exists"}
{"level":"error","ts":"2026-11-02T21:20:19.028Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-ait-84de7f3a","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"name":"kuadrant-e2e-ait-84de7f3a","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-ait-84de7f3a","uid":"b52b81e2-bf27-4ed2-b957-1177d1fb8b34"}]},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a022ce809b77c09b07324ce87ff1055fc5d959fa22b0a23a6932b1cc923bbee1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ait-84de7f3a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__e52e7667\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ait-84de7f3a\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ait-84de7f3a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__e52e7667\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ait-84de7f3a\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ait-84de7f3a\"]}],\"name\":\"22a145782ee9d9eb963f9c869dfe890eb1af39bab9237e94ffe5a43cff34b765\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b3a8d89bb951b164cefacf707c294fefc589285cb394c6a950807e74584186f8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ait-84de7f3a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__e52e7667\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ait-84de7f3a\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ait-84de7f3a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__e52e7667\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ait-84de7f3a\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ait-84de7f3a\"]}],\"name\":\"16a397eb4f09d49b4ec6e189b3177d78187084c1f609f0666711f4ab64c5f368\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b2774e83fd7be8cadbe91ef268ad972ab5a0d2fd97c27176866f86e842de8e08\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ait-84de7f3a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__e52e7667\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ait-84de7f3a\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ait-84de7f3a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__e52e7667\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ait-84de7f3a\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ait-84de7f3a\"]}],\"name\":\"c4c8b6bc7374efb1b4aad8cd0575a021c753002559279ea793648eab6113826e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e5aa47d4ff2df4f8a01352c174792989fe29e178320cd92c92b8bf26f7a50344\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ait-84de7f3a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__e52e7667\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ait-84de7f3a\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ait-84de7f3a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__e52e7667\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ait-84de7f3a\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ait-84de7f3a\"]}],\"name\":\"5f3cc13e96d4785355544af1075557194319b64b22397771a5122c40b0dffc8b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"eb07ca64b26b7d38355ff795867271a17ed10f6c9102c3916d9ca95b620d6b3e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ait-84de7f3a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__e52e7667\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ait-84de7f3a\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ait-84de7f3a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__e52e7667\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ait-84de7f3a\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ait-84de7f3a\"]}],\"name\":\"ae6f3d57ec0b0869b75a7d7c276de8184d11c5c75a12ec1e094345c2a711b27f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5113497a6647a1a7e4129b986081e065d299f9e913b8ee4228d58792fae1868a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ait-84de7f3a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__e52e7667\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ait-84de7f3a\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ait-84de7f3a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__e52e7667\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ait-84de7f3a\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ait-84de7f3a\"]}],\"name\":\"b5d824bd40641d16a6c6282f58f4e785ea6c3ba4c0113986aceab8895da9a3d2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-ait-84de7f3a"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-e2e-ait-84de7f3a\" already exists"}
{"level":"error","ts":"2026-11-02T21:20:19.074Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-ait-84de7f3a","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-ait-84de7f3a#rule-2"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"b3a8d89bb951b164cefacf707c294fefc589285cb394c6a950807e74584186f8","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["b3a8d89bb951b164cefacf707c294fefc589285cb394c6a950807e74584186f8"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ait-84de7f3a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ait-84de7f3a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"b3a8d89bb951b164cefacf707c294fefc589285cb394c6a950807e74584186f8\" already exists"}
{"level":"error","ts":"2026-11-02T21:20:19.144Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-ait-84de7f3a","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-ait-84de7f3a#rule-6"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"a022ce809b77c09b07324ce87ff1055fc5d959fa22b0a23a6932b1cc923bbee1","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a022ce809b77c09b07324ce87ff1055fc5d959fa22b0a23a6932b1cc923bbee1"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ait-84de7f3a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ait-84de7f3a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"a022ce809b77c09b07324ce87ff1055fc5d959fa22b0a23a6932b1cc923bbee1\" already exists"}
{"level":"error","ts":"2026-11-02T21:20:19.213Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-ait-84de7f3a","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-ait-84de7f3a#rule-3"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"e5aa47d4ff2df4f8a01352c174792989fe29e178320cd92c92b8bf26f7a50344","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["e5aa47d4ff2df4f8a01352c174792989fe29e178320cd92c92b8bf26f7a50344"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ait-84de7f3a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ait-84de7f3a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"e5aa47d4ff2df4f8a01352c174792989fe29e178320cd92c92b8bf26f7a50344\" already exists"}
{"level":"error","ts":"2026-11-02T21:20:19.282Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-ait-84de7f3a","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-ait-84de7f3a#rule-1"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"5113497a6647a1a7e4129b986081e065d299f9e913b8ee4228d58792fae1868a","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["5113497a6647a1a7e4129b986081e065d299f9e913b8ee4228d58792fae1868a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ait-84de7f3a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ait-84de7f3a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"5113497a6647a1a7e4129b986081e065d299f9e913b8ee4228d58792fae1868a\" already exists"}
{"level":"error","ts":"2026-11-02T21:20:19.342Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-ait-170b4fea","namespace":"openshift-ingress","uid":"b9e479b0-1d70-4023-a0f9-2895edc98442","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-ait-170b4fea\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:20:19.415Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-ait-84de7f3a-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-ait-84de7f3a-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:20:19.480Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-ait-170b4fea-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-ait-170b4fea-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:20:19.584Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-ait-84de7f3a","namespace":"openshift-ingress","uid":"9f61d37d-b6c4-476d-bddc-e2ae1441acfb","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-ait-84de7f3a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:20:19.623Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-migrate-5478da31-gw-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-migrate-5478da31-gw-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:20:19.643Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-migrate-5478da31","namespace":"openshift-ingress","uid":"321ee9d7-ae75-4cec-a128-7692c5c72070","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-migrate-5478da31\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:20:19.643Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:20:19.643Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T21:20:19.713Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"maas-api-route-e2e-ait-84de7f3a","namespace":"odh-ai-gateway-infra","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"maas-api-route-e2e-ait-84de7f3a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:20:20.135Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-ait-84de7f3a","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-ait-84de7f3a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:20:25Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-derive-54a47302","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-derive-54a47302","reconcileID":"a801f69c-6e8c-4207-a41f-36d376140529","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-derive-54a47302","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:20:25Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-derive-54a47302","event":"CREATE"}
{"level":"info","ts":"2026-11-02T21:20:25Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:20:26.039Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Kuadrant","EnvoyFilter","AuthPolicy","AuthConfig","Limitador","Gateway","TokenRateLimitPolicy","HTTPRoute","ConfigMap"],"eventTypes":{"create":11,"update":11}}
{"level":"info","ts":"2026-11-02T21:20:26.138Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:20:26.158Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:20:26.255Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:20:26.428Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:20:26.537Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:20:26.537Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:20:26.565Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:20:26Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-02T21:20:26Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-02T21:20:26.646Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:20:26.647Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:20:26.647Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:20:26.648Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:20:26.650Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:20:26.651Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:20:26Z","logger":"telemetry-policy-extension-controller","msg":"Failed to update status: resource might just be outdated"}
{"level":"info","ts":"2026-11-02T21:20:26Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:20:26Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-derive-54a47302","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-derive-54a47302","reconcileID":"0149bddf-498f-481d-b9ec-0fe7ba8b8835","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-derive-54a47302","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:20:26.725Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:20:26Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-derive-54a47302","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T21:20:26Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:20:27Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-02T21:20:27Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-02T21:20:27Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:20:27Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-derive-54a47302","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-derive-54a47302","reconcileID":"f0247aad-33b1-4c8d-83bb-a327d3c75716","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-derive-54a47302","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:20:27Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-derive-54a47302","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T21:20:27Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:20:27.535Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:20:27.536Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:20:27Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-02T21:20:27Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-02T21:20:27Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-02T21:20:27Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:20:28.070Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway","HTTPRoute"],"eventTypes":{"create":1,"update":1}}
{"level":"info","ts":"2026-11-02T21:20:28.535Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:20:28.536Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:20:28.537Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:20:28.538Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:20:28.540Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:20:28.542Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-11-02T21:20:28.594Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-ait-6f4fe932","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/ratelimit":"true"},"name":"kuadrant-ratelimiting-e2e-ait-6f4fe932","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-ait-6f4fe932","uid":"5969917f-1c39-4e99-a7cb-edbbc7ccb641"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"limitador-limitador.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-ratelimit-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"limitador-limitador.kuadrant-system.svc.cluster.local","port_value":8081}}}}]}]},"name":"kuadrant-ratelimit-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-ait-6f4fe932"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-ait-6f4fe932\" already exists"}
{"level":"error","ts":"2026-11-02T21:20:28.624Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:20:28.624Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T21:20:28.624Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-ait-6f4fe932","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"kuadrant-auth-e2e-ait-6f4fe932","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-ait-6f4fe932","uid":"5969917f-1c39-4e99-a7cb-edbbc7ccb641"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-auth-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local","port_value":50051}}}}]}]},"name":"kuadrant-auth-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-ait-6f4fe932"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-ait-6f4fe932\" already exists"}
{"level":"error","ts":"2026-11-02T21:20:28.624Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-ait-6f4fe932","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-ait-6f4fe932#rule-4"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"7927df375c4cc4ee643e85d846316d18c522151244dbca70d8e91d2861f5aac9","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["7927df375c4cc4ee643e85d846316d18c522151244dbca70d8e91d2861f5aac9"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ait-6f4fe932.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ait-6f4fe932.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"7927df375c4cc4ee643e85d846316d18c522151244dbca70d8e91d2861f5aac9\" already exists"}
{"level":"error","ts":"2026-11-02T21:20:28.691Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-ait-6f4fe932","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-ait-6f4fe932#rule-5"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"2e1e8e82bd77893addc580eca5bede5ad2845616ea51050bb8cab0038aa88879","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["2e1e8e82bd77893addc580eca5bede5ad2845616ea51050bb8cab0038aa88879"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ait-6f4fe932.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ait-6f4fe932.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"2e1e8e82bd77893addc580eca5bede5ad2845616ea51050bb8cab0038aa88879\" already exists"}
{"level":"error","ts":"2026-11-02T21:20:28.725Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-ait-6f4fe932","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"name":"kuadrant-e2e-ait-6f4fe932","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-ait-6f4fe932","uid":"5969917f-1c39-4e99-a7cb-edbbc7ccb641"}]},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"464cb0a79a5094693c54e3b155539f3de31e023694979770ffcb0257eabaad41\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ait-6f4fe932-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__59a9f392\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ait-6f4fe932\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ait-6f4fe932\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__59a9f392\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ait-6f4fe932\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ait-6f4fe932\"]}],\"name\":\"2964a80d01dc6a1e1b1529bcd2cc18a3719ac90ef0e753ab740a1d86a6ed08c9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b039dc6d5f9e02048b64874aaa2070beb7a4c9a6d546e2d2c4332fc98295f610\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ait-6f4fe932-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__59a9f392\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ait-6f4fe932\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ait-6f4fe932\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__59a9f392\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ait-6f4fe932\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ait-6f4fe932\"]}],\"name\":\"355c51743e53a32c218ed3d98eefb0d89612527ecf8a8d3baee250fad5559e4f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2e1e8e82bd77893addc580eca5bede5ad2845616ea51050bb8cab0038aa88879\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ait-6f4fe932-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__59a9f392\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ait-6f4fe932\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ait-6f4fe932\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__59a9f392\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ait-6f4fe932\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ait-6f4fe932\"]}],\"name\":\"ee37ece2cf2b4a1ce2ae504815773e306699dfc7369388c06f1b2e0a631e9553\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7ebf3775887ba71f04af1eff4363f21a6d47108958016775943bab60970463bf\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ait-6f4fe932-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__59a9f392\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ait-6f4fe932\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ait-6f4fe932\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__59a9f392\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ait-6f4fe932\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ait-6f4fe932\"]}],\"name\":\"38b93250b574be9917e709d9dd78f1d7d4f7a01a2b7a7d3abea1e5cbed0038b1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7927df375c4cc4ee643e85d846316d18c522151244dbca70d8e91d2861f5aac9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ait-6f4fe932-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__59a9f392\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ait-6f4fe932\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ait-6f4fe932\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__59a9f392\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ait-6f4fe932\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ait-6f4fe932\"]}],\"name\":\"df027e188c11aa429a1061ac9833ff4dfd7a7e0cabb170a8114a0199672d2d3d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"297756b7362e52b440e283847b119e6aece21be1ef66d278febc9cfae126aac5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ait-6f4fe932-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__59a9f392\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ait-6f4fe932\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ait-6f4fe932\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__59a9f392\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ait-6f4fe932\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ait-6f4fe932\"]}],\"name\":\"1789125d5b6353abf63e99c34c35855d4f05cb382b9046744e0aca8ba87aac36\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-ait-6f4fe932"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-e2e-ait-6f4fe932\" already exists"}
{"level":"error","ts":"2026-11-02T21:20:28.757Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-ait-6f4fe932","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-ait-6f4fe932#rule-3"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"7ebf3775887ba71f04af1eff4363f21a6d47108958016775943bab60970463bf","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["7ebf3775887ba71f04af1eff4363f21a6d47108958016775943bab60970463bf"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ait-6f4fe932.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ait-6f4fe932.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"7ebf3775887ba71f04af1eff4363f21a6d47108958016775943bab60970463bf\" already exists"}
{"level":"error","ts":"2026-11-02T21:20:28.829Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-ait-6f4fe932","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-ait-6f4fe932#rule-1"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"297756b7362e52b440e283847b119e6aece21be1ef66d278febc9cfae126aac5","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["297756b7362e52b440e283847b119e6aece21be1ef66d278febc9cfae126aac5"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ait-6f4fe932.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ait-6f4fe932.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"297756b7362e52b440e283847b119e6aece21be1ef66d278febc9cfae126aac5\" already exists"}
{"level":"error","ts":"2026-11-02T21:20:28.897Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-ait-6f4fe932","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-ait-6f4fe932#rule-2"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"b039dc6d5f9e02048b64874aaa2070beb7a4c9a6d546e2d2c4332fc98295f610","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["b039dc6d5f9e02048b64874aaa2070beb7a4c9a6d546e2d2c4332fc98295f610"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ait-6f4fe932.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ait-6f4fe932.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"b039dc6d5f9e02048b64874aaa2070beb7a4c9a6d546e2d2c4332fc98295f610\" already exists"}
{"level":"error","ts":"2026-11-02T21:20:28.964Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-ait-6f4fe932","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-ait-6f4fe932#rule-6"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"464cb0a79a5094693c54e3b155539f3de31e023694979770ffcb0257eabaad41","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["464cb0a79a5094693c54e3b155539f3de31e023694979770ffcb0257eabaad41"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ait-6f4fe932.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ait-6f4fe932.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"464cb0a79a5094693c54e3b155539f3de31e023694979770ffcb0257eabaad41\" already exists"}
{"level":"error","ts":"2026-11-02T21:20:29.123Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-ait-6f4fe932","namespace":"openshift-ingress","uid":"aa57e6fd-ca40-4d6e-b2d4-5fea445d3c19","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-ait-6f4fe932\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:20:29.208Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-ait-84de7f3a-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-ait-84de7f3a-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:20:29.355Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-ait-84de7f3a","namespace":"openshift-ingress","uid":"9f61d37d-b6c4-476d-bddc-e2ae1441acfb","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-ait-84de7f3a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:20:29.400Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-ait-6f4fe932-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-ait-6f4fe932-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:20:29.414Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:20:29.414Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T21:20:29.482Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"maas-api-route-e2e-ait-6f4fe932","namespace":"odh-ai-gateway-infra","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"maas-api-route-e2e-ait-6f4fe932\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:20:29.906Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-ait-6f4fe932","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-ait-6f4fe932\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:20:33.849Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","AuthConfig","Limitador","AuthPolicy","EnvoyFilter","HTTPRoute","TokenRateLimitPolicy","Kuadrant","Gateway"],"eventTypes":{"create":11,"update":9}}
{"level":"info","ts":"2026-11-02T21:20:33.969Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:20:33.982Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:20:34.132Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:20:34.147Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:20:34.232Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:20:34.232Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:20:34.232Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:20:34.544Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:20:34.547Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:20:34.547Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:20:34.547Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:20:34.550Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:20:34.550Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-11-02T21:20:34.625Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:20:34.625Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:20:35.539Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:20:35.539Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:20:40.039Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Limitador","ConfigMap","EnvoyFilter","AuthConfig","AuthPolicy","TokenRateLimitPolicy","Gateway","HTTPRoute"],"eventTypes":{"create":9,"update":8}}
{"level":"info","ts":"2026-11-02T21:20:40.158Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:20:40.363Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:20:40.523Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:20:40.523Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:20:40.530Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:20:40.530Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:20:40.532Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:20:40.536Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:20:40.536Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:20:40.543Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:20:40.632Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:20:41.554Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:20:41.554Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:20:46.063Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","Limitador","AuthPolicy","ConfigMap"],"eventTypes":{"update":4}}
{"level":"info","ts":"2026-11-02T21:20:46.183Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:20:46.325Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:20:46.468Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:20:46.468Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:20:46.666Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:20:46.666Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:20:46.668Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-02T21:20:46.668Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:20:46.671Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:20:46.671Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:20:46.678Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:20:47.684Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:20:47.684Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:20:50.184Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","ConfigMap","Limitador"],"eventTypes":{"update":9}}
{"level":"info","ts":"2026-11-02T21:20:50.306Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:20:50.454Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:20:50.541Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:20:50.541Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:20:50.675Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:20:50.677Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-02T21:20:50.677Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:20:50.677Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:20:50.724Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:20:50.724Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:20:51.709Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:20:51.709Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:20:58Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ait-170b4fea","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ait-170b4fea","reconcileID":"ef3f8d40-1376-4ca5-81da-353312ece952","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-ait-170b4fea","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:20:58Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-ait-170b4fea","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T21:20:58Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:20:58Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-11-02T21:20:58Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:20:58Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-11-02T21:20:58Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ait-170b4fea","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ait-170b4fea","reconcileID":"ef3f8d40-1376-4ca5-81da-353312ece952","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-ait-170b4fea","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:20:58Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-ait-170b4fea","event":"DELETE"}
{"level":"info","ts":"2026-11-02T21:20:58Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-02T21:20:58Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-ait-170b4fea\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-02T21:20:58Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:21:01Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ait-84de7f3a","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ait-84de7f3a","reconcileID":"46155c27-5707-4293-9407-2ad29ed9cc70","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-ait-84de7f3a","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:21:01Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-ait-84de7f3a","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T21:21:01Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:21:01Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-11-02T21:21:01Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:21:01Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-11-02T21:21:01Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ait-84de7f3a","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ait-84de7f3a","reconcileID":"46155c27-5707-4293-9407-2ad29ed9cc70","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-ait-84de7f3a","namespace":"openshift-ingress"}
{"level":"error","ts":"2026-11-02T21:21:01Z","logger":"telemetry-policy-extension-controller","msg":"Reconciler error","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ait-84de7f3a","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ait-84de7f3a","reconcileID":"667a4f4b-08b8-4c05-94d0-8731b55311b0","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-ait-84de7f3a\" not found","stacktrace":"sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:353\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-02T21:21:01Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-ait-84de7f3a","event":"DELETE"}
{"level":"info","ts":"2026-11-02T21:21:01Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-02T21:21:01Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-ait-84de7f3a\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-02T21:21:01Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:21:04.623Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Kuadrant","ConfigMap","Gateway","TokenRateLimitPolicy","HTTPRoute"],"eventTypes":{"delete":3,"update":3}}
{"level":"info","ts":"2026-11-02T21:21:04.702Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:21:04.722Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:21:04.932Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:21:04.965Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:21:05.023Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:21:05.023Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:21:05.023Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:21:05.166Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:21:05.168Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:21:05.171Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:21:05.171Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:21:05.166Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:21:05.180Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-11-02T21:21:05.226Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to delete envoyfilter object","envoyfilter":"openshift-ingress/kuadrant-auth-e2e-ait-84de7f3a","error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-ait-84de7f3a\" not found"}
{"level":"error","ts":"2026-11-02T21:21:05.226Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to delete envoyfilter object","envoyfilter":"openshift-ingress/kuadrant-ratelimiting-e2e-ait-84de7f3a","error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-ait-84de7f3a\" not found"}
{"level":"info","ts":"2026-11-02T21:21:05.229Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T21:21:05.390Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to delete envoyfilter object","gateway":"openshift-ingress/e2e-ait-84de7f3a","envoyfilter":"openshift-ingress/kuadrant-e2e-ait-84de7f3a","error":"envoyfilters.networking.istio.io \"kuadrant-e2e-ait-84de7f3a\" not found"}
{"level":"info","ts":"2026-11-02T21:21:06.687Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:21:06.687Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T21:21:06.929Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-worker-w3-f51151","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-worker-w3-f51151\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:21:07.108Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-worker-w4-d6cb38","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-worker-w4-d6cb38\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:21:07.164Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-ait-84de7f3a","error":"gateways.gateway.networking.k8s.io \"e2e-ait-84de7f3a\" not found"}
{"level":"info","ts":"2026-11-02T21:21:07.200Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway","Kuadrant","EnvoyFilter","AuthPolicy","TokenRateLimitPolicy","HTTPRoute"],"eventTypes":{"create":2,"delete":14,"update":2}}
{"level":"info","ts":"2026-11-02T21:21:07.278Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:21:07.286Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:21:07.362Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:21:07.571Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:21:07.627Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:21:07.739Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:21:07.739Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:21:07.744Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:21:07.744Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:21:07.746Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:21:07.749Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:21:07.749Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:21:07.756Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-11-02T21:21:07.823Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to delete envoyfilter object","envoyfilter":"openshift-ingress/kuadrant-auth-e2e-ait-84de7f3a","error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-ait-84de7f3a\" not found"}
{"level":"error","ts":"2026-11-02T21:21:07.823Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to delete envoyfilter object","envoyfilter":"openshift-ingress/kuadrant-ratelimiting-e2e-ait-84de7f3a","error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-ait-84de7f3a\" not found"}
{"level":"error","ts":"2026-11-02T21:21:07.823Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:21:07.823Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T21:21:07.823Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/2831c42a19436249a27619217043793522ee826dd49f811e5827ed170f680dd3","error":"authconfigs.authorino.kuadrant.io \"2831c42a19436249a27619217043793522ee826dd49f811e5827ed170f680dd3\" not found"}
{"level":"error","ts":"2026-11-02T21:21:07.882Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/24027c02a4583498aa6f81a43568c41b5e1cd0edb8dceb7fcabee9ab42b15291","error":"authconfigs.authorino.kuadrant.io \"24027c02a4583498aa6f81a43568c41b5e1cd0edb8dceb7fcabee9ab42b15291\" not found"}
{"level":"error","ts":"2026-11-02T21:21:07.937Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/b3a8d89bb951b164cefacf707c294fefc589285cb394c6a950807e74584186f8","error":"authconfigs.authorino.kuadrant.io \"b3a8d89bb951b164cefacf707c294fefc589285cb394c6a950807e74584186f8\" not found"}
{"level":"error","ts":"2026-11-02T21:21:07.997Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/2d8bc18ed9cc4eecc678cbd3e81b4c6500e6413361b69f85beffd83f39de5a74","error":"authconfigs.authorino.kuadrant.io \"2d8bc18ed9cc4eecc678cbd3e81b4c6500e6413361b69f85beffd83f39de5a74\" not found"}
{"level":"error","ts":"2026-11-02T21:21:08.052Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/e5aa47d4ff2df4f8a01352c174792989fe29e178320cd92c92b8bf26f7a50344","error":"authconfigs.authorino.kuadrant.io \"e5aa47d4ff2df4f8a01352c174792989fe29e178320cd92c92b8bf26f7a50344\" not found"}
{"level":"error","ts":"2026-11-02T21:21:08.106Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to delete envoyfilter object","gateway":"openshift-ingress/e2e-ait-84de7f3a","envoyfilter":"openshift-ingress/kuadrant-e2e-ait-84de7f3a","error":"envoyfilters.networking.istio.io \"kuadrant-e2e-ait-84de7f3a\" not found"}
{"level":"error","ts":"2026-11-02T21:21:08.106Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/eb07ca64b26b7d38355ff795867271a17ed10f6c9102c3916d9ca95b620d6b3e","error":"authconfigs.authorino.kuadrant.io \"eb07ca64b26b7d38355ff795867271a17ed10f6c9102c3916d9ca95b620d6b3e\" not found"}
{"level":"error","ts":"2026-11-02T21:21:08.161Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/a90116036f499c46c0370b64becdb1ffb38e95d4022ee7bed85e07e343fcd8da","error":"authconfigs.authorino.kuadrant.io \"a90116036f499c46c0370b64becdb1ffb38e95d4022ee7bed85e07e343fcd8da\" not found"}
{"level":"error","ts":"2026-11-02T21:21:08.216Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/119b797469fb50f10c4aa0ab7b5e0db431adfa81674efb66d2967b76f37a6ecd","error":"authconfigs.authorino.kuadrant.io \"119b797469fb50f10c4aa0ab7b5e0db431adfa81674efb66d2967b76f37a6ecd\" not found"}
{"level":"error","ts":"2026-11-02T21:21:08.271Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/7a352330852f11e1366d8253747086f455301e9d2eb3a3bab5f6dc913cbc36dd","error":"authconfigs.authorino.kuadrant.io \"7a352330852f11e1366d8253747086f455301e9d2eb3a3bab5f6dc913cbc36dd\" not found"}
{"level":"error","ts":"2026-11-02T21:21:08.326Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/7b68d94071435f75656ff8074db2774ad9ed15dddaf6862b3900065ddc6a11b2","error":"authconfigs.authorino.kuadrant.io \"7b68d94071435f75656ff8074db2774ad9ed15dddaf6862b3900065ddc6a11b2\" not found"}
{"level":"error","ts":"2026-11-02T21:21:08.384Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/a022ce809b77c09b07324ce87ff1055fc5d959fa22b0a23a6932b1cc923bbee1","error":"authconfigs.authorino.kuadrant.io \"a022ce809b77c09b07324ce87ff1055fc5d959fa22b0a23a6932b1cc923bbee1\" not found"}
{"level":"error","ts":"2026-11-02T21:21:08.441Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/45aaa0f77536368a87ccc0e532ee12ea1375a3ac80250a09d473ce16a09b49c6","error":"authconfigs.authorino.kuadrant.io \"45aaa0f77536368a87ccc0e532ee12ea1375a3ac80250a09d473ce16a09b49c6\" not found"}
{"level":"error","ts":"2026-11-02T21:21:08.496Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/5113497a6647a1a7e4129b986081e065d299f9e913b8ee4228d58792fae1868a","error":"authconfigs.authorino.kuadrant.io \"5113497a6647a1a7e4129b986081e065d299f9e913b8ee4228d58792fae1868a\" not found"}
{"level":"error","ts":"2026-11-02T21:21:08.554Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/7e78eecab02e1fd809cd8937f47dd685bd8416e8bea268e4aafb7c23f9e267bf","error":"authconfigs.authorino.kuadrant.io \"7e78eecab02e1fd809cd8937f47dd685bd8416e8bea268e4aafb7c23f9e267bf\" not found"}
{"level":"error","ts":"2026-11-02T21:21:08.611Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/b2774e83fd7be8cadbe91ef268ad972ab5a0d2fd97c27176866f86e842de8e08","error":"authconfigs.authorino.kuadrant.io \"b2774e83fd7be8cadbe91ef268ad972ab5a0d2fd97c27176866f86e842de8e08\" not found"}
{"level":"error","ts":"2026-11-02T21:21:08.666Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/f79a67059485d7c175d20633d82aabe70b4d1d84be145221b0214efd85a59820","error":"authconfigs.authorino.kuadrant.io \"f79a67059485d7c175d20633d82aabe70b4d1d84be145221b0214efd85a59820\" not found"}
{"level":"error","ts":"2026-11-02T21:21:08.721Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/6bf80d5681d0b7284fc57805d1a8d49f34a5a111b4ae9f47de5635430b72573f","error":"authconfigs.authorino.kuadrant.io \"6bf80d5681d0b7284fc57805d1a8d49f34a5a111b4ae9f47de5635430b72573f\" not found"}
{"level":"error","ts":"2026-11-02T21:21:08.776Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/1fbe2fb204eec57d92b46c554aac8ef9399bcbee6fc1a0898c1330fb6e490446","error":"authconfigs.authorino.kuadrant.io \"1fbe2fb204eec57d92b46c554aac8ef9399bcbee6fc1a0898c1330fb6e490446\" not found"}
{"level":"error","ts":"2026-11-02T21:21:08.834Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-facebook-opt-125m-simulated","namespace":"llm","uid":"da8edb1a-ed61-454d-939f-fc7cd235d9fb","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-facebook-opt-125m-simulated\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:21:08.892Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-derive-54a47302","namespace":"openshift-ingress","uid":"27cd3d13-8bd0-439c-bc88-914441e0ef15","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-derive-54a47302\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:21:08.950Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-ait-6f4fe932","namespace":"openshift-ingress","uid":"aa57e6fd-ca40-4d6e-b2d4-5fea445d3c19","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-ait-6f4fe932\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:21:09.007Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-simulated-simulated-premium","namespace":"llm","uid":"447993be-3c57-4e68-8ffa-6fc998a39c77","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-simulated-simulated-premium\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:21:09.071Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:21:09.071Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T21:21:09.312Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-worker-w3-f51151","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-worker-w3-f51151\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:21:09.430Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-worker-w4-d6cb38","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-worker-w4-d6cb38\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:21:09.547Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-ait-84de7f3a","error":"gateways.gateway.networking.k8s.io \"e2e-ait-84de7f3a\" not found"}
{"level":"info","ts":"2026-11-02T21:21:13.416Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway","TokenRateLimitPolicy","ConfigMap","Limitador","EnvoyFilter","AuthConfig"],"eventTypes":{"create":1,"delete":22,"update":8}}
{"level":"info","ts":"2026-11-02T21:21:13.535Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:21:13.662Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:21:13Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-derive-54a47302","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-derive-54a47302","reconcileID":"8382480f-f551-4920-8852-eecaa137c4bf","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-derive-54a47302","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:21:13Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-derive-54a47302","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T21:21:13Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:21:13Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-11-02T21:21:13Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:21:13.850Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:21:13.850Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:21:13.944Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:21:13.965Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:21:13.966Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:21:13.966Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:21:13.967Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-02T21:21:13.967Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:21:13.974Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:21:14Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-11-02T21:21:14Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-derive-54a47302","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-derive-54a47302","reconcileID":"8382480f-f551-4920-8852-eecaa137c4bf","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-derive-54a47302","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:21:14Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-derive-54a47302","event":"DELETE"}
{"level":"info","ts":"2026-11-02T21:21:14Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-02T21:21:14Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-derive-54a47302\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-02T21:21:14Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"error","ts":"2026-11-02T21:21:14.619Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-derive-54a47302","namespace":"openshift-ingress","uid":"27cd3d13-8bd0-439c-bc88-914441e0ef15","error":"tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-derive-54a47302\" not found"}
{"level":"info","ts":"2026-11-02T21:21:14.681Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:21:14.681Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T21:21:14.740Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-derive-54a47302","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-derive-54a47302\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:21:14.984Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-ait-6f4fe932","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-ait-6f4fe932\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:21:15Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ait-6f4fe932","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ait-6f4fe932","reconcileID":"1b5659bd-8f35-4a87-a57d-353379746893","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-ait-6f4fe932","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:21:15Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-ait-6f4fe932","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T21:21:15Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:21:15Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-11-02T21:21:15Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:21:15Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-11-02T21:21:15Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ait-6f4fe932","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ait-6f4fe932","reconcileID":"1b5659bd-8f35-4a87-a57d-353379746893","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-ait-6f4fe932","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:21:15Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-ait-6f4fe932","event":"DELETE"}
{"level":"info","ts":"2026-11-02T21:21:15Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-02T21:21:15Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-ait-6f4fe932\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-02T21:21:15Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:21:20.946Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Kuadrant","TokenRateLimitPolicy","Gateway","ConfigMap","EnvoyFilter","HTTPRoute"],"eventTypes":{"delete":4,"update":7}}
{"level":"info","ts":"2026-11-02T21:21:21.011Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:21:21.048Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:21:21.130Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:21:21.134Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:21:21Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-worker-w3-f51151","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-worker-w3-f51151","reconcileID":"c0788070-fa6f-49af-b218-c574288abb79","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-worker-w3-f51151","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:21:21Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-worker-w3-f51151","event":"CREATE"}
{"level":"info","ts":"2026-11-02T21:21:21Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:21:21.256Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:21:21.323Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:21:21.323Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:21:21.346Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:21:21.348Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:21:21.348Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:21:21.349Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:21:21.350Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:21:21.353Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:21:21.437Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T21:21:21.598Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to delete envoyfilter object","gateway":"openshift-ingress/e2e-derive-54a47302","envoyfilter":"openshift-ingress/kuadrant-e2e-derive-54a47302","error":"envoyfilters.networking.istio.io \"kuadrant-e2e-derive-54a47302\" not found"}
{"level":"info","ts":"2026-11-02T21:21:21Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-02T21:21:21Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-02T21:21:21Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:21:21Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-worker-w3-f51151","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-worker-w3-f51151","reconcileID":"c8945cae-fb23-4c67-95bd-e3ba82c8c31c","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-worker-w3-f51151","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:21:21Z","logger":"telemetry-policy-extension-controller","msg":"Warning: Reconciler returned both a non-zero result and a non-nil error. The result will always be ignored if the error is non-nil and the non-nil error causes requeuing with exponential backoff. For more details, see: https://pkg.go.dev/sigs.k8s.io/controller-runtime/pkg/reconcile#Reconciler","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-worker-w3-f51151","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-worker-w3-f51151","reconcileID":"c8945cae-fb23-4c67-95bd-e3ba82c8c31c"}
{"level":"error","ts":"2026-11-02T21:21:21Z","logger":"telemetry-policy-extension-controller","msg":"Reconciler error","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-worker-w3-f51151","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-worker-w3-f51151","reconcileID":"c8945cae-fb23-4c67-95bd-e3ba82c8c31c","error":"Operation cannot be fulfilled on telemetrypolicies.extensions.kuadrant.io \"maas-telemetry-e2e-worker-w3-f51151\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:353\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-02T21:21:21Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-worker-w3-f51151","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-worker-w3-f51151","reconcileID":"ffc9f8bb-bd04-4b31-8608-585389bf9c6f","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-worker-w3-f51151","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:21:21Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-worker-w3-f51151","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T21:21:21Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-02T21:21:22.170Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-derive-54a47302-maas-auth","namespace":"openshift-ingress","error":"authpolicies.kuadrant.io \"e2e-derive-54a47302-maas-auth\" not found"}
{"level":"info","ts":"2026-11-02T21:21:22.309Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:21:22.309Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:21:22Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-02T21:21:22Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-02T21:21:22Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-02T21:21:22Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:21:22Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-worker-w3-f51151","event":"UNKNOWN"}
{"level":"info","ts":"2026-11-02T21:21:22Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-02T21:21:22.551Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-worker-w2-6fa533","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-worker-w2-6fa533\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:21:22.814Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-derive-54a47302","error":"gateways.gateway.networking.k8s.io \"e2e-derive-54a47302\" not found"}
{"level":"info","ts":"2026-11-02T21:21:22.858Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway","HTTPRoute","AuthPolicy","EnvoyFilter"],"eventTypes":{"create":2,"delete":5,"update":1}}
{"level":"info","ts":"2026-11-02T21:21:22Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-02T21:21:22Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-02T21:21:22Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-02T21:21:22Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:21:23.242Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:21:23.244Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:21:23.244Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:21:23.253Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:21:23.253Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:21:23.254Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"error","ts":"2026-11-02T21:21:23.297Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to delete envoyfilter object","envoyfilter":"openshift-ingress/kuadrant-ratelimiting-e2e-derive-54a47302","error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-derive-54a47302\" not found"}
{"level":"error","ts":"2026-11-02T21:21:23.323Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/710b36a968ca4e0de9de51d4a0c943d4b07eaacabd93e813cfad653aecf12c53","error":"authconfigs.authorino.kuadrant.io \"710b36a968ca4e0de9de51d4a0c943d4b07eaacabd93e813cfad653aecf12c53\" not found"}
{"level":"error","ts":"2026-11-02T21:21:23.323Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to delete envoyfilter object","envoyfilter":"openshift-ingress/kuadrant-auth-e2e-derive-54a47302","error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-derive-54a47302\" not found"}
{"level":"error","ts":"2026-11-02T21:21:23.323Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:21:23.323Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T21:21:23.378Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/2e1e8e82bd77893addc580eca5bede5ad2845616ea51050bb8cab0038aa88879","error":"authconfigs.authorino.kuadrant.io \"2e1e8e82bd77893addc580eca5bede5ad2845616ea51050bb8cab0038aa88879\" not found"}
{"level":"error","ts":"2026-11-02T21:21:23.432Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/7927df375c4cc4ee643e85d846316d18c522151244dbca70d8e91d2861f5aac9","error":"authconfigs.authorino.kuadrant.io \"7927df375c4cc4ee643e85d846316d18c522151244dbca70d8e91d2861f5aac9\" not found"}
{"level":"error","ts":"2026-11-02T21:21:23.453Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to delete envoyfilter object","gateway":"openshift-ingress/e2e-derive-54a47302","envoyfilter":"openshift-ingress/kuadrant-e2e-derive-54a47302","error":"envoyfilters.networking.istio.io \"kuadrant-e2e-derive-54a47302\" not found"}
{"level":"error","ts":"2026-11-02T21:21:23.487Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/7ebf3775887ba71f04af1eff4363f21a6d47108958016775943bab60970463bf","error":"authconfigs.authorino.kuadrant.io \"7ebf3775887ba71f04af1eff4363f21a6d47108958016775943bab60970463bf\" not found"}
{"level":"error","ts":"2026-11-02T21:21:23.542Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/b039dc6d5f9e02048b64874aaa2070beb7a4c9a6d546e2d2c4332fc98295f610","error":"authconfigs.authorino.kuadrant.io \"b039dc6d5f9e02048b64874aaa2070beb7a4c9a6d546e2d2c4332fc98295f610\" not found"}
{"level":"error","ts":"2026-11-02T21:21:23.598Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/54266a15ec606a9157e6d6df649968c34e630cc06000941b7fc8c260867be31c","error":"authconfigs.authorino.kuadrant.io \"54266a15ec606a9157e6d6df649968c34e630cc06000941b7fc8c260867be31c\" not found"}
{"level":"error","ts":"2026-11-02T21:21:23.653Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/c8633a105d6beb6c83e30959280d199f52f3f1eeffe5f74355541c445f1dd0f3","error":"authconfigs.authorino.kuadrant.io \"c8633a105d6beb6c83e30959280d199f52f3f1eeffe5f74355541c445f1dd0f3\" not found"}
{"level":"error","ts":"2026-11-02T21:21:23.709Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/fa374730a4d9381b0fdf900fdd8bd1a21daf06697162a6cf1fde1c8755d2c7a0","error":"authconfigs.authorino.kuadrant.io \"fa374730a4d9381b0fdf900fdd8bd1a21daf06697162a6cf1fde1c8755d2c7a0\" not found"}
{"level":"error","ts":"2026-11-02T21:21:23.763Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/c7a6f10472fd7cea220aac88bd15da0f05464c16eece5554547b8d0ef3cdef62","error":"authconfigs.authorino.kuadrant.io \"c7a6f10472fd7cea220aac88bd15da0f05464c16eece5554547b8d0ef3cdef62\" not found"}
{"level":"error","ts":"2026-11-02T21:21:23.817Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/297756b7362e52b440e283847b119e6aece21be1ef66d278febc9cfae126aac5","error":"authconfigs.authorino.kuadrant.io \"297756b7362e52b440e283847b119e6aece21be1ef66d278febc9cfae126aac5\" not found"}
{"level":"error","ts":"2026-11-02T21:21:23.872Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/464cb0a79a5094693c54e3b155539f3de31e023694979770ffcb0257eabaad41","error":"authconfigs.authorino.kuadrant.io \"464cb0a79a5094693c54e3b155539f3de31e023694979770ffcb0257eabaad41\" not found"}
{"level":"error","ts":"2026-11-02T21:21:23.927Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/dbc3bfcf06048fe44d2ee7e2a598064439d046ffa810642384495af9a05eec75","error":"authconfigs.authorino.kuadrant.io \"dbc3bfcf06048fe44d2ee7e2a598064439d046ffa810642384495af9a05eec75\" not found"}
{"level":"error","ts":"2026-11-02T21:21:23.984Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-facebook-opt-125m-simulated","namespace":"llm","uid":"da8edb1a-ed61-454d-939f-fc7cd235d9fb","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-facebook-opt-125m-simulated\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:21:24.047Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-derive-54a47302-maas-auth","namespace":"openshift-ingress","error":"authpolicies.kuadrant.io \"e2e-derive-54a47302-maas-auth\" not found"}
{"level":"error","ts":"2026-11-02T21:21:24.098Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-simulated-simulated-premium","namespace":"llm","uid":"447993be-3c57-4e68-8ffa-6fc998a39c77","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-simulated-simulated-premium\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:21:24.121Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:21:24.121Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T21:21:24.177Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-derive-54a47302","error":"gateways.gateway.networking.k8s.io \"e2e-derive-54a47302\" not found"}
{"level":"error","ts":"2026-11-02T21:21:24.423Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-worker-w2-6fa533","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-worker-w2-6fa533\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:21:26Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-worker-w4-d6cb38","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-worker-w4-d6cb38","reconcileID":"b7f4894c-f4db-499b-bd11-f57361621cff","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-worker-w4-d6cb38","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:21:26Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-worker-w4-d6cb38","event":"CREATE"}
{"level":"info","ts":"2026-11-02T21:21:26Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:21:27Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-02T21:21:27Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-02T21:21:27Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:21:27Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-worker-w4-d6cb38","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-worker-w4-d6cb38","reconcileID":"6c0976c6-7d9c-494b-b704-d9c934793e61","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-worker-w4-d6cb38","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:21:27Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-worker-w4-d6cb38","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T21:21:27Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:21:27Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-02T21:21:27Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-02T21:21:27Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-02T21:21:27Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:21:27Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-worker-w4-d6cb38","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-worker-w4-d6cb38","reconcileID":"76c026d5-99ac-4c4d-a345-fe89a7285ab8","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-worker-w4-d6cb38","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:21:27Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-worker-w4-d6cb38","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T21:21:27Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:21:28Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-02T21:21:28Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-02T21:21:28Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-02T21:21:28Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:21:30.197Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway","HTTPRoute","Kuadrant","AuthPolicy","TokenRateLimitPolicy","ConfigMap","Limitador","AuthConfig","EnvoyFilter"],"eventTypes":{"create":4,"delete":17,"update":7}}
{"level":"info","ts":"2026-11-02T21:21:30.311Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:21:30.323Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:21:30.355Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:21:30.360Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:21:30.526Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:21:30.526Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:21:30.526Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:21:30.643Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:21:30.643Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:21:30.647Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:21:30.648Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:21:30.648Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:21:30.652Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"error","ts":"2026-11-02T21:21:30.725Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:21:30.725Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:21:31.794Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:21:31.794Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T21:21:32.168Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-worker-w0-0c9014","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-worker-w0-0c9014\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:21:32Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-worker-w0-0c9014","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-worker-w0-0c9014","reconcileID":"37eddd61-4742-43b3-8724-7f5948211c1d","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-worker-w0-0c9014","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:21:32Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-worker-w0-0c9014","event":"CREATE"}
{"level":"info","ts":"2026-11-02T21:21:32Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:21:32.320Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthPolicy","Kuadrant","TokenRateLimitPolicy"],"eventTypes":{"create":2,"update":1}}
{"level":"info","ts":"2026-11-02T21:21:32.397Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:21:32.404Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:21:32.463Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:21:32.544Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:21:32.545Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:21:32.654Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:21:32.654Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:21:32.824Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:21:32.827Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:21:32.831Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:21:32.839Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:21:32.839Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:21:32.843Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-11-02T21:21:32.894Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:21:32.894Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T21:21:32.895Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38#rule-2"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"3aa68add648f18fb79f3def0d73f0c2f29d8ab60b1352cf4548a1a038cf3d923","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["3aa68add648f18fb79f3def0d73f0c2f29d8ab60b1352cf4548a1a038cf3d923"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-d6cb38.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-d6cb38.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"3aa68add648f18fb79f3def0d73f0c2f29d8ab60b1352cf4548a1a038cf3d923\" already exists"}
{"level":"error","ts":"2026-11-02T21:21:32.923Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-worker-w3-f51151","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"kuadrant-auth-e2e-worker-w3-f51151","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-worker-w3-f51151","uid":"8871137c-7f6a-401d-a6db-2983aea5ba22"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-auth-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local","port_value":50051}}}}]}]},"name":"kuadrant-auth-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-worker-w3-f51151"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-worker-w3-f51151\" already exists"}
{"level":"error","ts":"2026-11-02T21:21:32.924Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-worker-w4-d6cb38","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/ratelimit":"true"},"name":"kuadrant-ratelimiting-e2e-worker-w4-d6cb38","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-worker-w4-d6cb38","uid":"36c0d6c0-4ad3-4739-8e18-24485ab1bc48"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"limitador-limitador.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-ratelimit-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"limitador-limitador.kuadrant-system.svc.cluster.local","port_value":8081}}}}]}]},"name":"kuadrant-ratelimit-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-worker-w4-d6cb38"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-worker-w4-d6cb38\" already exists"}
{"level":"error","ts":"2026-11-02T21:21:32.962Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38#rule-1"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"12dec0ddb151cc18ef75cfe2b4260788095e28a391f359fc3f7da7c75381b728","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["12dec0ddb151cc18ef75cfe2b4260788095e28a391f359fc3f7da7c75381b728"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-d6cb38.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-d6cb38.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"12dec0ddb151cc18ef75cfe2b4260788095e28a391f359fc3f7da7c75381b728\" already exists"}
{"level":"error","ts":"2026-11-02T21:21:32.983Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-worker-w3-f51151","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/ratelimit":"true"},"name":"kuadrant-ratelimiting-e2e-worker-w3-f51151","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-worker-w3-f51151","uid":"8871137c-7f6a-401d-a6db-2983aea5ba22"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"limitador-limitador.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-ratelimit-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"limitador-limitador.kuadrant-system.svc.cluster.local","port_value":8081}}}}]}]},"name":"kuadrant-ratelimit-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-worker-w3-f51151"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-worker-w3-f51151\" already exists"}
{"level":"error","ts":"2026-11-02T21:21:32.984Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-worker-w4-d6cb38","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"kuadrant-auth-e2e-worker-w4-d6cb38","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-worker-w4-d6cb38","uid":"36c0d6c0-4ad3-4739-8e18-24485ab1bc48"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-auth-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local","port_value":50051}}}}]}]},"name":"kuadrant-auth-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-worker-w4-d6cb38"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-worker-w4-d6cb38\" already exists"}
{"level":"error","ts":"2026-11-02T21:21:33.022Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-worker-w3-f51151","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"name":"kuadrant-e2e-worker-w3-f51151","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-worker-w3-f51151","uid":"8871137c-7f6a-401d-a6db-2983aea5ba22"}]},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b31ddb7ef02e35e9d172430b50a004a3047564232880010bd3e581bf0dc547f8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"a1ec0f0592798b3996117a17734b0936906621077ceec69c81d8fb77e89a142a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e11ba50523ae86c5c06c5b76176154ed9ba57c3ed13fa43133b1ac7249ce345f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"67192e2ead59827b5990f7b4cbc2aece4271402ddcdfaa76f7cf95d2d4552c43\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b6344fa6f672d55d2eb4fbf6449de24a41dbf664f8e9d3c01ecde50e9d46e233\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"3c429336b45d9712bfdb0d99ecd41baa0dde1570067b941b5927e1894931c254\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d1f3365185f5fcfe92899c5f49af1b579baab97128b8afee3eed4350859c3f14\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"2f17c508c987cffd0b45ebd164fcee3ad66819a39900f83fbeda518ccf619183\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"85124e62247f9234752fedfc382ba93d6f839dab53f49c16951446afa3e613aa\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"6d2c4320e5eae8e51596e1c62f1c7494e1c5f9cd5d374e73b3ddae65dd071a92\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"461f0fb3ed9e91195eaa488b65b6f04cb4bff62087edbcf0d4c2186d180ba0ab\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"994b30d96390325263d89c2da7554eadd9d4fd1811371afabaf057df68e19205\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-worker-w3-f51151"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-e2e-worker-w3-f51151\" already exists"}
{"level":"error","ts":"2026-11-02T21:21:33.032Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38#rule-4"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"db8ed9490207e877020d08d86f8a9769046fd69225998abd4e476e93ef7b9431","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["db8ed9490207e877020d08d86f8a9769046fd69225998abd4e476e93ef7b9431"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-d6cb38.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-d6cb38.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"db8ed9490207e877020d08d86f8a9769046fd69225998abd4e476e93ef7b9431\" already exists"}
{"level":"info","ts":"2026-11-02T21:21:33Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-02T21:21:33Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-02T21:21:33Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:21:33Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-worker-w0-0c9014","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-worker-w0-0c9014","reconcileID":"8eefdd4e-906d-46bf-9186-e105fe394a06","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-worker-w0-0c9014","namespace":"openshift-ingress"}
{"level":"error","ts":"2026-11-02T21:21:33.100Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151#rule-6"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"b31ddb7ef02e35e9d172430b50a004a3047564232880010bd3e581bf0dc547f8","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["b31ddb7ef02e35e9d172430b50a004a3047564232880010bd3e581bf0dc547f8"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-f51151.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-f51151.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"b31ddb7ef02e35e9d172430b50a004a3047564232880010bd3e581bf0dc547f8\" already exists"}
{"level":"info","ts":"2026-11-02T21:21:33Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-worker-w0-0c9014","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T21:21:33Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-02T21:21:33.168Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151#rule-1"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"461f0fb3ed9e91195eaa488b65b6f04cb4bff62087edbcf0d4c2186d180ba0ab","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["461f0fb3ed9e91195eaa488b65b6f04cb4bff62087edbcf0d4c2186d180ba0ab"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-f51151.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-f51151.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"461f0fb3ed9e91195eaa488b65b6f04cb4bff62087edbcf0d4c2186d180ba0ab\" already exists"}
{"level":"error","ts":"2026-11-02T21:21:33.215Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-worker-w4-d6cb38","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"name":"kuadrant-e2e-worker-w4-d6cb38","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-worker-w4-d6cb38","uid":"36c0d6c0-4ad3-4739-8e18-24485ab1bc48"}]},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a69bb45bad035c53dd8c7176828b1cc26d0c9d3f775d2059034b1639ca1b49d8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"79db77eb448edf55b65761a293f7f6fc07c9d4365912f7a8595364cdbf33d994\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3aa68add648f18fb79f3def0d73f0c2f29d8ab60b1352cf4548a1a038cf3d923\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"fad9cba453f811618739c6f08a8544a889f48ec7511f7d3ccac0f71ba988967b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"099191e40682a5a6b1df435c6dc10936b8b4e31a891f3520e8e9f8418b1acc3e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"adbf9660bf8db4b1489d019993fddbd2863d0cf7c72174df8663c00e565a1e21\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"13694f4cecc05b3e953bb7d1aa68f96fad9b8548456e1357cc504ba9936493bf\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"fd3f6d135cf69e39efa3702af6a7e665f47a40ddb90f71d1f37cad11438027bc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"db8ed9490207e877020d08d86f8a9769046fd69225998abd4e476e93ef7b9431\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"e3ae0784ebe4c51499f320023e5e93f640f2a33ae4fea237cb7e068df1c76739\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"12dec0ddb151cc18ef75cfe2b4260788095e28a391f359fc3f7da7c75381b728\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"8f6398fb66bae44affa747ad532a12445774a5b43ca2c7196a633d5d03da8c80\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-worker-w4-d6cb38"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-e2e-worker-w4-d6cb38\" already exists"}
{"level":"error","ts":"2026-11-02T21:21:33.239Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38#rule-5"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"099191e40682a5a6b1df435c6dc10936b8b4e31a891f3520e8e9f8418b1acc3e","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["099191e40682a5a6b1df435c6dc10936b8b4e31a891f3520e8e9f8418b1acc3e"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-d6cb38.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-d6cb38.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"099191e40682a5a6b1df435c6dc10936b8b4e31a891f3520e8e9f8418b1acc3e\" already exists"}
{"level":"error","ts":"2026-11-02T21:21:33.310Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151#rule-5"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"b6344fa6f672d55d2eb4fbf6449de24a41dbf664f8e9d3c01ecde50e9d46e233","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["b6344fa6f672d55d2eb4fbf6449de24a41dbf664f8e9d3c01ecde50e9d46e233"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-f51151.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-f51151.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"b6344fa6f672d55d2eb4fbf6449de24a41dbf664f8e9d3c01ecde50e9d46e233\" already exists"}
{"level":"error","ts":"2026-11-02T21:21:33.377Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38#rule-6"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"a69bb45bad035c53dd8c7176828b1cc26d0c9d3f775d2059034b1639ca1b49d8","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a69bb45bad035c53dd8c7176828b1cc26d0c9d3f775d2059034b1639ca1b49d8"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-d6cb38.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-d6cb38.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"a69bb45bad035c53dd8c7176828b1cc26d0c9d3f775d2059034b1639ca1b49d8\" already exists"}
{"level":"error","ts":"2026-11-02T21:21:33.448Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151#rule-3"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"d1f3365185f5fcfe92899c5f49af1b579baab97128b8afee3eed4350859c3f14","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d1f3365185f5fcfe92899c5f49af1b579baab97128b8afee3eed4350859c3f14"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-f51151.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-f51151.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"d1f3365185f5fcfe92899c5f49af1b579baab97128b8afee3eed4350859c3f14\" already exists"}
{"level":"error","ts":"2026-11-02T21:21:33.514Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151#rule-2"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"e11ba50523ae86c5c06c5b76176154ed9ba57c3ed13fa43133b1ac7249ce345f","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["e11ba50523ae86c5c06c5b76176154ed9ba57c3ed13fa43133b1ac7249ce345f"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-f51151.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-f51151.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"e11ba50523ae86c5c06c5b76176154ed9ba57c3ed13fa43133b1ac7249ce345f\" already exists"}
{"level":"error","ts":"2026-11-02T21:21:33.584Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38#rule-3"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"13694f4cecc05b3e953bb7d1aa68f96fad9b8548456e1357cc504ba9936493bf","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["13694f4cecc05b3e953bb7d1aa68f96fad9b8548456e1357cc504ba9936493bf"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-d6cb38.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-d6cb38.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"13694f4cecc05b3e953bb7d1aa68f96fad9b8548456e1357cc504ba9936493bf\" already exists"}
{"level":"info","ts":"2026-11-02T21:21:33Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-02T21:21:33Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-02T21:21:33Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-02T21:21:33Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"error","ts":"2026-11-02T21:21:33.652Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151#rule-4"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"85124e62247f9234752fedfc382ba93d6f839dab53f49c16951446afa3e613aa","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["85124e62247f9234752fedfc382ba93d6f839dab53f49c16951446afa3e613aa"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-f51151.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-f51151.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"85124e62247f9234752fedfc382ba93d6f839dab53f49c16951446afa3e613aa\" already exists"}
{"level":"error","ts":"2026-11-02T21:21:33.768Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-worker-w4-d6cb38","namespace":"openshift-ingress","uid":"6f6a09c9-d5cc-4e47-8444-7b69085b24cf","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-worker-w4-d6cb38\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:21:33.777Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-worker-w4-d6cb38-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-worker-w4-d6cb38-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:21:33.830Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-worker-w3-f51151","namespace":"openshift-ingress","uid":"d4b308ee-a3e0-46c6-b426-b113a09b0694","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-worker-w3-f51151\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:21:33.843Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-worker-w3-f51151-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-worker-w3-f51151-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:21:33.948Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:21:33.948Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T21:21:34.008Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-worker-w3-f51151","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-worker-w3-f51151\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:21:34.021Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"maas-api-route-e2e-worker-w3-f51151","namespace":"odh-ai-gateway-infra","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"maas-api-route-e2e-worker-w3-f51151\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:21:34.089Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"maas-api-route-e2e-worker-w4-d6cb38","namespace":"odh-ai-gateway-infra","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"maas-api-route-e2e-worker-w4-d6cb38\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:21:34.258Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-worker-w4-d6cb38","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-worker-w4-d6cb38\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:21:34.378Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-worker-w0-0c9014","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-worker-w0-0c9014\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:21:38.404Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthPolicy","AuthConfig","EnvoyFilter","Gateway","HTTPRoute","TokenRateLimitPolicy","Limitador","Kuadrant","ConfigMap"],"eventTypes":{"create":21,"update":12}}
{"level":"info","ts":"2026-11-02T21:21:38.483Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:21:38.510Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:21:38.642Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:21:38.656Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:21:38.737Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:21:38.740Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:21:38.740Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:21:38.881Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:21:38.881Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:21:38.883Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:21:38.926Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:21:38.926Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:21:38.932Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:21:38.986Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:21:39.708Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:21:39.708Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:21:44.169Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthPolicy","AuthConfig","HTTPRoute","EnvoyFilter","ConfigMap","TokenRateLimitPolicy","Gateway","Limitador"],"eventTypes":{"create":9,"update":10}}
{"level":"info","ts":"2026-11-02T21:21:44.292Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:21:44.358Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:21:44.444Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:21:44.444Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:21:44.674Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:21:44.678Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:21:44.732Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:21:44.734Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-02T21:21:44.734Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:21:44.744Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:21:44.744Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:21:45.501Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:21:45.501Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:21:48.039Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","AuthPolicy","ConfigMap","Limitador"],"eventTypes":{"update":8}}
{"level":"info","ts":"2026-11-02T21:21:48.158Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:21:48.239Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:21:48.354Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:21:48.354Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:21:48.549Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:21:48.551Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:21:48.551Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:21:48.561Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:21:48.562Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-02T21:21:48.562Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:21:48.563Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:21:49.297Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:21:49.297Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:21:54Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-worker-w2-6fa533","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-worker-w2-6fa533","reconcileID":"3df139e1-9226-4b99-8073-8ddb6905860e","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-worker-w2-6fa533","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:21:54Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-worker-w2-6fa533","event":"CREATE"}
{"level":"info","ts":"2026-11-02T21:21:54Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:21:54Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-02T21:21:54Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-02T21:21:54Z","logger":"telemetry-policy-extension-controller","msg":"Failed to update status: resource might just be outdated"}
{"level":"info","ts":"2026-11-02T21:21:54Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:21:54Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-worker-w2-6fa533","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-worker-w2-6fa533","reconcileID":"2adc2b4a-40e4-43ef-8695-17de22db0ea8","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-worker-w2-6fa533","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:21:54Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-worker-w2-6fa533","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T21:21:54Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:21:55Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-02T21:21:55Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-02T21:21:55Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:21:55Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-worker-w2-6fa533","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-worker-w2-6fa533","reconcileID":"28eb7e0d-9eb4-49b9-a09a-f5cba3212a51","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-worker-w2-6fa533","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:21:55Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-worker-w2-6fa533","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T21:21:55Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:21:55Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-02T21:21:55Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-02T21:21:55Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-02T21:21:55Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:21:57.425Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway","HTTPRoute","ConfigMap"],"eventTypes":{"create":2,"update":3}}
{"level":"info","ts":"2026-11-02T21:21:57.937Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:21:57.937Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:21:57.939Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:21:57.941Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:21:57.941Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:21:57.943Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:21:58.027Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:21:59Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-worker-w1-5f765a","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-worker-w1-5f765a","reconcileID":"c948b7a7-da96-40d8-bd16-691e4662cc8a","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-worker-w1-5f765a","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:21:59Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-worker-w1-5f765a","event":"CREATE"}
{"level":"info","ts":"2026-11-02T21:21:59Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:21:59.648Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:21:59.648Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T21:21:59.766Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-worker-w1-5f765a","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-worker-w1-5f765a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:21:59Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-02T21:21:59Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-02T21:21:59Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:21:59Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-worker-w1-5f765a","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-worker-w1-5f765a","reconcileID":"db521d27-8465-4c56-b6fe-cdb025ac6a39","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-worker-w1-5f765a","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:21:59Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-worker-w1-5f765a","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T21:21:59Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:22:00.173Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthPolicy","TokenRateLimitPolicy","Kuadrant"],"eventTypes":{"create":2,"update":1}}
{"level":"info","ts":"2026-11-02T21:22:00.327Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:22:00.343Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:22:00.536Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:22:00.547Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:22:00.634Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:22:00.634Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:22:00.634Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:22:00Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-02T21:22:00Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-02T21:22:00Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-02T21:22:00Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:22:00Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-worker-w1-5f765a","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-worker-w1-5f765a","reconcileID":"f620dd26-e5e8-449f-a648-61ac782e20ef","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-worker-w1-5f765a","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:22:00.835Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:22:00.835Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:22:00.837Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:22:00.838Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:22:00.839Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:22:00.839Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:22:00Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-worker-w1-5f765a","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T21:22:00Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-02T21:22:00.899Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:22:00.899Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T21:22:00.900Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-worker-w2-6fa533","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"kuadrant-auth-e2e-worker-w2-6fa533","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-worker-w2-6fa533","uid":"350cbfc3-ae8f-47d8-bf88-3bc797a06de4"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-auth-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local","port_value":50051}}}}]}]},"name":"kuadrant-auth-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-worker-w2-6fa533"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-worker-w2-6fa533\" already exists"}
{"level":"error","ts":"2026-11-02T21:22:00.901Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-worker-w2-6fa533","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/ratelimit":"true"},"name":"kuadrant-ratelimiting-e2e-worker-w2-6fa533","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-worker-w2-6fa533","uid":"350cbfc3-ae8f-47d8-bf88-3bc797a06de4"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"limitador-limitador.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-ratelimit-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"limitador-limitador.kuadrant-system.svc.cluster.local","port_value":8081}}}}]}]},"name":"kuadrant-ratelimit-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-worker-w2-6fa533"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-worker-w2-6fa533\" already exists"}
{"level":"error","ts":"2026-11-02T21:22:00.933Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route#v1-responses-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"cb9167704c77a112808785ad099bc015c57786c61e7befec251b029ce378a0c6","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["cb9167704c77a112808785ad099bc015c57786c61e7befec251b029ce378a0c6"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-f51151.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-f51151.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"cb9167704c77a112808785ad099bc015c57786c61e7befec251b029ce378a0c6\" already exists"}
{"level":"error","ts":"2026-11-02T21:22:01.023Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route#v1-catch-all-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"d896bcdf40d08e0bef242ce04aa58467e96c672450af890adda6941c53a574d3","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d896bcdf40d08e0bef242ce04aa58467e96c672450af890adda6941c53a574d3"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-f51151.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-f51151.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"d896bcdf40d08e0bef242ce04aa58467e96c672450af890adda6941c53a574d3\" already exists"}
{"level":"error","ts":"2026-11-02T21:22:01.090Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"f1def6d908410a124665ecd632ae01e5ba977920643dab1a35d25277292bae55","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f1def6d908410a124665ecd632ae01e5ba977920643dab1a35d25277292bae55"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-f51151.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-f51151.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"f1def6d908410a124665ecd632ae01e5ba977920643dab1a35d25277292bae55\" already exists"}
{"level":"error","ts":"2026-11-02T21:22:01.157Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"72bb4e3923485ca35015ee8655bc43ee332eea77f2cd8effbd48b21828f89f80","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["72bb4e3923485ca35015ee8655bc43ee332eea77f2cd8effbd48b21828f89f80"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-f51151.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-f51151.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"72bb4e3923485ca35015ee8655bc43ee332eea77f2cd8effbd48b21828f89f80\" already exists"}
{"level":"error","ts":"2026-11-02T21:22:01.226Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route#v1-chat-completions-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"d63de28626482cf5fa2aaf12cb9aa3def86d637d4c98f193819331c36fa73b21","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d63de28626482cf5fa2aaf12cb9aa3def86d637d4c98f193819331c36fa73b21"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-f51151.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-f51151.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"d63de28626482cf5fa2aaf12cb9aa3def86d637d4c98f193819331c36fa73b21\" already exists"}
{"level":"error","ts":"2026-11-02T21:22:01.277Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-worker-w2-6fa533","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"name":"kuadrant-e2e-worker-w2-6fa533","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-worker-w2-6fa533","uid":"350cbfc3-ae8f-47d8-bf88-3bc797a06de4"}]},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"79e41416d85afbda9f192c421571f899a58b4937465fe640fd4d17dfb0d8240e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-6fa533\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-6fa533\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"af109b5290beff4991ef93d4a835ce24ed3b0986578fba7947a76ca1a6dd65e2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"51e9e3c7450b52b22ca45c280738926226df3d95852d8df43ff47cf85cca9e5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-6fa533\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-6fa533\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"64fb7512cad2bf5a1c9b6978a7f9de714d5a739282aa9ca951ee3b4f417da286\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"dfa08453b9c8623db01e432dea4f9e09b3d7f80cbbee3a69df753c6d3fbfbded\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-6fa533\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-6fa533\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"af2b1c5e2c0a798508b2ef3249c778b1b43898c8636c878f66d20c220701a6f4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"517c7132d716e14e14b2c9fccd696f86bc7a24a46c391e71d07ac910d0dd1c18\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-6fa533\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-6fa533\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"ee9f66c18cbc8fcbae62d62e57dcbad633d943ff04a829fbc8bb030c121bf426\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b93afde66771848b5188f78e530f2f596324f9fb9f05b2dd8f1cb49489f2bda1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-6fa533\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-6fa533\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"c514ea15546ae0041f8d77a7e65bd51a98d808edee2739e914353f03c270d86d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"de3ca7c8a9dcdebe0c2a67b74b3bc72bdc4a8f34aff1f0c69df675fbb03b1e05\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-6fa533\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-6fa533\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"985f90a1588b57b9e2061e7440127c4729ab98e674bb91d1e90364de9aea35ad\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-worker-w2-6fa533"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-e2e-worker-w2-6fa533\" already exists"}
{"level":"error","ts":"2026-11-02T21:22:01.291Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route#v1-messages-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"aea6441051c6a7490e44d5f7bab0e4bf7cf461c9597675611789e8d9141a446c","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["aea6441051c6a7490e44d5f7bab0e4bf7cf461c9597675611789e8d9141a446c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-f51151.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-f51151.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"aea6441051c6a7490e44d5f7bab0e4bf7cf461c9597675611789e8d9141a446c\" already exists"}
{"level":"info","ts":"2026-11-02T21:22:01Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-02T21:22:01Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-02T21:22:01Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-02T21:22:01Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"error","ts":"2026-11-02T21:22:01.358Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"d13670b5b1696edcb191c925fa86dd729eeb7447f2230e160d9cc03e0117604d","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d13670b5b1696edcb191c925fa86dd729eeb7447f2230e160d9cc03e0117604d"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-f51151.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-f51151.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"d13670b5b1696edcb191c925fa86dd729eeb7447f2230e160d9cc03e0117604d\" already exists"}
{"level":"error","ts":"2026-11-02T21:22:01.402Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-worker-w3-f51151","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T21:21:31Z","generation":1,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"8871137c-7f6a-401d-a6db-2983aea5ba22\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:21:31Z"}],"name":"kuadrant-e2e-worker-w3-f51151","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-worker-w3-f51151","uid":"8871137c-7f6a-401d-a6db-2983aea5ba22"}],"resourceVersion":"26730","uid":"c24c0550-6758-4dca-8d2b-3fe32740d122"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a05d7e315cc7cde173ab18a777672d3a18ce0a96f8f52d505404dcf8d1e51c20\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"0e7c31c41adb0d3f9efc929ae631573fe0c783a2fa7edb7a4b135081c2969bbf\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a05d7e315cc7cde173ab18a777672d3a18ce0a96f8f52d505404dcf8d1e51c20\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"ec8a1b6bbf984a67cda63e2d923bfa9d2d66a7537f676f6198c12cbca9103517\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a05d7e315cc7cde173ab18a777672d3a18ce0a96f8f52d505404dcf8d1e51c20\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"a54bd689e670e5f8bbee0a66c2585a4d4adce9a5a7fc297449ee3b816a0c2695\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a05d7e315cc7cde173ab18a777672d3a18ce0a96f8f52d505404dcf8d1e51c20\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"6d5d9aca320022f0f8b70c3f9b34b5922adf537f5da717ec79924566febf6df1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a05d7e315cc7cde173ab18a777672d3a18ce0a96f8f52d505404dcf8d1e51c20\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"3f6b6643d5731a355a44968b83b24169ff3e0c1b36737d8be7f9d42e1def7c3e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a05d7e315cc7cde173ab18a777672d3a18ce0a96f8f52d505404dcf8d1e51c20\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"e00f3dfbbce60a718137b415a42cbf1e65a7b226437cc4600d9fa76b264e3b4d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a05d7e315cc7cde173ab18a777672d3a18ce0a96f8f52d505404dcf8d1e51c20\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"7ddf0d6bdcfc6aa206cdc0919b1d5b7545c903aafbb0e16d393016b1a83bd29a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a05d7e315cc7cde173ab18a777672d3a18ce0a96f8f52d505404dcf8d1e51c20\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"a00edc25239da061cd0457625d6046ede5f9d09507c78c2209e1e992795831c9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b31ddb7ef02e35e9d172430b50a004a3047564232880010bd3e581bf0dc547f8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"a1ec0f0592798b3996117a17734b0936906621077ceec69c81d8fb77e89a142a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"72bb4e3923485ca35015ee8655bc43ee332eea77f2cd8effbd48b21828f89f80\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"879fe62fbbe8b0a130140cda7f546611c758fb8fa416f173d2b0cf3da17d7941\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6ab1b21b6f75f2c1ef86f9bcf36a6c25244e88430832e3ac86a839cf10bb8dcd\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"15ecb8224cf6049c2e831c815cc4f0aed954432b967d01d55ea637294f3ea87e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a6267fc785126adca5b68df13f95ef1fa08e1d72b66fbff01b54f8d61edaf7ba\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"9a72bfcef40a8da2865b02b6123c023d9f4f17c11a2ff674e3ed24af23e468e2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aea6441051c6a7490e44d5f7bab0e4bf7cf461c9597675611789e8d9141a446c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"c871ffab27f7ed925d56fae005e70fd3716aab799f0484d7d44519e915491d11\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f1def6d908410a124665ecd632ae01e5ba977920643dab1a35d25277292bae55\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"1199947fd30f0d1dab3db5846b8d27e36b6284be94834b798e4004120ec52532\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d63de28626482cf5fa2aaf12cb9aa3def86d637d4c98f193819331c36fa73b21\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"fae01409c891b630fc644ebf1b8bc640438a1fc79de2b0750d34e2a6388d4ca6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7b5f8cd8dfbddc7109fd206805e23a6ae21c18bf406c0001927759ff1a39122f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"64238089f4803f45c8353b0d5d05ac6a23d6a3647106591fdc2bd5299c0b0759\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cb9167704c77a112808785ad099bc015c57786c61e7befec251b029ce378a0c6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"ef8b5b3a53f3de47fd70ccb56be2422e84d7fb1f10a03b64c032baca50a33c79\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"91d11ef27666b7f1f85063266e00a4add2242586a1e8a4bac5447b3f4ec7925d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"26827917812d006281f7f7ba6e53d3573012708364624693432b2cbdd0f434b5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d896bcdf40d08e0bef242ce04aa58467e96c672450af890adda6941c53a574d3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"69bd1c4b3e1b36f5d5d62283b221b7026a4e53da339ac7c470f75cb4334435f6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e11ba50523ae86c5c06c5b76176154ed9ba57c3ed13fa43133b1ac7249ce345f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"67192e2ead59827b5990f7b4cbc2aece4271402ddcdfaa76f7cf95d2d4552c43\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b6344fa6f672d55d2eb4fbf6449de24a41dbf664f8e9d3c01ecde50e9d46e233\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"3c429336b45d9712bfdb0d99ecd41baa0dde1570067b941b5927e1894931c254\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d1f3365185f5fcfe92899c5f49af1b579baab97128b8afee3eed4350859c3f14\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"2f17c508c987cffd0b45ebd164fcee3ad66819a39900f83fbeda518ccf619183\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"85124e62247f9234752fedfc382ba93d6f839dab53f49c16951446afa3e613aa\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"6d2c4320e5eae8e51596e1c62f1c7494e1c5f9cd5d374e73b3ddae65dd071a92\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"461f0fb3ed9e91195eaa488b65b6f04cb4bff62087edbcf0d4c2186d180ba0ab\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"994b30d96390325263d89c2da7554eadd9d4fd1811371afabaf057df68e19205\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d13670b5b1696edcb191c925fa86dd729eeb7447f2230e160d9cc03e0117604d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"f70585dfa8966b9748a8978bfdf51d589a9d85f553359b47bfa09ad8bb266b02\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-worker-w3-f51151"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-worker-w3-f51151\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:22:01.426Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route#v1-messages-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"91d11ef27666b7f1f85063266e00a4add2242586a1e8a4bac5447b3f4ec7925d","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["91d11ef27666b7f1f85063266e00a4add2242586a1e8a4bac5447b3f4ec7925d"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-f51151.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-f51151.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"91d11ef27666b7f1f85063266e00a4add2242586a1e8a4bac5447b3f4ec7925d\" already exists"}
{"level":"error","ts":"2026-11-02T21:22:01.492Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-6fa533","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-6fa533#rule-4"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"b93afde66771848b5188f78e530f2f596324f9fb9f05b2dd8f1cb49489f2bda1","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["b93afde66771848b5188f78e530f2f596324f9fb9f05b2dd8f1cb49489f2bda1"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"b93afde66771848b5188f78e530f2f596324f9fb9f05b2dd8f1cb49489f2bda1\" already exists"}
{"level":"error","ts":"2026-11-02T21:22:01.559Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-6fa533","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-6fa533#rule-3"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"517c7132d716e14e14b2c9fccd696f86bc7a24a46c391e71d07ac910d0dd1c18","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["517c7132d716e14e14b2c9fccd696f86bc7a24a46c391e71d07ac910d0dd1c18"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"517c7132d716e14e14b2c9fccd696f86bc7a24a46c391e71d07ac910d0dd1c18\" already exists"}
{"level":"error","ts":"2026-11-02T21:22:01.628Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route#v1-completions-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"6ab1b21b6f75f2c1ef86f9bcf36a6c25244e88430832e3ac86a839cf10bb8dcd","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["6ab1b21b6f75f2c1ef86f9bcf36a6c25244e88430832e3ac86a839cf10bb8dcd"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-f51151.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-f51151.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"6ab1b21b6f75f2c1ef86f9bcf36a6c25244e88430832e3ac86a839cf10bb8dcd\" already exists"}
{"level":"error","ts":"2026-11-02T21:22:01.697Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-6fa533","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-6fa533#rule-2"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"51e9e3c7450b52b22ca45c280738926226df3d95852d8df43ff47cf85cca9e5a","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["51e9e3c7450b52b22ca45c280738926226df3d95852d8df43ff47cf85cca9e5a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"51e9e3c7450b52b22ca45c280738926226df3d95852d8df43ff47cf85cca9e5a\" already exists"}
{"level":"error","ts":"2026-11-02T21:22:01.763Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-6fa533","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-6fa533#rule-6"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"79e41416d85afbda9f192c421571f899a58b4937465fe640fd4d17dfb0d8240e","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["79e41416d85afbda9f192c421571f899a58b4937465fe640fd4d17dfb0d8240e"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"79e41416d85afbda9f192c421571f899a58b4937465fe640fd4d17dfb0d8240e\" already exists"}
{"level":"error","ts":"2026-11-02T21:22:01.830Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route#v1-model-routing"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"a05d7e315cc7cde173ab18a777672d3a18ce0a96f8f52d505404dcf8d1e51c20","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a05d7e315cc7cde173ab18a777672d3a18ce0a96f8f52d505404dcf8d1e51c20"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-f51151.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-f51151.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"a05d7e315cc7cde173ab18a777672d3a18ce0a96f8f52d505404dcf8d1e51c20\" already exists"}
{"level":"error","ts":"2026-11-02T21:22:01.896Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-6fa533","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-6fa533#rule-5"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"dfa08453b9c8623db01e432dea4f9e09b3d7f80cbbee3a69df753c6d3fbfbded","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["dfa08453b9c8623db01e432dea4f9e09b3d7f80cbbee3a69df753c6d3fbfbded"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"dfa08453b9c8623db01e432dea4f9e09b3d7f80cbbee3a69df753c6d3fbfbded\" already exists"}
{"level":"error","ts":"2026-11-02T21:22:01.963Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route#v1-completions-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"7b5f8cd8dfbddc7109fd206805e23a6ae21c18bf406c0001927759ff1a39122f","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["7b5f8cd8dfbddc7109fd206805e23a6ae21c18bf406c0001927759ff1a39122f"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-f51151.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-f51151.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"7b5f8cd8dfbddc7109fd206805e23a6ae21c18bf406c0001927759ff1a39122f\" already exists"}
{"level":"error","ts":"2026-11-02T21:22:02.029Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route#v1-responses-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"a6267fc785126adca5b68df13f95ef1fa08e1d72b66fbff01b54f8d61edaf7ba","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a6267fc785126adca5b68df13f95ef1fa08e1d72b66fbff01b54f8d61edaf7ba"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-f51151.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-f51151.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"a6267fc785126adca5b68df13f95ef1fa08e1d72b66fbff01b54f8d61edaf7ba\" already exists"}
{"level":"error","ts":"2026-11-02T21:22:02.095Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-6fa533","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-6fa533#rule-1"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"de3ca7c8a9dcdebe0c2a67b74b3bc72bdc4a8f34aff1f0c69df675fbb03b1e05","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["de3ca7c8a9dcdebe0c2a67b74b3bc72bdc4a8f34aff1f0c69df675fbb03b1e05"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"de3ca7c8a9dcdebe0c2a67b74b3bc72bdc4a8f34aff1f0c69df675fbb03b1e05\" already exists"}
{"level":"error","ts":"2026-11-02T21:22:02.160Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-worker-w3-f51151-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-worker-w3-f51151-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:22:02.213Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-facebook-opt-125m-simulated","namespace":"llm","uid":"da8edb1a-ed61-454d-939f-fc7cd235d9fb","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-facebook-opt-125m-simulated\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:22:02.270Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-worker-w3-f51151","namespace":"openshift-ingress","uid":"d4b308ee-a3e0-46c6-b426-b113a09b0694","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-worker-w3-f51151\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:22:02.328Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-worker-w4-d6cb38","namespace":"openshift-ingress","uid":"6f6a09c9-d5cc-4e47-8444-7b69085b24cf","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-worker-w4-d6cb38\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:22:02.385Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-worker-w2-6fa533","namespace":"openshift-ingress","uid":"a5dc40a7-7420-41ee-b669-84be9ec8bcb8","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-worker-w2-6fa533\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:22:02.442Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-simulated-simulated-premium","namespace":"llm","uid":"447993be-3c57-4e68-8ffa-6fc998a39c77","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-simulated-simulated-premium\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:22:02.491Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-worker-w2-6fa533-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-worker-w2-6fa533-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:22:02.499Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-worker-w0-0c9014","namespace":"openshift-ingress","uid":"571b24bc-6370-4aa0-925c-f6e54337fc45","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-worker-w0-0c9014\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:22:02.499Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:22:02.500Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T21:22:02.557Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-worker-w1-5f765a","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-worker-w1-5f765a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:22:02.564Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"simulator-w3-f51151-kserve-route","namespace":"e2e-models-e2e-worker-w3-f51151","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"simulator-w3-f51151-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:22:02.646Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"maas-api-route-e2e-worker-w2-6fa533","namespace":"odh-ai-gateway-infra","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"maas-api-route-e2e-worker-w2-6fa533\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:22:02.919Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-worker-w2-6fa533","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-worker-w2-6fa533\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:22:06.975Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Limitador","AuthConfig","TokenRateLimitPolicy","AuthPolicy","Gateway","EnvoyFilter","ConfigMap","HTTPRoute","Kuadrant"],"eventTypes":{"create":24,"update":16}}
{"level":"info","ts":"2026-11-02T21:22:07.043Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:22:07.044Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:22:07.231Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:22:07.342Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:22:07.452Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:22:07.452Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:22:07.552Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:22:07.833Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:22:07.833Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:22:07.838Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:22:07.838Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:22:07.839Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:22:07.839Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:22:07.900Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:22:08.882Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:22:08.883Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:22:13.528Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","HTTPRoute","AuthConfig","AuthPolicy","EnvoyFilter","Limitador","Gateway","ConfigMap"],"eventTypes":{"create":9,"update":9}}
{"level":"info","ts":"2026-11-02T21:22:13.608Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:22:13.752Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:22:13.860Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:22:13.860Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:22:14.170Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:22:14.227Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:22:14.231Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-02T21:22:14.231Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:22:14.235Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:22:14.235Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:22:14.246Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:22:15.250Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:22:15.250Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T21:22:15.617Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-worker-w4-d6cb38","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-worker-w4-d6cb38\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:22:19.856Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","Limitador","ConfigMap","HTTPRoute","Gateway","AuthPolicy"],"eventTypes":{"create":1,"update":11}}
{"level":"info","ts":"2026-11-02T21:22:19.990Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:22:20.129Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:22:20.330Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:22:20.330Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:22:20.631Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:22:20.635Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:22:20.635Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:22:20.636Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:22:20.640Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:22:20.642Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:22:20.728Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:22:22.005Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:22:22.005Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T21:22:22.374Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-worker-w0-0c9014","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-worker-w0-0c9014\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:22:26.758Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","AuthConfig","HTTPRoute","EnvoyFilter","ConfigMap","AuthPolicy","Limitador","Gateway"],"eventTypes":{"create":13,"update":13}}
{"level":"info","ts":"2026-11-02T21:22:26.879Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:22:27.029Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:22:27.163Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:22:27.163Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:22:27.635Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:22:27.638Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:22:27.638Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:22:27.641Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:22:27.643Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:22:27.644Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-11-02T21:22:27.701Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:22:27.701Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:22:28.976Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:22:28.977Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:22:33.842Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["HTTPRoute","AuthConfig","ConfigMap","AuthPolicy","Limitador","EnvoyFilter"],"eventTypes":{"create":12,"update":6}}
{"level":"info","ts":"2026-11-02T21:22:33.964Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:22:34.066Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:22:34.126Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:22:34.126Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:22:34.669Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:22:34.671Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:22:34.671Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:22:34.685Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:22:34.688Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:22:34.723Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:22:34.751Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:22:35.738Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:22:35.738Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:22:40.486Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Limitador","ConfigMap","AuthPolicy"],"eventTypes":{"update":3}}
{"level":"info","ts":"2026-11-02T21:22:40.607Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:22:40.766Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:22:40.841Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:22:40.841Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:22:41.323Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:22:41.333Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:22:41.336Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-02T21:22:41.336Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:22:41.341Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:22:41.341Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:22:41.353Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:22:42.431Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:22:42.431Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:22:47.252Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["HTTPRoute","TokenRateLimitPolicy","Gateway","ConfigMap","Limitador"],"eventTypes":{"create":1,"update":10}}
{"level":"info","ts":"2026-11-02T21:22:47.373Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:22:47.451Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:22:47.548Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:22:47.548Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:22:48.172Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:22:48.176Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:22:48.176Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:22:48.176Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:22:48.223Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:22:48.223Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:22:48.291Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:22:49.572Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:22:49.572Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:22:54.426Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","TokenRateLimitPolicy","AuthPolicy","ConfigMap","Limitador","HTTPRoute","EnvoyFilter"],"eventTypes":{"create":13,"update":12}}
{"level":"info","ts":"2026-11-02T21:22:54.547Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:22:54.731Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:22:54.923Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:22:54.923Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:22:55.437Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:22:55.437Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:22:55.442Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:22:55.444Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:22:55.445Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:22:55.445Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-02T21:22:55.557Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:22:55.557Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:22:56.837Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:22:56.837Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:22:57.390Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway","AuthConfig"],"eventTypes":{"update":2}}
{"level":"info","ts":"2026-11-02T21:22:58.363Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:22:58.372Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:22:58.373Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:22:58.381Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-11-02T21:22:58.442Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:22:58.442Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:22:58.443Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:22:58.444Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-02T21:22:58.491Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"8abe3e629bd34674437803d6e54a0cb90fe0d0df12d2eac23f0b40d2f4990b37","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["8abe3e629bd34674437803d6e54a0cb90fe0d0df12d2eac23f0b40d2f4990b37"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"8abe3e629bd34674437803d6e54a0cb90fe0d0df12d2eac23f0b40d2f4990b37\" already exists"}
{"level":"error","ts":"2026-11-02T21:22:58.591Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route#v1-messages-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"f1edf5f89fd287762fbbefa668581cdc8f1877a3f31497227c537000670166d9","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f1edf5f89fd287762fbbefa668581cdc8f1877a3f31497227c537000670166d9"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"f1edf5f89fd287762fbbefa668581cdc8f1877a3f31497227c537000670166d9\" already exists"}
{"level":"error","ts":"2026-11-02T21:22:58.660Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route#v1-model-routing"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"2538346ffaabe171687c406d12f294530661f7690a04d14ab2327034447b1886","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["2538346ffaabe171687c406d12f294530661f7690a04d14ab2327034447b1886"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"2538346ffaabe171687c406d12f294530661f7690a04d14ab2327034447b1886\" already exists"}
{"level":"error","ts":"2026-11-02T21:22:58.773Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-worker-w2-6fa533","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T21:21:58Z","generation":1,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"350cbfc3-ae8f-47d8-bf88-3bc797a06de4\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:21:58Z"}],"name":"kuadrant-e2e-worker-w2-6fa533","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-worker-w2-6fa533","uid":"350cbfc3-ae8f-47d8-bf88-3bc797a06de4"}],"resourceVersion":"27735","uid":"e9c29fe8-1b7a-4730-9bc2-e4f3e80147bd"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2538346ffaabe171687c406d12f294530661f7690a04d14ab2327034447b1886\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"fc3c7a9daa18c716699d2f1fa233a5848a5d36cd60feee59a35bb57159d77252\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2538346ffaabe171687c406d12f294530661f7690a04d14ab2327034447b1886\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"53b8e179280ac5286bf38489ea72372b11c85a8c387359bf689ebecff1663d36\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2538346ffaabe171687c406d12f294530661f7690a04d14ab2327034447b1886\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"89b4eca3220447cd92c83c9c71f9e61e645c1f746a07d9b87eac9b2d4af27f2a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2538346ffaabe171687c406d12f294530661f7690a04d14ab2327034447b1886\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"0f54f971c3b78f7352580f77fc5be3e00c2117ef445b417be77bf67ea75539a5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2538346ffaabe171687c406d12f294530661f7690a04d14ab2327034447b1886\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"6982a3a190cf8786b034f1d39a14b07dab2e5311ed66344e600b389726798c72\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2538346ffaabe171687c406d12f294530661f7690a04d14ab2327034447b1886\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"87456404dc6fbf2160a52ba615889680b0c5cf40dc6100bb0e888288606dff25\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2538346ffaabe171687c406d12f294530661f7690a04d14ab2327034447b1886\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"8b9c2ea6de06bba9ed1ba2a65e99d1500ef45630a372914ecf445da73d74600a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2538346ffaabe171687c406d12f294530661f7690a04d14ab2327034447b1886\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"d58c446a6a9364595eaae0256bc0befa6f57ed0387674ac1d6970632cb6b41f0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"79e41416d85afbda9f192c421571f899a58b4937465fe640fd4d17dfb0d8240e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-6fa533\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-6fa533\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"af109b5290beff4991ef93d4a835ce24ed3b0986578fba7947a76ca1a6dd65e2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8abe3e629bd34674437803d6e54a0cb90fe0d0df12d2eac23f0b40d2f4990b37\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"ccb67df939c7a3278e2bb82db8d5dc418650599ab46b4bd1d8fe07cf9bb459d0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"503064d3f84a23711f1dad5e35d11ef1efceaefb2204608d180ef8d886666ffa\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"1036f7f4f8b7c68faa7a499350cf496a96528b515b125a726c7e904d5297c1e6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"41e99bc62a2ac4e8034135f4b655088597f627c66b2efc4627394d148bc2b0ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"b2fa16adeef96749257d873656ef49327fe454d7ba806ae3a8a73ec44c8a092d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f1edf5f89fd287762fbbefa668581cdc8f1877a3f31497227c537000670166d9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"dbf8e642e7e029e70e317d8df7b5d12be0fc1f008d29ff415d7291c09924eecb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"206e50a9b0e5f83281f994d9f1d85f92406e3544297c47017c081f763b10dd96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"1d9b68bda9fa73e5f8e8ac869771d602c5f128903fd22e64db2370f9749a3113\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"62457e23e29ce9b4e8380d685c5e9e84bc5137e91486a6f9c1c9e352ca3a021c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"957121ddf9ee4c2793cec71a8576e07ee1925a201f93c8de02b6fce446d010d8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fd7deaf8530c822c1b10ef4c1b0887086bc840af6d5c7a730508ddcb6e179095\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"14655ca6105b9121c6e780127a21626d2e779082f0ea2674b0d77647d247a24c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"60ca770315801fd35b67ab23639ba4ac6a344fcf95fe492c267cc87cb90ce14f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"d7f0af7e7ca785bc5de89e740ff47459e16eb3ba9360c1eee59d6d8d2f7389bd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1f83c46a7c87c216ad3b7a3697a1ad6c518cb36972a910efbc3c7eed6ab3956a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"496ec6213c84428bc1374936695dcb9246c04c80a4460a92e53220e4641a7116\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"319a8bd03b55a51284dd6790058e026879ed8db3e6d527dedb4a9314473afa5b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"ac54aac970a6722b49c3410bffc6b58a3832c579aa7c3629ff80507ab769f2d3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"51e9e3c7450b52b22ca45c280738926226df3d95852d8df43ff47cf85cca9e5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-6fa533\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-6fa533\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"64fb7512cad2bf5a1c9b6978a7f9de714d5a739282aa9ca951ee3b4f417da286\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"dfa08453b9c8623db01e432dea4f9e09b3d7f80cbbee3a69df753c6d3fbfbded\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-6fa533\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-6fa533\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"af2b1c5e2c0a798508b2ef3249c778b1b43898c8636c878f66d20c220701a6f4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"517c7132d716e14e14b2c9fccd696f86bc7a24a46c391e71d07ac910d0dd1c18\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-6fa533\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-6fa533\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"ee9f66c18cbc8fcbae62d62e57dcbad633d943ff04a829fbc8bb030c121bf426\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b93afde66771848b5188f78e530f2f596324f9fb9f05b2dd8f1cb49489f2bda1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-6fa533\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-6fa533\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"c514ea15546ae0041f8d77a7e65bd51a98d808edee2739e914353f03c270d86d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"de3ca7c8a9dcdebe0c2a67b74b3bc72bdc4a8f34aff1f0c69df675fbb03b1e05\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-6fa533\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-6fa533\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"985f90a1588b57b9e2061e7440127c4729ab98e674bb91d1e90364de9aea35ad\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"edbbdcfc920b88151941be1a4c41ad8be6a38bd6beddae7387db202bc3e9b302\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"15153104d9c89c44b59d96d9d8825fe62d21af5bd4db90b6c300fa53823a0ef0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-worker-w2-6fa533"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-worker-w2-6fa533\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:22:58.780Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route#v1-responses-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"41e99bc62a2ac4e8034135f4b655088597f627c66b2efc4627394d148bc2b0ce","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["41e99bc62a2ac4e8034135f4b655088597f627c66b2efc4627394d148bc2b0ce"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"41e99bc62a2ac4e8034135f4b655088597f627c66b2efc4627394d148bc2b0ce\" already exists"}
{"level":"error","ts":"2026-11-02T21:22:58.848Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route#v1-messages-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"1f83c46a7c87c216ad3b7a3697a1ad6c518cb36972a910efbc3c7eed6ab3956a","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["1f83c46a7c87c216ad3b7a3697a1ad6c518cb36972a910efbc3c7eed6ab3956a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"1f83c46a7c87c216ad3b7a3697a1ad6c518cb36972a910efbc3c7eed6ab3956a\" already exists"}
{"level":"error","ts":"2026-11-02T21:22:58.914Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route#v1-catch-all-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"319a8bd03b55a51284dd6790058e026879ed8db3e6d527dedb4a9314473afa5b","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["319a8bd03b55a51284dd6790058e026879ed8db3e6d527dedb4a9314473afa5b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"319a8bd03b55a51284dd6790058e026879ed8db3e6d527dedb4a9314473afa5b\" already exists"}
{"level":"error","ts":"2026-11-02T21:22:58.982Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route#v1-completions-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"fd7deaf8530c822c1b10ef4c1b0887086bc840af6d5c7a730508ddcb6e179095","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["fd7deaf8530c822c1b10ef4c1b0887086bc840af6d5c7a730508ddcb6e179095"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"fd7deaf8530c822c1b10ef4c1b0887086bc840af6d5c7a730508ddcb6e179095\" already exists"}
{"level":"error","ts":"2026-11-02T21:22:59.048Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"206e50a9b0e5f83281f994d9f1d85f92406e3544297c47017c081f763b10dd96","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["206e50a9b0e5f83281f994d9f1d85f92406e3544297c47017c081f763b10dd96"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"206e50a9b0e5f83281f994d9f1d85f92406e3544297c47017c081f763b10dd96\" already exists"}
{"level":"error","ts":"2026-11-02T21:22:59.116Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"edbbdcfc920b88151941be1a4c41ad8be6a38bd6beddae7387db202bc3e9b302","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["edbbdcfc920b88151941be1a4c41ad8be6a38bd6beddae7387db202bc3e9b302"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"edbbdcfc920b88151941be1a4c41ad8be6a38bd6beddae7387db202bc3e9b302\" already exists"}
{"level":"error","ts":"2026-11-02T21:22:59.183Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route#v1-completions-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"503064d3f84a23711f1dad5e35d11ef1efceaefb2204608d180ef8d886666ffa","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["503064d3f84a23711f1dad5e35d11ef1efceaefb2204608d180ef8d886666ffa"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"503064d3f84a23711f1dad5e35d11ef1efceaefb2204608d180ef8d886666ffa\" already exists"}
{"level":"error","ts":"2026-11-02T21:22:59.249Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route#v1-chat-completions-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"62457e23e29ce9b4e8380d685c5e9e84bc5137e91486a6f9c1c9e352ca3a021c","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["62457e23e29ce9b4e8380d685c5e9e84bc5137e91486a6f9c1c9e352ca3a021c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"62457e23e29ce9b4e8380d685c5e9e84bc5137e91486a6f9c1c9e352ca3a021c\" already exists"}
{"level":"error","ts":"2026-11-02T21:22:59.315Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route#v1-responses-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"60ca770315801fd35b67ab23639ba4ac6a344fcf95fe492c267cc87cb90ce14f","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["60ca770315801fd35b67ab23639ba4ac6a344fcf95fe492c267cc87cb90ce14f"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"60ca770315801fd35b67ab23639ba4ac6a344fcf95fe492c267cc87cb90ce14f\" already exists"}
{"level":"error","ts":"2026-11-02T21:22:59.449Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-worker-w3-f51151-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-worker-w3-f51151-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:22:59.781Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-worker-w2-6fa533-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-worker-w2-6fa533-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:22:59.784Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:22:59.784Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T21:22:59.864Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"simulator-w2-6fa533-kserve-route","namespace":"e2e-models-e2e-worker-w2-6fa533","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"simulator-w2-6fa533-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:23:04.877Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","AuthPolicy","HTTPRoute","Limitador","EnvoyFilter","ConfigMap"],"eventTypes":{"create":12,"update":6}}
{"level":"info","ts":"2026-11-02T21:23:05.045Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:23:05.239Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:23:05.354Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:23:05.354Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:23:05.957Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:23:05.957Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:23:05.960Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:23:05.965Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:23:05.965Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:23:05.973Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:23:06.024Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:23:07.082Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:23:07.082Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T21:23:07.264Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-worker-w1-5f765a","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-worker-w1-5f765a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:23:12.056Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthPolicy","Gateway","Limitador","HTTPRoute","ConfigMap"],"eventTypes":{"create":1,"update":4}}
{"level":"info","ts":"2026-11-02T21:23:12.127Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:23:12.545Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:23:12.663Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:23:12.663Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:23:13.274Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:23:13.275Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:23:13.278Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:23:13.324Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:23:13.325Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:23:13.325Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-02T21:23:13.381Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:23:13.381Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:23:14.662Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:23:14.662Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:23:19.729Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","Limitador","HTTPRoute","ConfigMap","AuthPolicy","EnvoyFilter"],"eventTypes":{"create":12,"update":5}}
{"level":"info","ts":"2026-11-02T21:23:19.905Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:23:20.231Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:23:20.346Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:23:20.346Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:23:21.070Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:23:21.073Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:23:21.075Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:23:21.075Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:23:21.076Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:23:21.077Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:23:21.147Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T21:23:22.382Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-worker-w3-f51151-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-worker-w3-f51151-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:23:22.452Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:23:22.452Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:23:23.057Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["HTTPRoute","AuthConfig","Gateway"],"eventTypes":{"create":1,"update":2}}
{"level":"info","ts":"2026-11-02T21:23:24.366Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:23:24.369Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:23:24.369Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:23:24.373Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:23:24.377Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:23:24.378Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-11-02T21:23:24.483Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:23:24.483Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T21:23:24.490Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route#v1-completions-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"4b5d6544ef7fd39f49a5af0551f4a404b0a5f49df3054a95306b7f797216c599","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["4b5d6544ef7fd39f49a5af0551f4a404b0a5f49df3054a95306b7f797216c599"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-d6cb38.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-d6cb38.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"4b5d6544ef7fd39f49a5af0551f4a404b0a5f49df3054a95306b7f797216c599\" already exists"}
{"level":"error","ts":"2026-11-02T21:23:24.562Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route#v1-chat-completions-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"f2655bcd7b6a7d3d8a4479c1c943c5f2b4d4fbb7d96408fc7ce07c4e7bd9f30c","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f2655bcd7b6a7d3d8a4479c1c943c5f2b4d4fbb7d96408fc7ce07c4e7bd9f30c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-d6cb38.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-d6cb38.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"f2655bcd7b6a7d3d8a4479c1c943c5f2b4d4fbb7d96408fc7ce07c4e7bd9f30c\" already exists"}
{"level":"error","ts":"2026-11-02T21:23:24.629Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"dff7a596e1042978304d40238abe84063cc499f4a6a2f9def85e7c84d1df1ebc","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["dff7a596e1042978304d40238abe84063cc499f4a6a2f9def85e7c84d1df1ebc"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-d6cb38.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-d6cb38.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"dff7a596e1042978304d40238abe84063cc499f4a6a2f9def85e7c84d1df1ebc\" already exists"}
{"level":"error","ts":"2026-11-02T21:23:24.696Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route#v1-responses-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"5c34c962f04362894a54cdf652c523865dbd1633f051244729b008181d474e55","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["5c34c962f04362894a54cdf652c523865dbd1633f051244729b008181d474e55"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-d6cb38.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-d6cb38.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"5c34c962f04362894a54cdf652c523865dbd1633f051244729b008181d474e55\" already exists"}
{"level":"error","ts":"2026-11-02T21:23:24.763Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route#v1-messages-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"bb82cce53996fd9a50a4f33832b37ff599d227ab91d54895bf0ab989d1eb0b01","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["bb82cce53996fd9a50a4f33832b37ff599d227ab91d54895bf0ab989d1eb0b01"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-d6cb38.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-d6cb38.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"bb82cce53996fd9a50a4f33832b37ff599d227ab91d54895bf0ab989d1eb0b01\" already exists"}
{"level":"error","ts":"2026-11-02T21:23:24.828Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"9a442413f7e81c114c48c6bbdd04c0e3809cdcdf4def1f524f6d3adf70468027","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["9a442413f7e81c114c48c6bbdd04c0e3809cdcdf4def1f524f6d3adf70468027"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-d6cb38.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-d6cb38.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"9a442413f7e81c114c48c6bbdd04c0e3809cdcdf4def1f524f6d3adf70468027\" already exists"}
{"level":"error","ts":"2026-11-02T21:23:24.894Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route#v1-completions-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"7d8b4229a4e8df0df0b627da5317c526c045e2ab5837161d638a7835193820d5","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["7d8b4229a4e8df0df0b627da5317c526c045e2ab5837161d638a7835193820d5"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-d6cb38.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-d6cb38.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"7d8b4229a4e8df0df0b627da5317c526c045e2ab5837161d638a7835193820d5\" already exists"}
{"level":"error","ts":"2026-11-02T21:23:24.961Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route#v1-messages-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"e12ef81cd87aec42f5b2528c46a9aeefe6b1bca82398f07b17a52a4bf6e91945","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["e12ef81cd87aec42f5b2528c46a9aeefe6b1bca82398f07b17a52a4bf6e91945"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-d6cb38.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-d6cb38.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"e12ef81cd87aec42f5b2528c46a9aeefe6b1bca82398f07b17a52a4bf6e91945\" already exists"}
{"level":"error","ts":"2026-11-02T21:23:25.028Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route#v1-responses-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"7fdbd59414185d321c56439c757d9c725c67465b49a83a52b935fdd9c5f0df82","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["7fdbd59414185d321c56439c757d9c725c67465b49a83a52b935fdd9c5f0df82"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-d6cb38.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-d6cb38.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"7fdbd59414185d321c56439c757d9c725c67465b49a83a52b935fdd9c5f0df82\" already exists"}
{"level":"error","ts":"2026-11-02T21:23:25.122Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-worker-w4-d6cb38","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T21:21:30Z","generation":2,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"36c0d6c0-4ad3-4739-8e18-24485ab1bc48\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:22:21Z"}],"name":"kuadrant-e2e-worker-w4-d6cb38","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-worker-w4-d6cb38","uid":"36c0d6c0-4ad3-4739-8e18-24485ab1bc48"}],"resourceVersion":"28370","uid":"2255fc2d-ab48-428d-86a8-4726b25b244c"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7f9f489fba4cc345dba07951f043d704ea999478c1da34cd23037357dcdf1384\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"f61d2b7d2f64f1d64a2dcee70f47ce24c9c6eb4854589984128561c58f6171ac\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"12f3d170c629c434ef1558f623819a2294b75940427c1164b50933cdad3fb52f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"4d6b2e7d73dcdd0567dbe7811fffb6b677ae17a404dd4e000e5586417b4abff9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7f9f489fba4cc345dba07951f043d704ea999478c1da34cd23037357dcdf1384\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"5b984da304c827646ff112362de545fa451a799e7f6999eac00f25f038606c2a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"12f3d170c629c434ef1558f623819a2294b75940427c1164b50933cdad3fb52f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"ad40721e9bd95807ea332811f94d79eb07b9dd045127a232886a7924332cbc73\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7f9f489fba4cc345dba07951f043d704ea999478c1da34cd23037357dcdf1384\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"b91256531abbaaf08ed45e4a93b53e9af9ebb53002123196214bb374517e81f0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"12f3d170c629c434ef1558f623819a2294b75940427c1164b50933cdad3fb52f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"597cf592078ae14c96f33099e96fee363339bedb2f5d430fdd69e28e8be2a8ff\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7f9f489fba4cc345dba07951f043d704ea999478c1da34cd23037357dcdf1384\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"490344715bd8708a2d31131fc3b4e370beef7eb7d9942ba89fc82080284e6244\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"12f3d170c629c434ef1558f623819a2294b75940427c1164b50933cdad3fb52f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"aeb99e2df9a1951917065c7b887084431b3e62a6f4d47287af43193676a5b8be\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7f9f489fba4cc345dba07951f043d704ea999478c1da34cd23037357dcdf1384\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"fa28a7ae652b865919d1ff4c61fd33bb8512d3139af38d1ceb9697a99e63cc6b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"12f3d170c629c434ef1558f623819a2294b75940427c1164b50933cdad3fb52f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"601d68ffdf7137fde779cf41214f1c74f63e6b717be0b7aad1eb56041a2d9b76\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7f9f489fba4cc345dba07951f043d704ea999478c1da34cd23037357dcdf1384\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"2dea78ba3797dedd7edd7b687182785345cfd95029e2131769c5797e3b752eb5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7f9f489fba4cc345dba07951f043d704ea999478c1da34cd23037357dcdf1384\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"cdb3a0c564011d63952f137daa521c84f02a66f8a75696ef9ac4f1f2cc9ea8c9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"12f3d170c629c434ef1558f623819a2294b75940427c1164b50933cdad3fb52f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"e019089f573a8879defa7fdce139828725d9f042c5a4dc9974b9185a8a382c51\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"12f3d170c629c434ef1558f623819a2294b75940427c1164b50933cdad3fb52f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"6a08c6dd0c7522c09a18466dfa733eb68e8c593cdc8d2890ccff2f5c9064fcc0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7f9f489fba4cc345dba07951f043d704ea999478c1da34cd23037357dcdf1384\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"31c0c96d54839068517aaeb062676423451143447943cafff7ee595d9fd1feca\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"12f3d170c629c434ef1558f623819a2294b75940427c1164b50933cdad3fb52f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"aebde4a102828558eb0fbde9709268d7adabc75fadf451c730e0573c086e2f07\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a69bb45bad035c53dd8c7176828b1cc26d0c9d3f775d2059034b1639ca1b49d8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"79db77eb448edf55b65761a293f7f6fc07c9d4365912f7a8595364cdbf33d994\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e5e9b9fa41efe7f56f3ea6e9079d12a9f3e89cd596105815b30b04ba7ba1281b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"9b7cb9a28ed2fc7fdfa23c7d8d869cc573e3e72423805bef3f945a77d2785710\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"dff7a596e1042978304d40238abe84063cc499f4a6a2f9def85e7c84d1df1ebc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"4ebe0e741886c221cfcd8d1126bcb3535dcbe15c7f802a713d3b2ceb8cee37e1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4db1dd6250896b02d5f97b90471902db72d349ea082f211b7b5e4046c827d477\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"9e4cdffa79635674b661188290cd9c853017f5721accaa1f268edc6c6b7f2590\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8ea982efbe7afcd4f8dbaa4e864584b38ec852971d686ed11c87e99f1b9f4f9a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"1ed83021e2408187ee74cd1a66732d37b92c80d46439951ce5e0f654f1542381\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7d8b4229a4e8df0df0b627da5317c526c045e2ab5837161d638a7835193820d5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"36ee8c63f509519eef9ec6e2c257745b647d322586f8289611274ca06f90ec11\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2c4b4abb753457c4ad4bd5815f6ce55723fcfcf44f298a47923e03e51d023a49\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"3ce9856de6f3b95cc2ed4fe4abeef13ecb59b5b1ef0102b858e5d3ec0d8afa89\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7fdbd59414185d321c56439c757d9c725c67465b49a83a52b935fdd9c5f0df82\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"2eb3ad4b5e4be8080b2e0309815371172455a7e5f61cf9c3c595f17e99e6f681\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bb82cce53996fd9a50a4f33832b37ff599d227ab91d54895bf0ab989d1eb0b01\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"138b7da9a4ea2091f7b13106ba292672e2ca1d22138b32de717b07cab221eebc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7ebdbd5a6be861834fc366408f369ad8f021dfe8f061cbc93334bc801f3df98f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"be4080fc1058816edd779c6c2b40a1657320a89a6a86b4ff7358026a6adb2e23\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a6e80d640d49da44f2b60f9db62279137aa6839ed5acbca6493b96977b1f3f9b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"b470ad22bfeca185d9d86c6a107cdea6e62f1aaf494ef31244de0d30052bbcfc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b1fdba63ead328fd43c505e06394bc2adb7e5e2dfb0a1e55ef2c41d8f345142f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"30a1d05fede91486be251352bb7291a36ac69d50b6fce18433612afe29f1b4b1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f2655bcd7b6a7d3d8a4479c1c943c5f2b4d4fbb7d96408fc7ce07c4e7bd9f30c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"12835533e58f43762872e20b92b523339a9de435dc7d0f689b42133b367fae44\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"309f6b916a61539853033efc6ca2e083c01c99e5b96f857a7c78b89f9816f598\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"788f4c0f9a4e5a97247c2043b8125cf170fe6674c40d873723dc972c4d5d93af\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9a1afd5e20de63bb2c85d93c9c3fd7aae15a0f45cb6e07dc467b8063b97decee\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"4c928eaa593596b5c3719a02958892d193943b2129a32e43035c896d93b232c1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4b5d6544ef7fd39f49a5af0551f4a404b0a5f49df3054a95306b7f797216c599\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"8773bca7122a801a4f199775b03693ad30e316ffebea5bcaf72af079bf14f24d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3474cd3af51b646106406cc4778f6a5608fdc62b1fd92f27ccbcf8ab285bc05c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"f0bc235629f48b82dcaad76bce5cdb80abfa82763d9ad220a11c3e27d70223d5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c34c962f04362894a54cdf652c523865dbd1633f051244729b008181d474e55\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"2c3bfc8693c69427d3231717a8df2d14aba0f1fb87d9fd82bb191f0ebb31c308\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e12ef81cd87aec42f5b2528c46a9aeefe6b1bca82398f07b17a52a4bf6e91945\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"bd1615998be1912965bb2d26173bc1bd1e2565f8996f1f21fc476ccff3b1ad05\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a6fa5c95daf46871f07bc4e3ef7985a19659c040a1ef2a7baccccaa90e241705\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"3a34ac7af354fbf7d29872077cc2e557a29218e220d9e4e79e21710f2084e770\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"16cb85f469e7c5716866312b8b4cc95d7bd4782b54923c1571be2b995ef85c30\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"a65b58c28d5a781726a832c59d62e640ea9d347c008d6795a6bc79865414532f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3aa68add648f18fb79f3def0d73f0c2f29d8ab60b1352cf4548a1a038cf3d923\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"fad9cba453f811618739c6f08a8544a889f48ec7511f7d3ccac0f71ba988967b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"099191e40682a5a6b1df435c6dc10936b8b4e31a891f3520e8e9f8418b1acc3e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"adbf9660bf8db4b1489d019993fddbd2863d0cf7c72174df8663c00e565a1e21\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"13694f4cecc05b3e953bb7d1aa68f96fad9b8548456e1357cc504ba9936493bf\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"fd3f6d135cf69e39efa3702af6a7e665f47a40ddb90f71d1f37cad11438027bc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"db8ed9490207e877020d08d86f8a9769046fd69225998abd4e476e93ef7b9431\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"e3ae0784ebe4c51499f320023e5e93f640f2a33ae4fea237cb7e068df1c76739\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"12dec0ddb151cc18ef75cfe2b4260788095e28a391f359fc3f7da7c75381b728\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"8f6398fb66bae44affa747ad532a12445774a5b43ca2c7196a633d5d03da8c80\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"735d43fce555e32c36cd137abc0678ce944fbfe58a677497d16ab8d9ab37074f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"1016de6b3250a59509e3bc1de65ad0a68ae6faf776c4eaa853d86bce7dd96698\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9a442413f7e81c114c48c6bbdd04c0e3809cdcdf4def1f524f6d3adf70468027\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"785762b8cbcc7dd30b578476b081ad2df517e9e450947fa2591a488b59407126\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-worker-w4-d6cb38"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-worker-w4-d6cb38\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:23:25.127Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route#v1-catch-all-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"16cb85f469e7c5716866312b8b4cc95d7bd4782b54923c1571be2b995ef85c30","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["16cb85f469e7c5716866312b8b4cc95d7bd4782b54923c1571be2b995ef85c30"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-d6cb38.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-d6cb38.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"16cb85f469e7c5716866312b8b4cc95d7bd4782b54923c1571be2b995ef85c30\" already exists"}
{"level":"error","ts":"2026-11-02T21:23:25.196Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route#v1-model-routing"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"12f3d170c629c434ef1558f623819a2294b75940427c1164b50933cdad3fb52f","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["12f3d170c629c434ef1558f623819a2294b75940427c1164b50933cdad3fb52f"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-d6cb38.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-d6cb38.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"12f3d170c629c434ef1558f623819a2294b75940427c1164b50933cdad3fb52f\" already exists"}
{"level":"error","ts":"2026-11-02T21:23:25.265Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"b1fdba63ead328fd43c505e06394bc2adb7e5e2dfb0a1e55ef2c41d8f345142f","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["b1fdba63ead328fd43c505e06394bc2adb7e5e2dfb0a1e55ef2c41d8f345142f"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-d6cb38.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-d6cb38.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"b1fdba63ead328fd43c505e06394bc2adb7e5e2dfb0a1e55ef2c41d8f345142f\" already exists"}
{"level":"error","ts":"2026-11-02T21:23:25.508Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-worker-w4-d6cb38-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-worker-w4-d6cb38-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:23:25.571Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-worker-w1-5f765a-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-worker-w1-5f765a-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:23:25.775Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-worker-w3-f51151-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-worker-w3-f51151-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:23:25.775Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:23:25.775Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T21:23:25.917Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"premium-w4-d6cb38-kserve-route","namespace":"e2e-models-e2e-worker-w4-d6cb38","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"premium-w4-d6cb38-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:23:31.026Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","EnvoyFilter","AuthPolicy","ConfigMap","Gateway","HTTPRoute","TokenRateLimitPolicy","Limitador"],"eventTypes":{"create":15,"update":8}}
{"level":"info","ts":"2026-11-02T21:23:31.203Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:23:31.737Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:23:31.933Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:23:31.933Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:23:32.663Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:23:32.663Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:23:32.667Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:23:32.668Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:23:32.670Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:23:32.670Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-02T21:23:32.776Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:23:32.776Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:23:36.417Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:23:36.417Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:23:41.684Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthPolicy","ConfigMap","AuthConfig","EnvoyFilter","HTTPRoute","Limitador","TokenRateLimitPolicy"],"eventTypes":{"create":12,"update":43}}
{"level":"info","ts":"2026-11-02T21:23:41.808Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:23:42.269Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:23:42.423Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:23:42.423Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:23:43.174Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:23:43.179Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:23:43.180Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:23:43.195Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:23:43.195Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:23:43.199Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:23:43.261Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:23:44.534Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:23:44.534Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:23:49.745Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","Limitador","TokenRateLimitPolicy","AuthPolicy"],"eventTypes":{"create":1,"update":5}}
{"level":"info","ts":"2026-11-02T21:23:49.922Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:23:50.249Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:23:50.423Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:23:50.423Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:23:51.367Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:23:51.369Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:23:51.369Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:23:51.370Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:23:51.373Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:23:51.375Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-11-02T21:23:51.480Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:23:51.480Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T21:23:53.943Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-worker-w0-0c9014-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-worker-w0-0c9014-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:23:54.455Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:23:54.455Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T21:23:54.942Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-worker-w2-6fa533","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-worker-w2-6fa533\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:23:55.065Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy"],"eventTypes":{"create":1}}
{"level":"info","ts":"2026-11-02T21:23:56.355Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:23:56.356Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:23:56.356Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:23:56.360Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"error","ts":"2026-11-02T21:23:56.423Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:23:56.423Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T21:23:57.180Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-worker-w4-d6cb38","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T21:21:30Z","generation":3,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"36c0d6c0-4ad3-4739-8e18-24485ab1bc48\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:23:21Z"}],"name":"kuadrant-e2e-worker-w4-d6cb38","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-worker-w4-d6cb38","uid":"36c0d6c0-4ad3-4739-8e18-24485ab1bc48"}],"resourceVersion":"29856","uid":"2255fc2d-ab48-428d-86a8-4726b25b244c"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7f9f489fba4cc345dba07951f043d704ea999478c1da34cd23037357dcdf1384\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"f61d2b7d2f64f1d64a2dcee70f47ce24c9c6eb4854589984128561c58f6171ac\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"12f3d170c629c434ef1558f623819a2294b75940427c1164b50933cdad3fb52f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"4d6b2e7d73dcdd0567dbe7811fffb6b677ae17a404dd4e000e5586417b4abff9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7f9f489fba4cc345dba07951f043d704ea999478c1da34cd23037357dcdf1384\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"5b984da304c827646ff112362de545fa451a799e7f6999eac00f25f038606c2a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"12f3d170c629c434ef1558f623819a2294b75940427c1164b50933cdad3fb52f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"ad40721e9bd95807ea332811f94d79eb07b9dd045127a232886a7924332cbc73\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7f9f489fba4cc345dba07951f043d704ea999478c1da34cd23037357dcdf1384\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"b91256531abbaaf08ed45e4a93b53e9af9ebb53002123196214bb374517e81f0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"12f3d170c629c434ef1558f623819a2294b75940427c1164b50933cdad3fb52f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"597cf592078ae14c96f33099e96fee363339bedb2f5d430fdd69e28e8be2a8ff\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7f9f489fba4cc345dba07951f043d704ea999478c1da34cd23037357dcdf1384\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"490344715bd8708a2d31131fc3b4e370beef7eb7d9942ba89fc82080284e6244\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"12f3d170c629c434ef1558f623819a2294b75940427c1164b50933cdad3fb52f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"aeb99e2df9a1951917065c7b887084431b3e62a6f4d47287af43193676a5b8be\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7f9f489fba4cc345dba07951f043d704ea999478c1da34cd23037357dcdf1384\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"fa28a7ae652b865919d1ff4c61fd33bb8512d3139af38d1ceb9697a99e63cc6b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"12f3d170c629c434ef1558f623819a2294b75940427c1164b50933cdad3fb52f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"601d68ffdf7137fde779cf41214f1c74f63e6b717be0b7aad1eb56041a2d9b76\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7f9f489fba4cc345dba07951f043d704ea999478c1da34cd23037357dcdf1384\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"2dea78ba3797dedd7edd7b687182785345cfd95029e2131769c5797e3b752eb5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7f9f489fba4cc345dba07951f043d704ea999478c1da34cd23037357dcdf1384\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"cdb3a0c564011d63952f137daa521c84f02a66f8a75696ef9ac4f1f2cc9ea8c9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"12f3d170c629c434ef1558f623819a2294b75940427c1164b50933cdad3fb52f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"e019089f573a8879defa7fdce139828725d9f042c5a4dc9974b9185a8a382c51\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"12f3d170c629c434ef1558f623819a2294b75940427c1164b50933cdad3fb52f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"6a08c6dd0c7522c09a18466dfa733eb68e8c593cdc8d2890ccff2f5c9064fcc0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7f9f489fba4cc345dba07951f043d704ea999478c1da34cd23037357dcdf1384\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"31c0c96d54839068517aaeb062676423451143447943cafff7ee595d9fd1feca\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"12f3d170c629c434ef1558f623819a2294b75940427c1164b50933cdad3fb52f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"aebde4a102828558eb0fbde9709268d7adabc75fadf451c730e0573c086e2f07\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a69bb45bad035c53dd8c7176828b1cc26d0c9d3f775d2059034b1639ca1b49d8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"79db77eb448edf55b65761a293f7f6fc07c9d4365912f7a8595364cdbf33d994\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e5e9b9fa41efe7f56f3ea6e9079d12a9f3e89cd596105815b30b04ba7ba1281b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"9b7cb9a28ed2fc7fdfa23c7d8d869cc573e3e72423805bef3f945a77d2785710\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"dff7a596e1042978304d40238abe84063cc499f4a6a2f9def85e7c84d1df1ebc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"4ebe0e741886c221cfcd8d1126bcb3535dcbe15c7f802a713d3b2ceb8cee37e1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4db1dd6250896b02d5f97b90471902db72d349ea082f211b7b5e4046c827d477\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"9e4cdffa79635674b661188290cd9c853017f5721accaa1f268edc6c6b7f2590\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8ea982efbe7afcd4f8dbaa4e864584b38ec852971d686ed11c87e99f1b9f4f9a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"1ed83021e2408187ee74cd1a66732d37b92c80d46439951ce5e0f654f1542381\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7d8b4229a4e8df0df0b627da5317c526c045e2ab5837161d638a7835193820d5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"36ee8c63f509519eef9ec6e2c257745b647d322586f8289611274ca06f90ec11\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2c4b4abb753457c4ad4bd5815f6ce55723fcfcf44f298a47923e03e51d023a49\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"3ce9856de6f3b95cc2ed4fe4abeef13ecb59b5b1ef0102b858e5d3ec0d8afa89\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7fdbd59414185d321c56439c757d9c725c67465b49a83a52b935fdd9c5f0df82\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"2eb3ad4b5e4be8080b2e0309815371172455a7e5f61cf9c3c595f17e99e6f681\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bb82cce53996fd9a50a4f33832b37ff599d227ab91d54895bf0ab989d1eb0b01\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"138b7da9a4ea2091f7b13106ba292672e2ca1d22138b32de717b07cab221eebc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7ebdbd5a6be861834fc366408f369ad8f021dfe8f061cbc93334bc801f3df98f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"be4080fc1058816edd779c6c2b40a1657320a89a6a86b4ff7358026a6adb2e23\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a6e80d640d49da44f2b60f9db62279137aa6839ed5acbca6493b96977b1f3f9b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"b470ad22bfeca185d9d86c6a107cdea6e62f1aaf494ef31244de0d30052bbcfc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b1fdba63ead328fd43c505e06394bc2adb7e5e2dfb0a1e55ef2c41d8f345142f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"30a1d05fede91486be251352bb7291a36ac69d50b6fce18433612afe29f1b4b1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f2655bcd7b6a7d3d8a4479c1c943c5f2b4d4fbb7d96408fc7ce07c4e7bd9f30c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"12835533e58f43762872e20b92b523339a9de435dc7d0f689b42133b367fae44\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"309f6b916a61539853033efc6ca2e083c01c99e5b96f857a7c78b89f9816f598\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"788f4c0f9a4e5a97247c2043b8125cf170fe6674c40d873723dc972c4d5d93af\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9a1afd5e20de63bb2c85d93c9c3fd7aae15a0f45cb6e07dc467b8063b97decee\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"4c928eaa593596b5c3719a02958892d193943b2129a32e43035c896d93b232c1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4b5d6544ef7fd39f49a5af0551f4a404b0a5f49df3054a95306b7f797216c599\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"8773bca7122a801a4f199775b03693ad30e316ffebea5bcaf72af079bf14f24d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3474cd3af51b646106406cc4778f6a5608fdc62b1fd92f27ccbcf8ab285bc05c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"f0bc235629f48b82dcaad76bce5cdb80abfa82763d9ad220a11c3e27d70223d5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c34c962f04362894a54cdf652c523865dbd1633f051244729b008181d474e55\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"2c3bfc8693c69427d3231717a8df2d14aba0f1fb87d9fd82bb191f0ebb31c308\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e12ef81cd87aec42f5b2528c46a9aeefe6b1bca82398f07b17a52a4bf6e91945\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"bd1615998be1912965bb2d26173bc1bd1e2565f8996f1f21fc476ccff3b1ad05\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a6fa5c95daf46871f07bc4e3ef7985a19659c040a1ef2a7baccccaa90e241705\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"3a34ac7af354fbf7d29872077cc2e557a29218e220d9e4e79e21710f2084e770\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"16cb85f469e7c5716866312b8b4cc95d7bd4782b54923c1571be2b995ef85c30\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"a65b58c28d5a781726a832c59d62e640ea9d347c008d6795a6bc79865414532f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3aa68add648f18fb79f3def0d73f0c2f29d8ab60b1352cf4548a1a038cf3d923\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"fad9cba453f811618739c6f08a8544a889f48ec7511f7d3ccac0f71ba988967b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"099191e40682a5a6b1df435c6dc10936b8b4e31a891f3520e8e9f8418b1acc3e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"adbf9660bf8db4b1489d019993fddbd2863d0cf7c72174df8663c00e565a1e21\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"13694f4cecc05b3e953bb7d1aa68f96fad9b8548456e1357cc504ba9936493bf\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"fd3f6d135cf69e39efa3702af6a7e665f47a40ddb90f71d1f37cad11438027bc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"db8ed9490207e877020d08d86f8a9769046fd69225998abd4e476e93ef7b9431\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"e3ae0784ebe4c51499f320023e5e93f640f2a33ae4fea237cb7e068df1c76739\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"12dec0ddb151cc18ef75cfe2b4260788095e28a391f359fc3f7da7c75381b728\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"8f6398fb66bae44affa747ad532a12445774a5b43ca2c7196a633d5d03da8c80\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"735d43fce555e32c36cd137abc0678ce944fbfe58a677497d16ab8d9ab37074f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"1016de6b3250a59509e3bc1de65ad0a68ae6faf776c4eaa853d86bce7dd96698\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9a442413f7e81c114c48c6bbdd04c0e3809cdcdf4def1f524f6d3adf70468027\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"785762b8cbcc7dd30b578476b081ad2df517e9e450947fa2591a488b59407126\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-worker-w4-d6cb38"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-worker-w4-d6cb38\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:23:57.544Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w4-d6cb38","namespace":"e2e-models-e2e-worker-w4-d6cb38","uid":"0d3ebd35-5005-4ee4-a055-ff95546e3673","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w4-d6cb38\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:23:57.719Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-worker-w4-d6cb38","namespace":"openshift-ingress","uid":"6f6a09c9-d5cc-4e47-8444-7b69085b24cf","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-worker-w4-d6cb38\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:23:57.835Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w4-d6cb38","namespace":"e2e-models-e2e-worker-w4-d6cb38","uid":"486176e6-7786-40c4-9ce0-6f4a68b408b2","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w4-d6cb38\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:23:57.893Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w3-f51151","namespace":"e2e-models-e2e-worker-w3-f51151","uid":"e3340067-224a-43ad-8020-ca9e00ead152","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w3-f51151\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:23:58.082Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-worker-w2-6fa533","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-worker-w2-6fa533\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:23:58.091Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"simulator-w4-d6cb38-kserve-route","namespace":"e2e-models-e2e-worker-w4-d6cb38","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"simulator-w4-d6cb38-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:23:58.194Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"premium-w4-d6cb38-kserve-route","namespace":"e2e-models-e2e-worker-w4-d6cb38","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"premium-w4-d6cb38-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:24:03.289Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","AuthPolicy","HTTPRoute","TokenRateLimitPolicy","ConfigMap","EnvoyFilter","Gateway","Limitador"],"eventTypes":{"create":3,"update":42}}
{"level":"info","ts":"2026-11-02T21:24:03.525Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:24:04.167Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:24:04.255Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:24:04.256Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:24:05.073Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:24:05.135Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:24:05.137Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:24:05.137Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:24:05.139Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:24:05.151Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:24:05.304Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:24:09.291Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:24:09.291Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:24:17.101Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","TokenRateLimitPolicy","AuthPolicy","EnvoyFilter","HTTPRoute","ConfigMap","Limitador"],"eventTypes":{"create":12,"update":45}}
{"level":"info","ts":"2026-11-02T21:24:17.225Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:24:17.943Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:24:18.055Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:24:18.056Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:24:18.867Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:24:18.870Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:24:18.928Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:24:18.931Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:24:18.931Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:24:18.932Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"error","ts":"2026-11-02T21:24:18.992Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:24:18.992Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:24:20.637Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:24:20.637Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:24:21.227Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","HTTPRoute","Gateway"],"eventTypes":{"create":1,"update":2}}
{"level":"info","ts":"2026-11-02T21:24:22.966Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:24:22.969Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:24:22.969Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:24:22.969Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:24:22.973Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:24:22.975Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-11-02T21:24:23.123Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:24:23.123Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T21:24:23.124Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route#v1-completions-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"beb0d5e916dc078abcaba4ea5b4d8012d5c2d8edfd07ca54d585bfe44d7c605a","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["beb0d5e916dc078abcaba4ea5b4d8012d5c2d8edfd07ca54d585bfe44d7c605a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-5f765a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-5f765a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"beb0d5e916dc078abcaba4ea5b4d8012d5c2d8edfd07ca54d585bfe44d7c605a\" already exists"}
{"level":"error","ts":"2026-11-02T21:24:23.192Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route#v1-messages-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"9f6fc629fa43de74b0fb261de7e8b46fbdfe4f21235446879cd916210856d6f0","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["9f6fc629fa43de74b0fb261de7e8b46fbdfe4f21235446879cd916210856d6f0"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-5f765a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-5f765a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"9f6fc629fa43de74b0fb261de7e8b46fbdfe4f21235446879cd916210856d6f0\" already exists"}
{"level":"error","ts":"2026-11-02T21:24:23.262Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route#v1-completions-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"106dc24382c96b56f69df1e4bfaa0455678809d57faded1081bc4e26a642d4a0","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["106dc24382c96b56f69df1e4bfaa0455678809d57faded1081bc4e26a642d4a0"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-5f765a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-5f765a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"106dc24382c96b56f69df1e4bfaa0455678809d57faded1081bc4e26a642d4a0\" already exists"}
{"level":"error","ts":"2026-11-02T21:24:23.328Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"505545a95fce131db80f848e9990387e6b3e42a2f7e2375f56bbc07efcac9723","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["505545a95fce131db80f848e9990387e6b3e42a2f7e2375f56bbc07efcac9723"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-5f765a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-5f765a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"505545a95fce131db80f848e9990387e6b3e42a2f7e2375f56bbc07efcac9723\" already exists"}
{"level":"error","ts":"2026-11-02T21:24:23.415Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-worker-w1-5f765a","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T21:22:08Z","generation":2,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"4caf3c5b-8145-48de-a05b-6a1b9a102f00\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:23:13Z"}],"name":"kuadrant-e2e-worker-w1-5f765a","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-worker-w1-5f765a","uid":"4caf3c5b-8145-48de-a05b-6a1b9a102f00"}],"resourceVersion":"29631","uid":"fb3e4914-c809-4feb-81f5-a0a468b56725"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bcf0aab5299349f1dd1df89a10a558ad5617afdfb0f30d972811f3dbb51b1ea5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"f2c753e74bbc5983406d967abd1143e62400e0f08a2e36f6ffa42c06a3a6974c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/simulator-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"db6f9ff18eeb49f1421400a53d101cb100b1a88466190b46fb6dbed22a42e073\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"eedd7a1bac5c7747d7137dccbdafefbc4f76edb1acf806e0399e7d01c0c93443\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/premium-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bcf0aab5299349f1dd1df89a10a558ad5617afdfb0f30d972811f3dbb51b1ea5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"76a34f19bf7079dd4104caff1731257297b843b61401a91d00b1a27ccab63fd7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/simulator-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"db6f9ff18eeb49f1421400a53d101cb100b1a88466190b46fb6dbed22a42e073\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"263fa7af352a917ec5f565f1287ed3339005bf0c3ba787dcb8a5e539d84cfaff\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/premium-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bcf0aab5299349f1dd1df89a10a558ad5617afdfb0f30d972811f3dbb51b1ea5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"3451d924df135b44fe4e7857db1417971e78cee0d322dc55f2d9dcfc1a98438c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/simulator-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"db6f9ff18eeb49f1421400a53d101cb100b1a88466190b46fb6dbed22a42e073\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"c12741fd641c86bf88bbd47e58d2e5d62933e3e0f320cf13ec7d52df7a394c29\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/premium-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bcf0aab5299349f1dd1df89a10a558ad5617afdfb0f30d972811f3dbb51b1ea5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"70ba0b522bbd69a6ed9f77952d20b92d482b03854cc92dbb7d522bd33335c96d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/simulator-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"db6f9ff18eeb49f1421400a53d101cb100b1a88466190b46fb6dbed22a42e073\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"65d2403634b5ea32b46b6ea0b85de94e33a3af4a2416095b99fbdb18350add91\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/premium-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bcf0aab5299349f1dd1df89a10a558ad5617afdfb0f30d972811f3dbb51b1ea5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"ba40310e6c4dc6ab4a0b4c712eda89883762afc9beb70d4b7c23b27f69b9ab49\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/simulator-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"db6f9ff18eeb49f1421400a53d101cb100b1a88466190b46fb6dbed22a42e073\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"bd657b2cf110d146eb81bf7b91f3184e0028cf98e5195ef2ddb8f508863741de\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/premium-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bcf0aab5299349f1dd1df89a10a558ad5617afdfb0f30d972811f3dbb51b1ea5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"d637ac7d402bcd26ac6f88370d996d05abc8c7982ed2c2cc4095675044806a8e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/simulator-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bcf0aab5299349f1dd1df89a10a558ad5617afdfb0f30d972811f3dbb51b1ea5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"30abcde41a2149187abd00b7dbf1da4982d5f53b5da1288f5b95a0d579abbd6a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/simulator-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"db6f9ff18eeb49f1421400a53d101cb100b1a88466190b46fb6dbed22a42e073\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"e253a93d7a1e997f4ec04774e63bac26b7573119884a469fa9cadfdd694f2c86\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/premium-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"db6f9ff18eeb49f1421400a53d101cb100b1a88466190b46fb6dbed22a42e073\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"857e58268f515ca3e78ba5dd4b121c1c64a1556ffa6fb72ca451501f13fd956c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/premium-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bcf0aab5299349f1dd1df89a10a558ad5617afdfb0f30d972811f3dbb51b1ea5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"c06ce02686be6c949fde11dd46005249ce969a6a4cd5979e062f2fd0e328306e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/simulator-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"db6f9ff18eeb49f1421400a53d101cb100b1a88466190b46fb6dbed22a42e073\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"a5c2e2f330e8d4b7f1cc2fd43eb290bf161724714abfed900324fd2909e2a064\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/premium-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fa1a008e4957943b0d2d9d600bd19dafc0caa0b522e5c1d1e09ecc5d82a64f4c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-5f765a\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-5f765a\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"b218feb88b60257514445a8b1d44e3ab1edb938de3bc6d6fdb02ef04222c6dcb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"58ba249888c7ebfedfcb5aec9df19d4b07d2856710ac2163dcc961a176311fa9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"4d61c78710f351b5667f692e1f8792c5724b52f7fc998511134665312fdd896f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/simulator-w1-5f765a/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2aaf9242e876623422852fe471269a2d268f4d784b14c7ab37ec9f34c17f3060\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"f201dec897e559ed36b9a30f0bbf86c43aae129e674ef36595083bda93e4b839\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/premium-w1-5f765a/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c19827aa458f939a86c4dbefda3dabc4f554898dbb7e2f92b488060e9e90b5cc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"6d546403540eabf244c73a602659986050165bca90bc795de701a61411a1c48e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/simulator-w1-5f765a/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"784ccec783ba11c98817fe5af2849f9f4970be19046e351a067c85add913f548\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"9327d3b7df136b8c0fed4aaa35057ac8d1022305472875ccc8c55a524105fb1a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/simulator-w1-5f765a/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"beb0d5e916dc078abcaba4ea5b4d8012d5c2d8edfd07ca54d585bfe44d7c605a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"8cff0046c214e842687a3a284fe4fabc8a45eb2579168ac47aa1b4908bd95fc4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/premium-w1-5f765a/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5bc63b4c1a02d51f1462172790f7018aec7db9fb8a2a61024ca7c15aac9065b4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"2bdf38e0b22608328672d2ed39e7a6336f89c14fb615a48fda4a36a65c185b32\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/simulator-w1-5f765a/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b8fb7aae7cac121f592817a5e9754983e04e46d9e4226183153bf83b778fffdd\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"b288a64704f96ac78878f6909232d8598eef54cca0d7adc2629cac87b6802414\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/premium-w1-5f765a/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9f6fc629fa43de74b0fb261de7e8b46fbdfe4f21235446879cd916210856d6f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"3345e3b0c95bd559e9c6ce41f622270b0d9eed1deb3d862eb2d4fad368905626\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/premium-w1-5f765a/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"719394d8154dd624eedc306180a33baa4128531f223bc2727d0376601dd634f6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"94c5946d9d9c3cc245ba073b8c7a87c64029cba185e4d624d2145ef119722e87\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/simulator-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4139e076413d5d9d1fd2b594b83d854cc771dfa28886f3f67439ec043220dd9f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"0b53b3ab98bfc66b662cb3ccde6535694ee9e681e165e011925491f011e74e55\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"505545a95fce131db80f848e9990387e6b3e42a2f7e2375f56bbc07efcac9723\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"3f3727d24e2cdb2256f9ce1aa9d7daf02e123ff83dd7745a54bf0be968b8f9fd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/premium-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9112a3b536f3eb5f79a5b52d0ee8a7a26d3700b295f3ce2775128d2841f01ff4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"f08d8256a9bbcb38779e30702529b4c292d4f2775e4ae9817b47fa8337570bcb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0768841c9057075fe648e2fa67028e1fc0bee839efdd3e78e081dac6a9e13397\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"2e7b2a851ead1f1cbcc5f6106eac7e445acafba2c4c4ad4a5a56639d6af03796\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9178bfcf79bd6f1164069b245bef389ffaa38dddce2763e94a3e39d83454aa7f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"2e3472e08ab25f673a6a47899dd2756fa7246fcafa45a33d1cfbd451f1a6da2b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"106dc24382c96b56f69df1e4bfaa0455678809d57faded1081bc4e26a642d4a0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"922243bc7c6610ec5ba0285d821a4e92cf6386c7e495914f5a3fe8f9160a0647\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0b8fd96f5e30886bce6ea837ac57b2f3d77783c525b1de469227d248ca2a1d6e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"9ad77601cac881a53e95a12cc3d1e21e0beee1d4e9757eaa68fbb36f70dbe5e2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e1e7c7c242c339c99da1caa3f217a7bd53ffc78a71bee9a0e898d1f0b8471fb3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"00a6f26194c6932f8037cd0201f950c67a9b8fbee2e5ed3817f9a97812c711c2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c4c89ab332c30b38dc4f16ef73fecdbd0ef26ff23424b1e8fd0d18c2d45cf73d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"892cea79034a9b0e44e5d14d2ace5c60fa5e183f87a7ffb536724af7425a469d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9d278f3acef96193a8d6a95bb17fda6beacb6c6949e61147bbb0a9f984d383ca\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"c89ebfbf5d6c50d68e0202a4a7f2450fb6de7656dcb639d8a2d40d475718ebc7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f7254b99580aca11d813d05cebe8fd0d083eab4978ed55c24131cbd3917e5e39\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"a5339e879056a8880ff59d0bd2b4a470fa93075d67e5851ae7b49fba2bef41e6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a2866a5a08cd0abaabb645c82aff8b6635fdbd34410a7b092e32a8b164086e19\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-5f765a\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-5f765a\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"cc60bc0276d07b9216150b4bc6b21e75f85bf16c7cf27ea44774f135d5d03080\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b651c6e6a372a592c9723851c4377c52eae8778a18d51a17e65b611b0b04e077\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-5f765a\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-5f765a\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"3c78a568a81450298f63da5aa6923258e0adf684426ab83ceb35e01cf96e31be\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e206eae15f3c87b50ca80d04704d63fdf1ea76a805ec0dff6aaf8552207a1be8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-5f765a\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-5f765a\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"2b06fb39c490ea09b70252ff358244737d19e14a20470f0c43270d8a8d663698\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2ce874ebffdc76810fc3c080f4a7068ce8f4e9a05d63e70150e7fc6ef281b797\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-5f765a\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-5f765a\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"4ea6ce64f8c082ae7ad14a6cda98b463639b3ce9f3c1fb4c0f89d8e025314dd5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a2db302be0c4963be9b2d68075376d29342d2e854fa4746701662a56823b450e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-5f765a\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-5f765a\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"c252574ae7fb8eaff36f49460a23a178a025ecce5b05cd990eb6d87e58fc178a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b6a8f91d1ffdf775c75f2a1c84bb520696572aea4d3ece8ed9123766f347b2eb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"7edb3db3dee9ba3102857080aca6e9bec53bbe738951ad9a83ba0cb19f036f1e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/simulator-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"eadff6644620dd26a92e8dd1076b97db8fef2224eb03b70ce4e7ee1ef8dc0b30\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"41b87dde831c23a98bbe55369e4882c3bfbc1b8dcecce6cd22b590fe3e2fd450\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/premium-w1-5f765a')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-worker-w1-5f765a"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-worker-w1-5f765a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:24:23.422Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route#v1-messages-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"c4c89ab332c30b38dc4f16ef73fecdbd0ef26ff23424b1e8fd0d18c2d45cf73d","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["c4c89ab332c30b38dc4f16ef73fecdbd0ef26ff23424b1e8fd0d18c2d45cf73d"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-5f765a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-5f765a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"c4c89ab332c30b38dc4f16ef73fecdbd0ef26ff23424b1e8fd0d18c2d45cf73d\" already exists"}
{"level":"error","ts":"2026-11-02T21:24:23.489Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route#v1-catch-all-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"f7254b99580aca11d813d05cebe8fd0d083eab4978ed55c24131cbd3917e5e39","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f7254b99580aca11d813d05cebe8fd0d083eab4978ed55c24131cbd3917e5e39"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-5f765a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-5f765a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"f7254b99580aca11d813d05cebe8fd0d083eab4978ed55c24131cbd3917e5e39\" already exists"}
{"level":"error","ts":"2026-11-02T21:24:23.557Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"eadff6644620dd26a92e8dd1076b97db8fef2224eb03b70ce4e7ee1ef8dc0b30","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["eadff6644620dd26a92e8dd1076b97db8fef2224eb03b70ce4e7ee1ef8dc0b30"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-5f765a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-5f765a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"eadff6644620dd26a92e8dd1076b97db8fef2224eb03b70ce4e7ee1ef8dc0b30\" already exists"}
{"level":"error","ts":"2026-11-02T21:24:23.635Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route#v1-model-routing"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"db6f9ff18eeb49f1421400a53d101cb100b1a88466190b46fb6dbed22a42e073","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["db6f9ff18eeb49f1421400a53d101cb100b1a88466190b46fb6dbed22a42e073"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-5f765a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-5f765a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"db6f9ff18eeb49f1421400a53d101cb100b1a88466190b46fb6dbed22a42e073\" already exists"}
{"level":"error","ts":"2026-11-02T21:24:23.707Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"2aaf9242e876623422852fe471269a2d268f4d784b14c7ab37ec9f34c17f3060","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["2aaf9242e876623422852fe471269a2d268f4d784b14c7ab37ec9f34c17f3060"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-5f765a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-5f765a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"2aaf9242e876623422852fe471269a2d268f4d784b14c7ab37ec9f34c17f3060\" already exists"}
{"level":"error","ts":"2026-11-02T21:24:23.768Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-worker-w3-f51151","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T21:21:31Z","generation":5,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"8871137c-7f6a-401d-a6db-2983aea5ba22\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:24:05Z"}],"name":"kuadrant-e2e-worker-w3-f51151","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-worker-w3-f51151","uid":"8871137c-7f6a-401d-a6db-2983aea5ba22"}],"resourceVersion":"30898","uid":"c24c0550-6758-4dca-8d2b-3fe32740d122"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a05d7e315cc7cde173ab18a777672d3a18ce0a96f8f52d505404dcf8d1e51c20\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"0b1f2a741c3b01e8\\\" || auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"0b1f2a741c3b01e8\\\" || auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"0e7c31c41adb0d3f9efc929ae631573fe0c783a2fa7edb7a4b135081c2969bbf\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6c73e108ce3d5ef8ece11651aca73aa00bd88530b6aba861d23ca7b6ff89ba5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"aedbd7ef0308fd9494e9a3a1386b732923d5d060acf5a188601898d4867d320f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a05d7e315cc7cde173ab18a777672d3a18ce0a96f8f52d505404dcf8d1e51c20\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"0b1f2a741c3b01e8\\\" || auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"0b1f2a741c3b01e8\\\" || auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"ec8a1b6bbf984a67cda63e2d923bfa9d2d66a7537f676f6198c12cbca9103517\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6c73e108ce3d5ef8ece11651aca73aa00bd88530b6aba861d23ca7b6ff89ba5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"5c9b9ac2bc33c747eb54045ee2511e3c8b2ee9737a3f347afb75903f43d74fb7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a05d7e315cc7cde173ab18a777672d3a18ce0a96f8f52d505404dcf8d1e51c20\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"0b1f2a741c3b01e8\\\" || auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"0b1f2a741c3b01e8\\\" || auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"a54bd689e670e5f8bbee0a66c2585a4d4adce9a5a7fc297449ee3b816a0c2695\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6c73e108ce3d5ef8ece11651aca73aa00bd88530b6aba861d23ca7b6ff89ba5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"ad845c31a125851bf4cc5ae7e83bb4a011cf98484d99780ab16df250ca9dd41c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a05d7e315cc7cde173ab18a777672d3a18ce0a96f8f52d505404dcf8d1e51c20\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"0b1f2a741c3b01e8\\\" || auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"0b1f2a741c3b01e8\\\" || auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"6d5d9aca320022f0f8b70c3f9b34b5922adf537f5da717ec79924566febf6df1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6c73e108ce3d5ef8ece11651aca73aa00bd88530b6aba861d23ca7b6ff89ba5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"346e75cab49a1cf8ae89d90cfb32099256f44d7909e40cdc730e951946a411e2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a05d7e315cc7cde173ab18a777672d3a18ce0a96f8f52d505404dcf8d1e51c20\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"0b1f2a741c3b01e8\\\" || auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"0b1f2a741c3b01e8\\\" || auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"3f6b6643d5731a355a44968b83b24169ff3e0c1b36737d8be7f9d42e1def7c3e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6c73e108ce3d5ef8ece11651aca73aa00bd88530b6aba861d23ca7b6ff89ba5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"cd8ab5f89e71494c8d176f9668b8ed279bd244e6f70d1a5c87603877b4b7182d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a05d7e315cc7cde173ab18a777672d3a18ce0a96f8f52d505404dcf8d1e51c20\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"0b1f2a741c3b01e8\\\" || auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"0b1f2a741c3b01e8\\\" || auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"e00f3dfbbce60a718137b415a42cbf1e65a7b226437cc4600d9fa76b264e3b4d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a05d7e315cc7cde173ab18a777672d3a18ce0a96f8f52d505404dcf8d1e51c20\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"0b1f2a741c3b01e8\\\" || auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"0b1f2a741c3b01e8\\\" || auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"7ddf0d6bdcfc6aa206cdc0919b1d5b7545c903aafbb0e16d393016b1a83bd29a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6c73e108ce3d5ef8ece11651aca73aa00bd88530b6aba861d23ca7b6ff89ba5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"fe3b37fdd5d3f9d3bdf7d03b186d964b283bfbe7d3ffa720457517666c3070a2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6c73e108ce3d5ef8ece11651aca73aa00bd88530b6aba861d23ca7b6ff89ba5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"7dd9491b4755b4900c5bc55b4dd9aff38f99899f0236e4d21bf7c94e5769cbb1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a05d7e315cc7cde173ab18a777672d3a18ce0a96f8f52d505404dcf8d1e51c20\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"0b1f2a741c3b01e8\\\" || auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"0b1f2a741c3b01e8\\\" || auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"a00edc25239da061cd0457625d6046ede5f9d09507c78c2209e1e992795831c9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6c73e108ce3d5ef8ece11651aca73aa00bd88530b6aba861d23ca7b6ff89ba5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"fbd557cfa232fb43236e5864400cd1522fbf21d014450df4a714ea2d3608e863\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b31ddb7ef02e35e9d172430b50a004a3047564232880010bd3e581bf0dc547f8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"a1ec0f0592798b3996117a17734b0936906621077ceec69c81d8fb77e89a142a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"72bb4e3923485ca35015ee8655bc43ee332eea77f2cd8effbd48b21828f89f80\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"0b1f2a741c3b01e8\\\" || auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"0b1f2a741c3b01e8\\\" || auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"879fe62fbbe8b0a130140cda7f546611c758fb8fa416f173d2b0cf3da17d7941\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f9603ac54a5668b179c6ba3dcda3951e57253a5ad5ad80214b563f50337f3a9c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"7caf859dfb9739029a8c1b13adba06164610495beddbda8e01fd7b432b15f4c3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6ab1b21b6f75f2c1ef86f9bcf36a6c25244e88430832e3ac86a839cf10bb8dcd\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"0b1f2a741c3b01e8\\\" || auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"0b1f2a741c3b01e8\\\" || auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"15ecb8224cf6049c2e831c815cc4f0aed954432b967d01d55ea637294f3ea87e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a6267fc785126adca5b68df13f95ef1fa08e1d72b66fbff01b54f8d61edaf7ba\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"0b1f2a741c3b01e8\\\" || auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"0b1f2a741c3b01e8\\\" || auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"9a72bfcef40a8da2865b02b6123c023d9f4f17c11a2ff674e3ed24af23e468e2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a6d41f4e9f57ec1e6bb4423e49991033d85f00a2a3303e02b25d1eedb67be3c9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"ad4137b1e753fd100088742941c8aaee9eaddc158bbaf221eb0d7318bdb8dfb5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aea6441051c6a7490e44d5f7bab0e4bf7cf461c9597675611789e8d9141a446c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"0b1f2a741c3b01e8\\\" || auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"0b1f2a741c3b01e8\\\" || auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"c871ffab27f7ed925d56fae005e70fd3716aab799f0484d7d44519e915491d11\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7f4456bc894bf7ab59ba02c25915a8db007a89ffdd1efcace437a7761c68b3f9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"aedfea0f1dceed2b1af07ebf6e7dbc55cdc958ea5a084291f6216a19f63eae8a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c57cda59d33d438c637a64dce8619a9616880a275363557ccc83d2cbc4920e14\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"1a3df8e6f6ad36c3eb928970ca2e746005e16b25405fc6eb9f44977b07d56905\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f1def6d908410a124665ecd632ae01e5ba977920643dab1a35d25277292bae55\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"0b1f2a741c3b01e8\\\" || auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"0b1f2a741c3b01e8\\\" || auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"1199947fd30f0d1dab3db5846b8d27e36b6284be94834b798e4004120ec52532\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d63de28626482cf5fa2aaf12cb9aa3def86d637d4c98f193819331c36fa73b21\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"0b1f2a741c3b01e8\\\" || auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"0b1f2a741c3b01e8\\\" || auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"fae01409c891b630fc644ebf1b8bc640438a1fc79de2b0750d34e2a6388d4ca6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f86615df74e8d3814df8817b06dc7578a4b0af0817397c5bdddb1daaaeb1df4e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"2d972852e655bb76327ea47e134854d589cf64538813171d00544a81dc138f4f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"06c1a51758821d18e14577dc995b939fe472579672223b3bf0c1a312b23f23c4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"a90d5652afa4bbc65c24ada88ebb0df97a9c759ab0004d0c85d28f7e4c012bb9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/premium-w3-f51151/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7b5f8cd8dfbddc7109fd206805e23a6ae21c18bf406c0001927759ff1a39122f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"0b1f2a741c3b01e8\\\" || auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"0b1f2a741c3b01e8\\\" || auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"64238089f4803f45c8353b0d5d05ac6a23d6a3647106591fdc2bd5299c0b0759\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cb9167704c77a112808785ad099bc015c57786c61e7befec251b029ce378a0c6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"0b1f2a741c3b01e8\\\" || auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"0b1f2a741c3b01e8\\\" || auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"ef8b5b3a53f3de47fd70ccb56be2422e84d7fb1f10a03b64c032baca50a33c79\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9a4beabc5e6770b1db0aae064836730685e70fcacd601193f69aafe8156d41a4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"667e44e20cda74056b10928af7322c52f17d044dda1b5aded34df466201c3e4d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/premium-w3-f51151/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"91d11ef27666b7f1f85063266e00a4add2242586a1e8a4bac5447b3f4ec7925d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"0b1f2a741c3b01e8\\\" || auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"0b1f2a741c3b01e8\\\" || auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"26827917812d006281f7f7ba6e53d3573012708364624693432b2cbdd0f434b5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"707f7a9a5bb373d466ca8ba9e6220842edd61bdf74768cdb8760aca4648a21b3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"b90f395e8ebaa67a3ab9ee2a967d88bbf981033415dedacddf2e76a8347bfd39\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/premium-w3-f51151/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ab3c6da9622dba177dfaf10df58f987a09c5bd12e35f73cca3f03ce632140cd4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"9ec2510ba7c20be712eae31e88eb54985eedbb6ce61783804c05db0582107bc2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/premium-w3-f51151/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d896bcdf40d08e0bef242ce04aa58467e96c672450af890adda6941c53a574d3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"0b1f2a741c3b01e8\\\" || auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"0b1f2a741c3b01e8\\\" || auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"69bd1c4b3e1b36f5d5d62283b221b7026a4e53da339ac7c470f75cb4334435f6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3fdafb69d9c72b7e3c78e50b30f01adec907957097c6a1e811ceff68d93d7c23\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"a31568314e38d20d12f5921c57463100edd3022d5f9f3c0b36033d9a4dee9193\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e11ba50523ae86c5c06c5b76176154ed9ba57c3ed13fa43133b1ac7249ce345f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"67192e2ead59827b5990f7b4cbc2aece4271402ddcdfaa76f7cf95d2d4552c43\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b6344fa6f672d55d2eb4fbf6449de24a41dbf664f8e9d3c01ecde50e9d46e233\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"3c429336b45d9712bfdb0d99ecd41baa0dde1570067b941b5927e1894931c254\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d1f3365185f5fcfe92899c5f49af1b579baab97128b8afee3eed4350859c3f14\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"2f17c508c987cffd0b45ebd164fcee3ad66819a39900f83fbeda518ccf619183\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"85124e62247f9234752fedfc382ba93d6f839dab53f49c16951446afa3e613aa\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"6d2c4320e5eae8e51596e1c62f1c7494e1c5f9cd5d374e73b3ddae65dd071a92\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"461f0fb3ed9e91195eaa488b65b6f04cb4bff62087edbcf0d4c2186d180ba0ab\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"994b30d96390325263d89c2da7554eadd9d4fd1811371afabaf057df68e19205\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d13670b5b1696edcb191c925fa86dd729eeb7447f2230e160d9cc03e0117604d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"0b1f2a741c3b01e8\\\" || auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"0b1f2a741c3b01e8\\\" || auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"f70585dfa8966b9748a8978bfdf51d589a9d85f553359b47bfa09ad8bb266b02\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"18b02d50add3a7c29ec6127eedab648f22d172b48224a97365a7798a612dcd01\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"1e0c9c02fbbf3d69df4286ba8224f5543dfc90c1df5aa687b5b6f1c00dce4d56\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-worker-w3-f51151"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-worker-w3-f51151\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:24:23.774Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route#v1-responses-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"e1e7c7c242c339c99da1caa3f217a7bd53ffc78a71bee9a0e898d1f0b8471fb3","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["e1e7c7c242c339c99da1caa3f217a7bd53ffc78a71bee9a0e898d1f0b8471fb3"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-5f765a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-5f765a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"e1e7c7c242c339c99da1caa3f217a7bd53ffc78a71bee9a0e898d1f0b8471fb3\" already exists"}
{"level":"error","ts":"2026-11-02T21:24:23.844Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route#v1-chat-completions-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"9112a3b536f3eb5f79a5b52d0ee8a7a26d3700b295f3ce2775128d2841f01ff4","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["9112a3b536f3eb5f79a5b52d0ee8a7a26d3700b295f3ce2775128d2841f01ff4"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-5f765a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-5f765a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"9112a3b536f3eb5f79a5b52d0ee8a7a26d3700b295f3ce2775128d2841f01ff4\" already exists"}
{"level":"error","ts":"2026-11-02T21:24:23.911Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route#v1-responses-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"b8fb7aae7cac121f592817a5e9754983e04e46d9e4226183153bf83b778fffdd","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["b8fb7aae7cac121f592817a5e9754983e04e46d9e4226183153bf83b778fffdd"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-5f765a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-5f765a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"b8fb7aae7cac121f592817a5e9754983e04e46d9e4226183153bf83b778fffdd\" already exists"}
{"level":"error","ts":"2026-11-02T21:24:24.090Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-worker-w0-0c9014-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-worker-w0-0c9014-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:24:24.290Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-worker-w1-5f765a-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-worker-w1-5f765a-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:24:24.383Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w3-f51151","namespace":"e2e-models-e2e-worker-w3-f51151","uid":"e3340067-224a-43ad-8020-ca9e00ead152","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w3-f51151\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:24:24.417Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-worker-w2-6fa533-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-worker-w2-6fa533-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:24:24.737Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:24:24.737Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T21:24:24.807Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"premium-w1-5f765a-kserve-route","namespace":"e2e-models-e2e-worker-w1-5f765a","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"premium-w1-5f765a-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:24:32.587Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthPolicy","AuthConfig","EnvoyFilter","ConfigMap","TokenRateLimitPolicy","HTTPRoute","Limitador"],"eventTypes":{"create":12,"update":9}}
{"level":"info","ts":"2026-11-02T21:24:32.766Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:24:33.341Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:24:33.558Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:24:33.558Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:24:34.469Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:24:34.472Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:24:34.478Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:24:34.535Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:24:34.535Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:24:34.535Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:24:34.588Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T21:24:35.470Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w4-d6cb38","namespace":"e2e-models-e2e-worker-w4-d6cb38","uid":"486176e6-7786-40c4-9ce0-6f4a68b408b2","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w4-d6cb38\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:24:35.545Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-worker-w2-6fa533-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-worker-w2-6fa533-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:24:35.884Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w3-f51151","namespace":"e2e-models-e2e-worker-w3-f51151","uid":"e3340067-224a-43ad-8020-ca9e00ead152","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w3-f51151\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:24:35.941Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w0-0c9014","namespace":"e2e-models-e2e-worker-w0-0c9014","uid":"4f647df6-1d5b-433b-b4fc-1279ff1755f7","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w0-0c9014\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:24:36.239Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:24:36.240Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:24:36.889Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy"],"eventTypes":{"update":1}}
{"level":"info","ts":"2026-11-02T21:24:38.576Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:24:38.580Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:24:38.580Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:24:38.582Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"error","ts":"2026-11-02T21:24:38.640Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:24:38.640Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T21:24:39.379Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-worker-w3-f51151","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T21:21:31Z","generation":6,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"8871137c-7f6a-401d-a6db-2983aea5ba22\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:24:19Z"}],"name":"kuadrant-e2e-worker-w3-f51151","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-worker-w3-f51151","uid":"8871137c-7f6a-401d-a6db-2983aea5ba22"}],"resourceVersion":"31293","uid":"c24c0550-6758-4dca-8d2b-3fe32740d122"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a05d7e315cc7cde173ab18a777672d3a18ce0a96f8f52d505404dcf8d1e51c20\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"0e7c31c41adb0d3f9efc929ae631573fe0c783a2fa7edb7a4b135081c2969bbf\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6c73e108ce3d5ef8ece11651aca73aa00bd88530b6aba861d23ca7b6ff89ba5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"aedbd7ef0308fd9494e9a3a1386b732923d5d060acf5a188601898d4867d320f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a05d7e315cc7cde173ab18a777672d3a18ce0a96f8f52d505404dcf8d1e51c20\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"ec8a1b6bbf984a67cda63e2d923bfa9d2d66a7537f676f6198c12cbca9103517\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6c73e108ce3d5ef8ece11651aca73aa00bd88530b6aba861d23ca7b6ff89ba5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"5c9b9ac2bc33c747eb54045ee2511e3c8b2ee9737a3f347afb75903f43d74fb7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a05d7e315cc7cde173ab18a777672d3a18ce0a96f8f52d505404dcf8d1e51c20\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"a54bd689e670e5f8bbee0a66c2585a4d4adce9a5a7fc297449ee3b816a0c2695\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6c73e108ce3d5ef8ece11651aca73aa00bd88530b6aba861d23ca7b6ff89ba5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"ad845c31a125851bf4cc5ae7e83bb4a011cf98484d99780ab16df250ca9dd41c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a05d7e315cc7cde173ab18a777672d3a18ce0a96f8f52d505404dcf8d1e51c20\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"6d5d9aca320022f0f8b70c3f9b34b5922adf537f5da717ec79924566febf6df1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6c73e108ce3d5ef8ece11651aca73aa00bd88530b6aba861d23ca7b6ff89ba5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"346e75cab49a1cf8ae89d90cfb32099256f44d7909e40cdc730e951946a411e2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a05d7e315cc7cde173ab18a777672d3a18ce0a96f8f52d505404dcf8d1e51c20\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"3f6b6643d5731a355a44968b83b24169ff3e0c1b36737d8be7f9d42e1def7c3e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6c73e108ce3d5ef8ece11651aca73aa00bd88530b6aba861d23ca7b6ff89ba5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"cd8ab5f89e71494c8d176f9668b8ed279bd244e6f70d1a5c87603877b4b7182d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a05d7e315cc7cde173ab18a777672d3a18ce0a96f8f52d505404dcf8d1e51c20\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"e00f3dfbbce60a718137b415a42cbf1e65a7b226437cc4600d9fa76b264e3b4d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a05d7e315cc7cde173ab18a777672d3a18ce0a96f8f52d505404dcf8d1e51c20\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"7ddf0d6bdcfc6aa206cdc0919b1d5b7545c903aafbb0e16d393016b1a83bd29a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6c73e108ce3d5ef8ece11651aca73aa00bd88530b6aba861d23ca7b6ff89ba5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"fe3b37fdd5d3f9d3bdf7d03b186d964b283bfbe7d3ffa720457517666c3070a2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6c73e108ce3d5ef8ece11651aca73aa00bd88530b6aba861d23ca7b6ff89ba5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"7dd9491b4755b4900c5bc55b4dd9aff38f99899f0236e4d21bf7c94e5769cbb1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a05d7e315cc7cde173ab18a777672d3a18ce0a96f8f52d505404dcf8d1e51c20\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"a00edc25239da061cd0457625d6046ede5f9d09507c78c2209e1e992795831c9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6c73e108ce3d5ef8ece11651aca73aa00bd88530b6aba861d23ca7b6ff89ba5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"fbd557cfa232fb43236e5864400cd1522fbf21d014450df4a714ea2d3608e863\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b31ddb7ef02e35e9d172430b50a004a3047564232880010bd3e581bf0dc547f8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"a1ec0f0592798b3996117a17734b0936906621077ceec69c81d8fb77e89a142a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"72bb4e3923485ca35015ee8655bc43ee332eea77f2cd8effbd48b21828f89f80\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"879fe62fbbe8b0a130140cda7f546611c758fb8fa416f173d2b0cf3da17d7941\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f9603ac54a5668b179c6ba3dcda3951e57253a5ad5ad80214b563f50337f3a9c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"7caf859dfb9739029a8c1b13adba06164610495beddbda8e01fd7b432b15f4c3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6ab1b21b6f75f2c1ef86f9bcf36a6c25244e88430832e3ac86a839cf10bb8dcd\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"15ecb8224cf6049c2e831c815cc4f0aed954432b967d01d55ea637294f3ea87e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a6267fc785126adca5b68df13f95ef1fa08e1d72b66fbff01b54f8d61edaf7ba\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"9a72bfcef40a8da2865b02b6123c023d9f4f17c11a2ff674e3ed24af23e468e2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a6d41f4e9f57ec1e6bb4423e49991033d85f00a2a3303e02b25d1eedb67be3c9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"ad4137b1e753fd100088742941c8aaee9eaddc158bbaf221eb0d7318bdb8dfb5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aea6441051c6a7490e44d5f7bab0e4bf7cf461c9597675611789e8d9141a446c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"c871ffab27f7ed925d56fae005e70fd3716aab799f0484d7d44519e915491d11\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7f4456bc894bf7ab59ba02c25915a8db007a89ffdd1efcace437a7761c68b3f9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"aedfea0f1dceed2b1af07ebf6e7dbc55cdc958ea5a084291f6216a19f63eae8a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c57cda59d33d438c637a64dce8619a9616880a275363557ccc83d2cbc4920e14\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"1a3df8e6f6ad36c3eb928970ca2e746005e16b25405fc6eb9f44977b07d56905\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f1def6d908410a124665ecd632ae01e5ba977920643dab1a35d25277292bae55\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"1199947fd30f0d1dab3db5846b8d27e36b6284be94834b798e4004120ec52532\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d63de28626482cf5fa2aaf12cb9aa3def86d637d4c98f193819331c36fa73b21\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"fae01409c891b630fc644ebf1b8bc640438a1fc79de2b0750d34e2a6388d4ca6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f86615df74e8d3814df8817b06dc7578a4b0af0817397c5bdddb1daaaeb1df4e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"2d972852e655bb76327ea47e134854d589cf64538813171d00544a81dc138f4f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"06c1a51758821d18e14577dc995b939fe472579672223b3bf0c1a312b23f23c4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"a90d5652afa4bbc65c24ada88ebb0df97a9c759ab0004d0c85d28f7e4c012bb9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/premium-w3-f51151/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7b5f8cd8dfbddc7109fd206805e23a6ae21c18bf406c0001927759ff1a39122f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"64238089f4803f45c8353b0d5d05ac6a23d6a3647106591fdc2bd5299c0b0759\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cb9167704c77a112808785ad099bc015c57786c61e7befec251b029ce378a0c6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"ef8b5b3a53f3de47fd70ccb56be2422e84d7fb1f10a03b64c032baca50a33c79\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9a4beabc5e6770b1db0aae064836730685e70fcacd601193f69aafe8156d41a4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"667e44e20cda74056b10928af7322c52f17d044dda1b5aded34df466201c3e4d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/premium-w3-f51151/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"91d11ef27666b7f1f85063266e00a4add2242586a1e8a4bac5447b3f4ec7925d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"26827917812d006281f7f7ba6e53d3573012708364624693432b2cbdd0f434b5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"707f7a9a5bb373d466ca8ba9e6220842edd61bdf74768cdb8760aca4648a21b3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"b90f395e8ebaa67a3ab9ee2a967d88bbf981033415dedacddf2e76a8347bfd39\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/premium-w3-f51151/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ab3c6da9622dba177dfaf10df58f987a09c5bd12e35f73cca3f03ce632140cd4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"9ec2510ba7c20be712eae31e88eb54985eedbb6ce61783804c05db0582107bc2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/premium-w3-f51151/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d896bcdf40d08e0bef242ce04aa58467e96c672450af890adda6941c53a574d3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"69bd1c4b3e1b36f5d5d62283b221b7026a4e53da339ac7c470f75cb4334435f6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3fdafb69d9c72b7e3c78e50b30f01adec907957097c6a1e811ceff68d93d7c23\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"a31568314e38d20d12f5921c57463100edd3022d5f9f3c0b36033d9a4dee9193\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e11ba50523ae86c5c06c5b76176154ed9ba57c3ed13fa43133b1ac7249ce345f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"67192e2ead59827b5990f7b4cbc2aece4271402ddcdfaa76f7cf95d2d4552c43\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b6344fa6f672d55d2eb4fbf6449de24a41dbf664f8e9d3c01ecde50e9d46e233\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"3c429336b45d9712bfdb0d99ecd41baa0dde1570067b941b5927e1894931c254\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d1f3365185f5fcfe92899c5f49af1b579baab97128b8afee3eed4350859c3f14\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"2f17c508c987cffd0b45ebd164fcee3ad66819a39900f83fbeda518ccf619183\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"85124e62247f9234752fedfc382ba93d6f839dab53f49c16951446afa3e613aa\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"6d2c4320e5eae8e51596e1c62f1c7494e1c5f9cd5d374e73b3ddae65dd071a92\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"461f0fb3ed9e91195eaa488b65b6f04cb4bff62087edbcf0d4c2186d180ba0ab\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"994b30d96390325263d89c2da7554eadd9d4fd1811371afabaf057df68e19205\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d13670b5b1696edcb191c925fa86dd729eeb7447f2230e160d9cc03e0117604d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"f70585dfa8966b9748a8978bfdf51d589a9d85f553359b47bfa09ad8bb266b02\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"18b02d50add3a7c29ec6127eedab648f22d172b48224a97365a7798a612dcd01\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"1e0c9c02fbbf3d69df4286ba8224f5543dfc90c1df5aa687b5b6f1c00dce4d56\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-worker-w3-f51151"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-worker-w3-f51151\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:24:39.803Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w0-0c9014","namespace":"e2e-models-e2e-worker-w0-0c9014","uid":"4f647df6-1d5b-433b-b4fc-1279ff1755f7","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w0-0c9014\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:24:40.038Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w3-f51151","namespace":"e2e-models-e2e-worker-w3-f51151","uid":"e3340067-224a-43ad-8020-ca9e00ead152","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w3-f51151\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:24:40.215Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w4-d6cb38","namespace":"e2e-models-e2e-worker-w4-d6cb38","uid":"486176e6-7786-40c4-9ce0-6f4a68b408b2","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w4-d6cb38\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:24:48.272Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthPolicy","ConfigMap","TokenRateLimitPolicy","EnvoyFilter","Limitador"],"eventTypes":{"create":4,"update":8}}
{"level":"info","ts":"2026-11-02T21:24:48.398Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:24:48.827Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:24:48.935Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:24:48.935Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:24:50.027Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:24:50.027Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:24:50.030Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:24:50.031Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:24:50.033Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:24:50.033Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-02T21:24:50.138Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:24:50.138Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T21:24:54.955Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w4-d6cb38","namespace":"e2e-models-e2e-worker-w4-d6cb38","uid":"486176e6-7786-40c4-9ce0-6f4a68b408b2","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w4-d6cb38\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:24:55.619Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:24:55.619Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:24:56.216Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy"],"eventTypes":{"update":2}}
{"level":"info","ts":"2026-11-02T21:24:57.841Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:24:57.844Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:24:57.845Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:24:57.845Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-02T21:24:57.902Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:24:57.902Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T21:24:58.286Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-worker-w1-5f765a","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T21:22:08Z","generation":3,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"4caf3c5b-8145-48de-a05b-6a1b9a102f00\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:24:19Z"}],"name":"kuadrant-e2e-worker-w1-5f765a","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-worker-w1-5f765a","uid":"4caf3c5b-8145-48de-a05b-6a1b9a102f00"}],"resourceVersion":"31304","uid":"fb3e4914-c809-4feb-81f5-a0a468b56725"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bcf0aab5299349f1dd1df89a10a558ad5617afdfb0f30d972811f3dbb51b1ea5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]}],\"name\":\"f2c753e74bbc5983406d967abd1143e62400e0f08a2e36f6ffa42c06a3a6974c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/simulator-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"db6f9ff18eeb49f1421400a53d101cb100b1a88466190b46fb6dbed22a42e073\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]}],\"name\":\"eedd7a1bac5c7747d7137dccbdafefbc4f76edb1acf806e0399e7d01c0c93443\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/premium-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bcf0aab5299349f1dd1df89a10a558ad5617afdfb0f30d972811f3dbb51b1ea5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]}],\"name\":\"76a34f19bf7079dd4104caff1731257297b843b61401a91d00b1a27ccab63fd7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/simulator-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"db6f9ff18eeb49f1421400a53d101cb100b1a88466190b46fb6dbed22a42e073\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]}],\"name\":\"263fa7af352a917ec5f565f1287ed3339005bf0c3ba787dcb8a5e539d84cfaff\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/premium-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bcf0aab5299349f1dd1df89a10a558ad5617afdfb0f30d972811f3dbb51b1ea5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]}],\"name\":\"3451d924df135b44fe4e7857db1417971e78cee0d322dc55f2d9dcfc1a98438c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/simulator-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"db6f9ff18eeb49f1421400a53d101cb100b1a88466190b46fb6dbed22a42e073\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]}],\"name\":\"c12741fd641c86bf88bbd47e58d2e5d62933e3e0f320cf13ec7d52df7a394c29\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/premium-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bcf0aab5299349f1dd1df89a10a558ad5617afdfb0f30d972811f3dbb51b1ea5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]}],\"name\":\"70ba0b522bbd69a6ed9f77952d20b92d482b03854cc92dbb7d522bd33335c96d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/simulator-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"db6f9ff18eeb49f1421400a53d101cb100b1a88466190b46fb6dbed22a42e073\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]}],\"name\":\"65d2403634b5ea32b46b6ea0b85de94e33a3af4a2416095b99fbdb18350add91\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/premium-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bcf0aab5299349f1dd1df89a10a558ad5617afdfb0f30d972811f3dbb51b1ea5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]}],\"name\":\"ba40310e6c4dc6ab4a0b4c712eda89883762afc9beb70d4b7c23b27f69b9ab49\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/simulator-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"db6f9ff18eeb49f1421400a53d101cb100b1a88466190b46fb6dbed22a42e073\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]}],\"name\":\"bd657b2cf110d146eb81bf7b91f3184e0028cf98e5195ef2ddb8f508863741de\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/premium-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bcf0aab5299349f1dd1df89a10a558ad5617afdfb0f30d972811f3dbb51b1ea5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]}],\"name\":\"d637ac7d402bcd26ac6f88370d996d05abc8c7982ed2c2cc4095675044806a8e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/simulator-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bcf0aab5299349f1dd1df89a10a558ad5617afdfb0f30d972811f3dbb51b1ea5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]}],\"name\":\"30abcde41a2149187abd00b7dbf1da4982d5f53b5da1288f5b95a0d579abbd6a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/simulator-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"db6f9ff18eeb49f1421400a53d101cb100b1a88466190b46fb6dbed22a42e073\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]}],\"name\":\"e253a93d7a1e997f4ec04774e63bac26b7573119884a469fa9cadfdd694f2c86\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/premium-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"db6f9ff18eeb49f1421400a53d101cb100b1a88466190b46fb6dbed22a42e073\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]}],\"name\":\"857e58268f515ca3e78ba5dd4b121c1c64a1556ffa6fb72ca451501f13fd956c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/premium-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bcf0aab5299349f1dd1df89a10a558ad5617afdfb0f30d972811f3dbb51b1ea5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]}],\"name\":\"c06ce02686be6c949fde11dd46005249ce969a6a4cd5979e062f2fd0e328306e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/simulator-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"db6f9ff18eeb49f1421400a53d101cb100b1a88466190b46fb6dbed22a42e073\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]}],\"name\":\"a5c2e2f330e8d4b7f1cc2fd43eb290bf161724714abfed900324fd2909e2a064\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/premium-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fa1a008e4957943b0d2d9d600bd19dafc0caa0b522e5c1d1e09ecc5d82a64f4c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-5f765a\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-5f765a\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"b218feb88b60257514445a8b1d44e3ab1edb938de3bc6d6fdb02ef04222c6dcb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"58ba249888c7ebfedfcb5aec9df19d4b07d2856710ac2163dcc961a176311fa9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]}],\"name\":\"4d61c78710f351b5667f692e1f8792c5724b52f7fc998511134665312fdd896f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/simulator-w1-5f765a/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2aaf9242e876623422852fe471269a2d268f4d784b14c7ab37ec9f34c17f3060\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]}],\"name\":\"f201dec897e559ed36b9a30f0bbf86c43aae129e674ef36595083bda93e4b839\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/premium-w1-5f765a/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c19827aa458f939a86c4dbefda3dabc4f554898dbb7e2f92b488060e9e90b5cc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]}],\"name\":\"6d546403540eabf244c73a602659986050165bca90bc795de701a61411a1c48e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/simulator-w1-5f765a/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"784ccec783ba11c98817fe5af2849f9f4970be19046e351a067c85add913f548\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]}],\"name\":\"9327d3b7df136b8c0fed4aaa35057ac8d1022305472875ccc8c55a524105fb1a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/simulator-w1-5f765a/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"beb0d5e916dc078abcaba4ea5b4d8012d5c2d8edfd07ca54d585bfe44d7c605a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]}],\"name\":\"8cff0046c214e842687a3a284fe4fabc8a45eb2579168ac47aa1b4908bd95fc4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/premium-w1-5f765a/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5bc63b4c1a02d51f1462172790f7018aec7db9fb8a2a61024ca7c15aac9065b4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]}],\"name\":\"2bdf38e0b22608328672d2ed39e7a6336f89c14fb615a48fda4a36a65c185b32\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/simulator-w1-5f765a/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b8fb7aae7cac121f592817a5e9754983e04e46d9e4226183153bf83b778fffdd\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]}],\"name\":\"b288a64704f96ac78878f6909232d8598eef54cca0d7adc2629cac87b6802414\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/premium-w1-5f765a/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9f6fc629fa43de74b0fb261de7e8b46fbdfe4f21235446879cd916210856d6f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]}],\"name\":\"3345e3b0c95bd559e9c6ce41f622270b0d9eed1deb3d862eb2d4fad368905626\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/premium-w1-5f765a/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"719394d8154dd624eedc306180a33baa4128531f223bc2727d0376601dd634f6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]}],\"name\":\"94c5946d9d9c3cc245ba073b8c7a87c64029cba185e4d624d2145ef119722e87\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/simulator-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4139e076413d5d9d1fd2b594b83d854cc771dfa28886f3f67439ec043220dd9f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]}],\"name\":\"0b53b3ab98bfc66b662cb3ccde6535694ee9e681e165e011925491f011e74e55\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"505545a95fce131db80f848e9990387e6b3e42a2f7e2375f56bbc07efcac9723\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]}],\"name\":\"3f3727d24e2cdb2256f9ce1aa9d7daf02e123ff83dd7745a54bf0be968b8f9fd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/premium-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9112a3b536f3eb5f79a5b52d0ee8a7a26d3700b295f3ce2775128d2841f01ff4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]}],\"name\":\"f08d8256a9bbcb38779e30702529b4c292d4f2775e4ae9817b47fa8337570bcb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0768841c9057075fe648e2fa67028e1fc0bee839efdd3e78e081dac6a9e13397\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]}],\"name\":\"2e7b2a851ead1f1cbcc5f6106eac7e445acafba2c4c4ad4a5a56639d6af03796\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9178bfcf79bd6f1164069b245bef389ffaa38dddce2763e94a3e39d83454aa7f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]}],\"name\":\"2e3472e08ab25f673a6a47899dd2756fa7246fcafa45a33d1cfbd451f1a6da2b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"106dc24382c96b56f69df1e4bfaa0455678809d57faded1081bc4e26a642d4a0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]}],\"name\":\"922243bc7c6610ec5ba0285d821a4e92cf6386c7e495914f5a3fe8f9160a0647\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0b8fd96f5e30886bce6ea837ac57b2f3d77783c525b1de469227d248ca2a1d6e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]}],\"name\":\"9ad77601cac881a53e95a12cc3d1e21e0beee1d4e9757eaa68fbb36f70dbe5e2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e1e7c7c242c339c99da1caa3f217a7bd53ffc78a71bee9a0e898d1f0b8471fb3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]}],\"name\":\"00a6f26194c6932f8037cd0201f950c67a9b8fbee2e5ed3817f9a97812c711c2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c4c89ab332c30b38dc4f16ef73fecdbd0ef26ff23424b1e8fd0d18c2d45cf73d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]}],\"name\":\"892cea79034a9b0e44e5d14d2ace5c60fa5e183f87a7ffb536724af7425a469d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9d278f3acef96193a8d6a95bb17fda6beacb6c6949e61147bbb0a9f984d383ca\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]}],\"name\":\"c89ebfbf5d6c50d68e0202a4a7f2450fb6de7656dcb639d8a2d40d475718ebc7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f7254b99580aca11d813d05cebe8fd0d083eab4978ed55c24131cbd3917e5e39\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]}],\"name\":\"a5339e879056a8880ff59d0bd2b4a470fa93075d67e5851ae7b49fba2bef41e6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a2866a5a08cd0abaabb645c82aff8b6635fdbd34410a7b092e32a8b164086e19\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-5f765a\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-5f765a\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"cc60bc0276d07b9216150b4bc6b21e75f85bf16c7cf27ea44774f135d5d03080\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b651c6e6a372a592c9723851c4377c52eae8778a18d51a17e65b611b0b04e077\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-5f765a\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-5f765a\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"3c78a568a81450298f63da5aa6923258e0adf684426ab83ceb35e01cf96e31be\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e206eae15f3c87b50ca80d04704d63fdf1ea76a805ec0dff6aaf8552207a1be8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-5f765a\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-5f765a\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"2b06fb39c490ea09b70252ff358244737d19e14a20470f0c43270d8a8d663698\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2ce874ebffdc76810fc3c080f4a7068ce8f4e9a05d63e70150e7fc6ef281b797\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-5f765a\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-5f765a\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"4ea6ce64f8c082ae7ad14a6cda98b463639b3ce9f3c1fb4c0f89d8e025314dd5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a2db302be0c4963be9b2d68075376d29342d2e854fa4746701662a56823b450e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-5f765a\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-5f765a\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"c252574ae7fb8eaff36f49460a23a178a025ecce5b05cd990eb6d87e58fc178a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b6a8f91d1ffdf775c75f2a1c84bb520696572aea4d3ece8ed9123766f347b2eb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]}],\"name\":\"7edb3db3dee9ba3102857080aca6e9bec53bbe738951ad9a83ba0cb19f036f1e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/simulator-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"eadff6644620dd26a92e8dd1076b97db8fef2224eb03b70ce4e7ee1ef8dc0b30\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]}],\"name\":\"41b87dde831c23a98bbe55369e4882c3bfbc1b8dcecce6cd22b590fe3e2fd450\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/premium-w1-5f765a')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-worker-w1-5f765a"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-worker-w1-5f765a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:24:58.422Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-worker-w4-d6cb38","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T21:21:30Z","generation":4,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"36c0d6c0-4ad3-4739-8e18-24485ab1bc48\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:23:51Z"}],"name":"kuadrant-e2e-worker-w4-d6cb38","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-worker-w4-d6cb38","uid":"36c0d6c0-4ad3-4739-8e18-24485ab1bc48"}],"resourceVersion":"30528","uid":"2255fc2d-ab48-428d-86a8-4726b25b244c"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7f9f489fba4cc345dba07951f043d704ea999478c1da34cd23037357dcdf1384\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"43944086c7f9657d\\\" || auth.identity.selected_subscription_id == \\\"9835edb7fff9d047\\\" || auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"43944086c7f9657d\\\" || auth.identity.selected_subscription_id == \\\"9835edb7fff9d047\\\" || auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"f61d2b7d2f64f1d64a2dcee70f47ce24c9c6eb4854589984128561c58f6171ac\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"12f3d170c629c434ef1558f623819a2294b75940427c1164b50933cdad3fb52f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"4d6b2e7d73dcdd0567dbe7811fffb6b677ae17a404dd4e000e5586417b4abff9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7f9f489fba4cc345dba07951f043d704ea999478c1da34cd23037357dcdf1384\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"43944086c7f9657d\\\" || auth.identity.selected_subscription_id == \\\"9835edb7fff9d047\\\" || auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"43944086c7f9657d\\\" || auth.identity.selected_subscription_id == \\\"9835edb7fff9d047\\\" || auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"5b984da304c827646ff112362de545fa451a799e7f6999eac00f25f038606c2a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"12f3d170c629c434ef1558f623819a2294b75940427c1164b50933cdad3fb52f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"ad40721e9bd95807ea332811f94d79eb07b9dd045127a232886a7924332cbc73\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7f9f489fba4cc345dba07951f043d704ea999478c1da34cd23037357dcdf1384\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"43944086c7f9657d\\\" || auth.identity.selected_subscription_id == \\\"9835edb7fff9d047\\\" || auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"43944086c7f9657d\\\" || auth.identity.selected_subscription_id == \\\"9835edb7fff9d047\\\" || auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"b91256531abbaaf08ed45e4a93b53e9af9ebb53002123196214bb374517e81f0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"12f3d170c629c434ef1558f623819a2294b75940427c1164b50933cdad3fb52f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"597cf592078ae14c96f33099e96fee363339bedb2f5d430fdd69e28e8be2a8ff\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7f9f489fba4cc345dba07951f043d704ea999478c1da34cd23037357dcdf1384\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"43944086c7f9657d\\\" || auth.identity.selected_subscription_id == \\\"9835edb7fff9d047\\\" || auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"43944086c7f9657d\\\" || auth.identity.selected_subscription_id == \\\"9835edb7fff9d047\\\" || auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"490344715bd8708a2d31131fc3b4e370beef7eb7d9942ba89fc82080284e6244\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"12f3d170c629c434ef1558f623819a2294b75940427c1164b50933cdad3fb52f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"aeb99e2df9a1951917065c7b887084431b3e62a6f4d47287af43193676a5b8be\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7f9f489fba4cc345dba07951f043d704ea999478c1da34cd23037357dcdf1384\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"43944086c7f9657d\\\" || auth.identity.selected_subscription_id == \\\"9835edb7fff9d047\\\" || auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"43944086c7f9657d\\\" || auth.identity.selected_subscription_id == \\\"9835edb7fff9d047\\\" || auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"fa28a7ae652b865919d1ff4c61fd33bb8512d3139af38d1ceb9697a99e63cc6b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"12f3d170c629c434ef1558f623819a2294b75940427c1164b50933cdad3fb52f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"601d68ffdf7137fde779cf41214f1c74f63e6b717be0b7aad1eb56041a2d9b76\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7f9f489fba4cc345dba07951f043d704ea999478c1da34cd23037357dcdf1384\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"43944086c7f9657d\\\" || auth.identity.selected_subscription_id == \\\"9835edb7fff9d047\\\" || auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"43944086c7f9657d\\\" || auth.identity.selected_subscription_id == \\\"9835edb7fff9d047\\\" || auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"2dea78ba3797dedd7edd7b687182785345cfd95029e2131769c5797e3b752eb5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7f9f489fba4cc345dba07951f043d704ea999478c1da34cd23037357dcdf1384\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"43944086c7f9657d\\\" || auth.identity.selected_subscription_id == \\\"9835edb7fff9d047\\\" || auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"43944086c7f9657d\\\" || auth.identity.selected_subscription_id == \\\"9835edb7fff9d047\\\" || auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"cdb3a0c564011d63952f137daa521c84f02a66f8a75696ef9ac4f1f2cc9ea8c9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"12f3d170c629c434ef1558f623819a2294b75940427c1164b50933cdad3fb52f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"e019089f573a8879defa7fdce139828725d9f042c5a4dc9974b9185a8a382c51\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"12f3d170c629c434ef1558f623819a2294b75940427c1164b50933cdad3fb52f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"6a08c6dd0c7522c09a18466dfa733eb68e8c593cdc8d2890ccff2f5c9064fcc0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7f9f489fba4cc345dba07951f043d704ea999478c1da34cd23037357dcdf1384\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"43944086c7f9657d\\\" || auth.identity.selected_subscription_id == \\\"9835edb7fff9d047\\\" || auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"43944086c7f9657d\\\" || auth.identity.selected_subscription_id == \\\"9835edb7fff9d047\\\" || auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"31c0c96d54839068517aaeb062676423451143447943cafff7ee595d9fd1feca\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"12f3d170c629c434ef1558f623819a2294b75940427c1164b50933cdad3fb52f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"aebde4a102828558eb0fbde9709268d7adabc75fadf451c730e0573c086e2f07\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a69bb45bad035c53dd8c7176828b1cc26d0c9d3f775d2059034b1639ca1b49d8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"79db77eb448edf55b65761a293f7f6fc07c9d4365912f7a8595364cdbf33d994\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e5e9b9fa41efe7f56f3ea6e9079d12a9f3e89cd596105815b30b04ba7ba1281b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"43944086c7f9657d\\\" || auth.identity.selected_subscription_id == \\\"9835edb7fff9d047\\\" || auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"43944086c7f9657d\\\" || auth.identity.selected_subscription_id == \\\"9835edb7fff9d047\\\" || auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"9b7cb9a28ed2fc7fdfa23c7d8d869cc573e3e72423805bef3f945a77d2785710\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"dff7a596e1042978304d40238abe84063cc499f4a6a2f9def85e7c84d1df1ebc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"4ebe0e741886c221cfcd8d1126bcb3535dcbe15c7f802a713d3b2ceb8cee37e1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4db1dd6250896b02d5f97b90471902db72d349ea082f211b7b5e4046c827d477\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"43944086c7f9657d\\\" || auth.identity.selected_subscription_id == \\\"9835edb7fff9d047\\\" || auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"43944086c7f9657d\\\" || auth.identity.selected_subscription_id == \\\"9835edb7fff9d047\\\" || auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"9e4cdffa79635674b661188290cd9c853017f5721accaa1f268edc6c6b7f2590\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8ea982efbe7afcd4f8dbaa4e864584b38ec852971d686ed11c87e99f1b9f4f9a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"43944086c7f9657d\\\" || auth.identity.selected_subscription_id == \\\"9835edb7fff9d047\\\" || auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"43944086c7f9657d\\\" || auth.identity.selected_subscription_id == \\\"9835edb7fff9d047\\\" || auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"1ed83021e2408187ee74cd1a66732d37b92c80d46439951ce5e0f654f1542381\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7d8b4229a4e8df0df0b627da5317c526c045e2ab5837161d638a7835193820d5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"36ee8c63f509519eef9ec6e2c257745b647d322586f8289611274ca06f90ec11\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2c4b4abb753457c4ad4bd5815f6ce55723fcfcf44f298a47923e03e51d023a49\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"43944086c7f9657d\\\" || auth.identity.selected_subscription_id == \\\"9835edb7fff9d047\\\" || auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"43944086c7f9657d\\\" || auth.identity.selected_subscription_id == \\\"9835edb7fff9d047\\\" || auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"3ce9856de6f3b95cc2ed4fe4abeef13ecb59b5b1ef0102b858e5d3ec0d8afa89\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7fdbd59414185d321c56439c757d9c725c67465b49a83a52b935fdd9c5f0df82\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"2eb3ad4b5e4be8080b2e0309815371172455a7e5f61cf9c3c595f17e99e6f681\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bb82cce53996fd9a50a4f33832b37ff599d227ab91d54895bf0ab989d1eb0b01\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"138b7da9a4ea2091f7b13106ba292672e2ca1d22138b32de717b07cab221eebc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7ebdbd5a6be861834fc366408f369ad8f021dfe8f061cbc93334bc801f3df98f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"43944086c7f9657d\\\" || auth.identity.selected_subscription_id == \\\"9835edb7fff9d047\\\" || auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"43944086c7f9657d\\\" || auth.identity.selected_subscription_id == \\\"9835edb7fff9d047\\\" || auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"be4080fc1058816edd779c6c2b40a1657320a89a6a86b4ff7358026a6adb2e23\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a6e80d640d49da44f2b60f9db62279137aa6839ed5acbca6493b96977b1f3f9b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"43944086c7f9657d\\\" || auth.identity.selected_subscription_id == \\\"9835edb7fff9d047\\\" || auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"43944086c7f9657d\\\" || auth.identity.selected_subscription_id == \\\"9835edb7fff9d047\\\" || auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"b470ad22bfeca185d9d86c6a107cdea6e62f1aaf494ef31244de0d30052bbcfc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b1fdba63ead328fd43c505e06394bc2adb7e5e2dfb0a1e55ef2c41d8f345142f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"30a1d05fede91486be251352bb7291a36ac69d50b6fce18433612afe29f1b4b1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f2655bcd7b6a7d3d8a4479c1c943c5f2b4d4fbb7d96408fc7ce07c4e7bd9f30c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"12835533e58f43762872e20b92b523339a9de435dc7d0f689b42133b367fae44\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"309f6b916a61539853033efc6ca2e083c01c99e5b96f857a7c78b89f9816f598\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"43944086c7f9657d\\\" || auth.identity.selected_subscription_id == \\\"9835edb7fff9d047\\\" || auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"43944086c7f9657d\\\" || auth.identity.selected_subscription_id == \\\"9835edb7fff9d047\\\" || auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"788f4c0f9a4e5a97247c2043b8125cf170fe6674c40d873723dc972c4d5d93af\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9a1afd5e20de63bb2c85d93c9c3fd7aae15a0f45cb6e07dc467b8063b97decee\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"43944086c7f9657d\\\" || auth.identity.selected_subscription_id == \\\"9835edb7fff9d047\\\" || auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"43944086c7f9657d\\\" || auth.identity.selected_subscription_id == \\\"9835edb7fff9d047\\\" || auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"4c928eaa593596b5c3719a02958892d193943b2129a32e43035c896d93b232c1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4b5d6544ef7fd39f49a5af0551f4a404b0a5f49df3054a95306b7f797216c599\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"8773bca7122a801a4f199775b03693ad30e316ffebea5bcaf72af079bf14f24d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3474cd3af51b646106406cc4778f6a5608fdc62b1fd92f27ccbcf8ab285bc05c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"43944086c7f9657d\\\" || auth.identity.selected_subscription_id == \\\"9835edb7fff9d047\\\" || auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"43944086c7f9657d\\\" || auth.identity.selected_subscription_id == \\\"9835edb7fff9d047\\\" || auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"f0bc235629f48b82dcaad76bce5cdb80abfa82763d9ad220a11c3e27d70223d5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c34c962f04362894a54cdf652c523865dbd1633f051244729b008181d474e55\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"2c3bfc8693c69427d3231717a8df2d14aba0f1fb87d9fd82bb191f0ebb31c308\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e12ef81cd87aec42f5b2528c46a9aeefe6b1bca82398f07b17a52a4bf6e91945\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"bd1615998be1912965bb2d26173bc1bd1e2565f8996f1f21fc476ccff3b1ad05\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a6fa5c95daf46871f07bc4e3ef7985a19659c040a1ef2a7baccccaa90e241705\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"43944086c7f9657d\\\" || auth.identity.selected_subscription_id == \\\"9835edb7fff9d047\\\" || auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"43944086c7f9657d\\\" || auth.identity.selected_subscription_id == \\\"9835edb7fff9d047\\\" || auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"3a34ac7af354fbf7d29872077cc2e557a29218e220d9e4e79e21710f2084e770\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"16cb85f469e7c5716866312b8b4cc95d7bd4782b54923c1571be2b995ef85c30\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"a65b58c28d5a781726a832c59d62e640ea9d347c008d6795a6bc79865414532f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3aa68add648f18fb79f3def0d73f0c2f29d8ab60b1352cf4548a1a038cf3d923\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"fad9cba453f811618739c6f08a8544a889f48ec7511f7d3ccac0f71ba988967b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"099191e40682a5a6b1df435c6dc10936b8b4e31a891f3520e8e9f8418b1acc3e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"adbf9660bf8db4b1489d019993fddbd2863d0cf7c72174df8663c00e565a1e21\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"13694f4cecc05b3e953bb7d1aa68f96fad9b8548456e1357cc504ba9936493bf\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"fd3f6d135cf69e39efa3702af6a7e665f47a40ddb90f71d1f37cad11438027bc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"db8ed9490207e877020d08d86f8a9769046fd69225998abd4e476e93ef7b9431\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"e3ae0784ebe4c51499f320023e5e93f640f2a33ae4fea237cb7e068df1c76739\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"12dec0ddb151cc18ef75cfe2b4260788095e28a391f359fc3f7da7c75381b728\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"8f6398fb66bae44affa747ad532a12445774a5b43ca2c7196a633d5d03da8c80\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"735d43fce555e32c36cd137abc0678ce944fbfe58a677497d16ab8d9ab37074f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"43944086c7f9657d\\\" || auth.identity.selected_subscription_id == \\\"9835edb7fff9d047\\\" || auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"43944086c7f9657d\\\" || auth.identity.selected_subscription_id == \\\"9835edb7fff9d047\\\" || auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"1016de6b3250a59509e3bc1de65ad0a68ae6faf776c4eaa853d86bce7dd96698\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9a442413f7e81c114c48c6bbdd04c0e3809cdcdf4def1f524f6d3adf70468027\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"785762b8cbcc7dd30b578476b081ad2df517e9e450947fa2591a488b59407126\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-worker-w4-d6cb38"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-worker-w4-d6cb38\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:24:58.701Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-worker-w2-6fa533","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T21:21:58Z","generation":3,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"350cbfc3-ae8f-47d8-bf88-3bc797a06de4\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:24:06Z"}],"name":"kuadrant-e2e-worker-w2-6fa533","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-worker-w2-6fa533","uid":"350cbfc3-ae8f-47d8-bf88-3bc797a06de4"}],"resourceVersion":"30925","uid":"e9c29fe8-1b7a-4730-9bc2-e4f3e80147bd"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2538346ffaabe171687c406d12f294530661f7690a04d14ab2327034447b1886\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"fc3c7a9daa18c716699d2f1fa233a5848a5d36cd60feee59a35bb57159d77252\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"df8548d2a100989756489c2811783626f3836ef18d08ba8c81bfb6b9e9ef9c28\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"983a86a79f65831a149f35f3c7673bbfb37560154023198d82ebb8965ed48c8e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/premium-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2538346ffaabe171687c406d12f294530661f7690a04d14ab2327034447b1886\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"53b8e179280ac5286bf38489ea72372b11c85a8c387359bf689ebecff1663d36\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"df8548d2a100989756489c2811783626f3836ef18d08ba8c81bfb6b9e9ef9c28\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"c166f75566a6849f94f19ff1eaf52bbfeb65e132db0ce99439215a5fba3cf50f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/premium-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2538346ffaabe171687c406d12f294530661f7690a04d14ab2327034447b1886\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"89b4eca3220447cd92c83c9c71f9e61e645c1f746a07d9b87eac9b2d4af27f2a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"df8548d2a100989756489c2811783626f3836ef18d08ba8c81bfb6b9e9ef9c28\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"82b649105e404b52dbe59777c528effe8ddcaf390c919bc52a045d6654c17d27\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/premium-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2538346ffaabe171687c406d12f294530661f7690a04d14ab2327034447b1886\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"0f54f971c3b78f7352580f77fc5be3e00c2117ef445b417be77bf67ea75539a5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"df8548d2a100989756489c2811783626f3836ef18d08ba8c81bfb6b9e9ef9c28\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"616030c276c95a5326d811265a5516c30019307d032046e4dbf9c60aed89bb9f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/premium-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2538346ffaabe171687c406d12f294530661f7690a04d14ab2327034447b1886\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"6982a3a190cf8786b034f1d39a14b07dab2e5311ed66344e600b389726798c72\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"df8548d2a100989756489c2811783626f3836ef18d08ba8c81bfb6b9e9ef9c28\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"d8b01a7d8bf17be310055802641797f595c1e7290b01b91e2b87cf0300418b94\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/premium-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2538346ffaabe171687c406d12f294530661f7690a04d14ab2327034447b1886\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"87456404dc6fbf2160a52ba615889680b0c5cf40dc6100bb0e888288606dff25\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2538346ffaabe171687c406d12f294530661f7690a04d14ab2327034447b1886\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"8b9c2ea6de06bba9ed1ba2a65e99d1500ef45630a372914ecf445da73d74600a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"df8548d2a100989756489c2811783626f3836ef18d08ba8c81bfb6b9e9ef9c28\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"9222b1bebeb91f5bc797ef6f55e59f628b5f90c3da7305c7a50abb490cf18e24\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/premium-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"df8548d2a100989756489c2811783626f3836ef18d08ba8c81bfb6b9e9ef9c28\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"63ba67de9ead24d6aab10a349447139ea4c7227426ee6072b8939e91ccf0ed30\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/premium-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2538346ffaabe171687c406d12f294530661f7690a04d14ab2327034447b1886\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"d58c446a6a9364595eaae0256bc0befa6f57ed0387674ac1d6970632cb6b41f0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"df8548d2a100989756489c2811783626f3836ef18d08ba8c81bfb6b9e9ef9c28\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"6e120ade3c6d3506708dea5d54e9bc2fd6306ec4718a0c11f9c0a89c0ea6f1cd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/premium-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"79e41416d85afbda9f192c421571f899a58b4937465fe640fd4d17dfb0d8240e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-6fa533\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-6fa533\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"af109b5290beff4991ef93d4a835ce24ed3b0986578fba7947a76ca1a6dd65e2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8abe3e629bd34674437803d6e54a0cb90fe0d0df12d2eac23f0b40d2f4990b37\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"ccb67df939c7a3278e2bb82db8d5dc418650599ab46b4bd1d8fe07cf9bb459d0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8f50bf1a21545f68eb583e07935b8b0da52bbc4743a8bc67c4d9545b76da56af\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"7206c2870629f698a99d45c9e7140cc1334b531b1ad5a3c88c147fac40e793b2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/premium-w2-6fa533/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"503064d3f84a23711f1dad5e35d11ef1efceaefb2204608d180ef8d886666ffa\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"1036f7f4f8b7c68faa7a499350cf496a96528b515b125a726c7e904d5297c1e6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"41e99bc62a2ac4e8034135f4b655088597f627c66b2efc4627394d148bc2b0ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"b2fa16adeef96749257d873656ef49327fe454d7ba806ae3a8a73ec44c8a092d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2f2531e01fa8fc0031706fadbba0c1818c30681dcf9d2c65b1c7c23230ea3a32\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"d04838d25723911d554e0017a035ebf67253923630681f27a1c93b44878b1bcc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/premium-w2-6fa533/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f1edf5f89fd287762fbbefa668581cdc8f1877a3f31497227c537000670166d9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"dbf8e642e7e029e70e317d8df7b5d12be0fc1f008d29ff415d7291c09924eecb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"afe9746e0af749da011756561a859419e447efc535f5e3f3773b1d18a5b5a9ac\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"7ae7a5b24207da4f6cb3659a8b6639f53e96a876f02aaa1f0a8b92813f856ad7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/premium-w2-6fa533/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8309dc44d5088e48040255bf86dbc622de08fc216837cd0027a69bdf179a9d2a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"206d678ecc5400943db26abb21afd48a2ffc6fee651aa73c8301a56858221aa0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/premium-w2-6fa533/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"206e50a9b0e5f83281f994d9f1d85f92406e3544297c47017c081f763b10dd96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"1d9b68bda9fa73e5f8e8ac869771d602c5f128903fd22e64db2370f9749a3113\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"62457e23e29ce9b4e8380d685c5e9e84bc5137e91486a6f9c1c9e352ca3a021c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"957121ddf9ee4c2793cec71a8576e07ee1925a201f93c8de02b6fce446d010d8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1ce9b189744d237515a1896d038a3437e8e31669b01937d8cf3a067728ee7e82\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"672be8f3fbaf802659dc395e46e1b17c7ab1515e557eab74f4c7d2c055ad4cf7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/premium-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0947683a63afc3251194a3b586cb934b1350dcaa171c4fd826d6773a00d5cf2a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"88202ce79ddf6dca9b8c8b1fbc0aa013155bc9975075ee9158a09c6708287af4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fd7deaf8530c822c1b10ef4c1b0887086bc840af6d5c7a730508ddcb6e179095\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"14655ca6105b9121c6e780127a21626d2e779082f0ea2674b0d77647d247a24c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"60ca770315801fd35b67ab23639ba4ac6a344fcf95fe492c267cc87cb90ce14f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"d7f0af7e7ca785bc5de89e740ff47459e16eb3ba9360c1eee59d6d8d2f7389bd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6d6f6c08f92b4cefaa6a997643ec612cf9c62df4fa750dd0f5d4c3d50d40d2bb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"daf823a39b0f169fe5f258178380bcf0b3e996152ebcc401fb21de178f041b24\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1f83c46a7c87c216ad3b7a3697a1ad6c518cb36972a910efbc3c7eed6ab3956a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"496ec6213c84428bc1374936695dcb9246c04c80a4460a92e53220e4641a7116\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"25cb748ea88f201b192c863c4e2fb40e5931cd9cfed0d04ae104e35dbe48f38b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"c49c039641c1cdbec2a8f5cc805b4b722943e1336d082080571a2f2fcb073186\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3ecbc6560d7cb2e5396471349d24b95ff664f3b33dfc188e590c2b772721287c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"2e058e1b6b4635806a5e2b8fb08fed6fd11db7595be6907f89a86777a30aa9b5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"319a8bd03b55a51284dd6790058e026879ed8db3e6d527dedb4a9314473afa5b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"ac54aac970a6722b49c3410bffc6b58a3832c579aa7c3629ff80507ab769f2d3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"23d2f913b5bde1ed64144a38680e6282220982f4f5ea1167fabdda3234dbc67e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"c6c6e62fb02ec82dd2ad63c3690b3887e0701c293e1871ee382d92ea80f88f66\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"51e9e3c7450b52b22ca45c280738926226df3d95852d8df43ff47cf85cca9e5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-6fa533\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-6fa533\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"64fb7512cad2bf5a1c9b6978a7f9de714d5a739282aa9ca951ee3b4f417da286\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"dfa08453b9c8623db01e432dea4f9e09b3d7f80cbbee3a69df753c6d3fbfbded\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-6fa533\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-6fa533\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"af2b1c5e2c0a798508b2ef3249c778b1b43898c8636c878f66d20c220701a6f4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"517c7132d716e14e14b2c9fccd696f86bc7a24a46c391e71d07ac910d0dd1c18\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-6fa533\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-6fa533\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"ee9f66c18cbc8fcbae62d62e57dcbad633d943ff04a829fbc8bb030c121bf426\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b93afde66771848b5188f78e530f2f596324f9fb9f05b2dd8f1cb49489f2bda1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-6fa533\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-6fa533\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"c514ea15546ae0041f8d77a7e65bd51a98d808edee2739e914353f03c270d86d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"de3ca7c8a9dcdebe0c2a67b74b3bc72bdc4a8f34aff1f0c69df675fbb03b1e05\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-6fa533\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-6fa533\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"985f90a1588b57b9e2061e7440127c4729ab98e674bb91d1e90364de9aea35ad\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"edbbdcfc920b88151941be1a4c41ad8be6a38bd6beddae7387db202bc3e9b302\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"15153104d9c89c44b59d96d9d8825fe62d21af5bd4db90b6c300fa53823a0ef0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bf3fa706be871596c50143869f253e98ce7aa463d723d2f419d378a041dbfbe5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"4e925c4610a758f575689b807fc7a61cef2c3891e2cf0a1c1074186e65a2e8fd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/premium-w2-6fa533')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-worker-w2-6fa533"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-worker-w2-6fa533\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:24:58.989Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w1-5f765a","namespace":"e2e-models-e2e-worker-w1-5f765a","uid":"7188eadc-9748-4be8-a5e2-d904cf5b6130","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w1-5f765a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:24:59.166Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-worker-w2-6fa533","namespace":"openshift-ingress","uid":"a5dc40a7-7420-41ee-b669-84be9ec8bcb8","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-worker-w2-6fa533\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:24:59.224Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w0-0c9014","namespace":"e2e-models-e2e-worker-w0-0c9014","uid":"4f647df6-1d5b-433b-b4fc-1279ff1755f7","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w0-0c9014\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:24:59.281Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w4-d6cb38","namespace":"e2e-models-e2e-worker-w4-d6cb38","uid":"486176e6-7786-40c4-9ce0-6f4a68b408b2","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w4-d6cb38\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:24:59.339Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w2-6fa533","namespace":"e2e-models-e2e-worker-w2-6fa533","uid":"3a128bb2-de88-49aa-ab9e-c8626107a077","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w2-6fa533\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:24:59.397Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w3-f51151","namespace":"e2e-models-e2e-worker-w3-f51151","uid":"e3340067-224a-43ad-8020-ca9e00ead152","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w3-f51151\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:24:59.573Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w2-6fa533","namespace":"e2e-models-e2e-worker-w2-6fa533","uid":"2ff73667-c2c3-4579-9503-b6ca098f1021","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w2-6fa533\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:24:59.632Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-worker-w1-5f765a","namespace":"openshift-ingress","uid":"61d218f4-e9a7-4418-a32d-90a2c51e6642","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-worker-w1-5f765a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:24:59.690Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w1-5f765a","namespace":"e2e-models-e2e-worker-w1-5f765a","uid":"9c852546-ee7c-4e72-855c-111315f7bf82","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w1-5f765a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:24:59.931Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"simulator-w2-6fa533-kserve-route","namespace":"e2e-models-e2e-worker-w2-6fa533","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"simulator-w2-6fa533-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:24:59.994Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"simulator-w1-5f765a-kserve-route","namespace":"e2e-models-e2e-worker-w1-5f765a","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"simulator-w1-5f765a-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:25:00.091Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"premium-w2-6fa533-kserve-route","namespace":"e2e-models-e2e-worker-w2-6fa533","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"premium-w2-6fa533-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:25:00.202Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"premium-w1-5f765a-kserve-route","namespace":"e2e-models-e2e-worker-w1-5f765a","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"premium-w1-5f765a-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:25:05.399Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","AuthConfig","ConfigMap","AuthPolicy","EnvoyFilter","Limitador","HTTPRoute"],"eventTypes":{"update":80}}
{"level":"info","ts":"2026-11-02T21:25:05.527Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:25:05.959Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:25:06.061Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:25:06.062Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:25:07.367Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:25:07.373Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:25:07.373Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:25:07.423Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:25:07.423Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:25:07.430Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:25:07.492Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:25:09.353Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:25:09.353Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T21:25:09.538Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"maas-default-gateway","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"maas-default-gateway\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:25:09.952Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy"],"eventTypes":{"update":1}}
{"level":"info","ts":"2026-11-02T21:25:11.648Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:25:11.650Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:25:11.650Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:25:11.652Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"error","ts":"2026-11-02T21:25:11.723Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:25:11.723Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T21:25:12.105Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-worker-w4-d6cb38","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T21:21:30Z","generation":5,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"36c0d6c0-4ad3-4739-8e18-24485ab1bc48\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:24:50Z"}],"name":"kuadrant-e2e-worker-w4-d6cb38","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-worker-w4-d6cb38","uid":"36c0d6c0-4ad3-4739-8e18-24485ab1bc48"}],"resourceVersion":"32114","uid":"2255fc2d-ab48-428d-86a8-4726b25b244c"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7f9f489fba4cc345dba07951f043d704ea999478c1da34cd23037357dcdf1384\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"f61d2b7d2f64f1d64a2dcee70f47ce24c9c6eb4854589984128561c58f6171ac\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"12f3d170c629c434ef1558f623819a2294b75940427c1164b50933cdad3fb52f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"4d6b2e7d73dcdd0567dbe7811fffb6b677ae17a404dd4e000e5586417b4abff9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7f9f489fba4cc345dba07951f043d704ea999478c1da34cd23037357dcdf1384\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"5b984da304c827646ff112362de545fa451a799e7f6999eac00f25f038606c2a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"12f3d170c629c434ef1558f623819a2294b75940427c1164b50933cdad3fb52f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"ad40721e9bd95807ea332811f94d79eb07b9dd045127a232886a7924332cbc73\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7f9f489fba4cc345dba07951f043d704ea999478c1da34cd23037357dcdf1384\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"b91256531abbaaf08ed45e4a93b53e9af9ebb53002123196214bb374517e81f0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"12f3d170c629c434ef1558f623819a2294b75940427c1164b50933cdad3fb52f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"597cf592078ae14c96f33099e96fee363339bedb2f5d430fdd69e28e8be2a8ff\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7f9f489fba4cc345dba07951f043d704ea999478c1da34cd23037357dcdf1384\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"490344715bd8708a2d31131fc3b4e370beef7eb7d9942ba89fc82080284e6244\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"12f3d170c629c434ef1558f623819a2294b75940427c1164b50933cdad3fb52f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"aeb99e2df9a1951917065c7b887084431b3e62a6f4d47287af43193676a5b8be\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7f9f489fba4cc345dba07951f043d704ea999478c1da34cd23037357dcdf1384\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"fa28a7ae652b865919d1ff4c61fd33bb8512d3139af38d1ceb9697a99e63cc6b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"12f3d170c629c434ef1558f623819a2294b75940427c1164b50933cdad3fb52f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"601d68ffdf7137fde779cf41214f1c74f63e6b717be0b7aad1eb56041a2d9b76\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7f9f489fba4cc345dba07951f043d704ea999478c1da34cd23037357dcdf1384\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"2dea78ba3797dedd7edd7b687182785345cfd95029e2131769c5797e3b752eb5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7f9f489fba4cc345dba07951f043d704ea999478c1da34cd23037357dcdf1384\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"cdb3a0c564011d63952f137daa521c84f02a66f8a75696ef9ac4f1f2cc9ea8c9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"12f3d170c629c434ef1558f623819a2294b75940427c1164b50933cdad3fb52f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"e019089f573a8879defa7fdce139828725d9f042c5a4dc9974b9185a8a382c51\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"12f3d170c629c434ef1558f623819a2294b75940427c1164b50933cdad3fb52f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"6a08c6dd0c7522c09a18466dfa733eb68e8c593cdc8d2890ccff2f5c9064fcc0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7f9f489fba4cc345dba07951f043d704ea999478c1da34cd23037357dcdf1384\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"31c0c96d54839068517aaeb062676423451143447943cafff7ee595d9fd1feca\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"12f3d170c629c434ef1558f623819a2294b75940427c1164b50933cdad3fb52f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"aebde4a102828558eb0fbde9709268d7adabc75fadf451c730e0573c086e2f07\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a69bb45bad035c53dd8c7176828b1cc26d0c9d3f775d2059034b1639ca1b49d8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"79db77eb448edf55b65761a293f7f6fc07c9d4365912f7a8595364cdbf33d994\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e5e9b9fa41efe7f56f3ea6e9079d12a9f3e89cd596105815b30b04ba7ba1281b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"9b7cb9a28ed2fc7fdfa23c7d8d869cc573e3e72423805bef3f945a77d2785710\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"dff7a596e1042978304d40238abe84063cc499f4a6a2f9def85e7c84d1df1ebc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"4ebe0e741886c221cfcd8d1126bcb3535dcbe15c7f802a713d3b2ceb8cee37e1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4db1dd6250896b02d5f97b90471902db72d349ea082f211b7b5e4046c827d477\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"9e4cdffa79635674b661188290cd9c853017f5721accaa1f268edc6c6b7f2590\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8ea982efbe7afcd4f8dbaa4e864584b38ec852971d686ed11c87e99f1b9f4f9a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"1ed83021e2408187ee74cd1a66732d37b92c80d46439951ce5e0f654f1542381\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7d8b4229a4e8df0df0b627da5317c526c045e2ab5837161d638a7835193820d5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"36ee8c63f509519eef9ec6e2c257745b647d322586f8289611274ca06f90ec11\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2c4b4abb753457c4ad4bd5815f6ce55723fcfcf44f298a47923e03e51d023a49\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"3ce9856de6f3b95cc2ed4fe4abeef13ecb59b5b1ef0102b858e5d3ec0d8afa89\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7fdbd59414185d321c56439c757d9c725c67465b49a83a52b935fdd9c5f0df82\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"2eb3ad4b5e4be8080b2e0309815371172455a7e5f61cf9c3c595f17e99e6f681\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bb82cce53996fd9a50a4f33832b37ff599d227ab91d54895bf0ab989d1eb0b01\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"138b7da9a4ea2091f7b13106ba292672e2ca1d22138b32de717b07cab221eebc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7ebdbd5a6be861834fc366408f369ad8f021dfe8f061cbc93334bc801f3df98f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"be4080fc1058816edd779c6c2b40a1657320a89a6a86b4ff7358026a6adb2e23\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a6e80d640d49da44f2b60f9db62279137aa6839ed5acbca6493b96977b1f3f9b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"b470ad22bfeca185d9d86c6a107cdea6e62f1aaf494ef31244de0d30052bbcfc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b1fdba63ead328fd43c505e06394bc2adb7e5e2dfb0a1e55ef2c41d8f345142f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"30a1d05fede91486be251352bb7291a36ac69d50b6fce18433612afe29f1b4b1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f2655bcd7b6a7d3d8a4479c1c943c5f2b4d4fbb7d96408fc7ce07c4e7bd9f30c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"12835533e58f43762872e20b92b523339a9de435dc7d0f689b42133b367fae44\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"309f6b916a61539853033efc6ca2e083c01c99e5b96f857a7c78b89f9816f598\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"788f4c0f9a4e5a97247c2043b8125cf170fe6674c40d873723dc972c4d5d93af\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9a1afd5e20de63bb2c85d93c9c3fd7aae15a0f45cb6e07dc467b8063b97decee\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"4c928eaa593596b5c3719a02958892d193943b2129a32e43035c896d93b232c1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4b5d6544ef7fd39f49a5af0551f4a404b0a5f49df3054a95306b7f797216c599\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"8773bca7122a801a4f199775b03693ad30e316ffebea5bcaf72af079bf14f24d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3474cd3af51b646106406cc4778f6a5608fdc62b1fd92f27ccbcf8ab285bc05c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"f0bc235629f48b82dcaad76bce5cdb80abfa82763d9ad220a11c3e27d70223d5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c34c962f04362894a54cdf652c523865dbd1633f051244729b008181d474e55\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"2c3bfc8693c69427d3231717a8df2d14aba0f1fb87d9fd82bb191f0ebb31c308\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e12ef81cd87aec42f5b2528c46a9aeefe6b1bca82398f07b17a52a4bf6e91945\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"bd1615998be1912965bb2d26173bc1bd1e2565f8996f1f21fc476ccff3b1ad05\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a6fa5c95daf46871f07bc4e3ef7985a19659c040a1ef2a7baccccaa90e241705\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"3a34ac7af354fbf7d29872077cc2e557a29218e220d9e4e79e21710f2084e770\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"16cb85f469e7c5716866312b8b4cc95d7bd4782b54923c1571be2b995ef85c30\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"a65b58c28d5a781726a832c59d62e640ea9d347c008d6795a6bc79865414532f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3aa68add648f18fb79f3def0d73f0c2f29d8ab60b1352cf4548a1a038cf3d923\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"fad9cba453f811618739c6f08a8544a889f48ec7511f7d3ccac0f71ba988967b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"099191e40682a5a6b1df435c6dc10936b8b4e31a891f3520e8e9f8418b1acc3e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"adbf9660bf8db4b1489d019993fddbd2863d0cf7c72174df8663c00e565a1e21\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"13694f4cecc05b3e953bb7d1aa68f96fad9b8548456e1357cc504ba9936493bf\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"fd3f6d135cf69e39efa3702af6a7e665f47a40ddb90f71d1f37cad11438027bc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"db8ed9490207e877020d08d86f8a9769046fd69225998abd4e476e93ef7b9431\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"e3ae0784ebe4c51499f320023e5e93f640f2a33ae4fea237cb7e068df1c76739\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"12dec0ddb151cc18ef75cfe2b4260788095e28a391f359fc3f7da7c75381b728\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"8f6398fb66bae44affa747ad532a12445774a5b43ca2c7196a633d5d03da8c80\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"735d43fce555e32c36cd137abc0678ce944fbfe58a677497d16ab8d9ab37074f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"1016de6b3250a59509e3bc1de65ad0a68ae6faf776c4eaa853d86bce7dd96698\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9a442413f7e81c114c48c6bbdd04c0e3809cdcdf4def1f524f6d3adf70468027\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"785762b8cbcc7dd30b578476b081ad2df517e9e450947fa2591a488b59407126\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-worker-w4-d6cb38"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-worker-w4-d6cb38\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:25:12.643Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w4-d6cb38","namespace":"e2e-models-e2e-worker-w4-d6cb38","uid":"486176e6-7786-40c4-9ce0-6f4a68b408b2","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w4-d6cb38\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:25:13.845Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"maas-default-gateway","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"maas-default-gateway\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:25:21.579Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","Gateway","AuthPolicy","EnvoyFilter","Limitador","TokenRateLimitPolicy","HTTPRoute"],"eventTypes":{"create":1,"update":7}}
{"level":"info","ts":"2026-11-02T21:25:21.705Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:25:22.468Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:25:22.558Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:25:22.558Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:25:23.655Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:25:23.657Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:25:23.661Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:25:23.662Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:25:23.662Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:25:23.664Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-11-02T21:25:23.770Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:25:23.770Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T21:25:25.650Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w2-6fa533","namespace":"e2e-models-e2e-worker-w2-6fa533","uid":"3a128bb2-de88-49aa-ab9e-c8626107a077","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w2-6fa533\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:25:25.771Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:25:25.771Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T21:25:26.108Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-worker-w4-d6cb38","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-worker-w4-d6cb38\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:25:26.420Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy"],"eventTypes":{"create":1}}
{"level":"info","ts":"2026-11-02T21:25:28.597Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:25:28.599Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:25:28.599Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:25:28.623Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"error","ts":"2026-11-02T21:25:28.680Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:25:28.680Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T21:25:29.323Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/maas-default-gateway","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T21:16:03Z","generation":7,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"371b36ef-c4b7-499a-87db-1bdf4e8f92de\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:18:48Z"}],"name":"kuadrant-maas-default-gateway","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"maas-default-gateway","uid":"371b36ef-c4b7-499a-87db-1bdf4e8f92de"}],"resourceVersion":"20808","uid":"86b5bad7-2bb7-41c9-b2c7-bb4c8f13292a"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"61b044087f8d56658ae99d15d4fab3cf1ad74e6636795c133e054a5aace0540d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e511d90f2140d9cde0b2100a0a488dacadd8f510bb901601d5e6fd25343a0f1c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"1e42d143d6033a677e2aa0de97c78600094e515d7c0d3f86b4925ef8be636163\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"26b7799af8a40e8b9585c255ec018a63b0074c27282d4dccebed45f14e703b5e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"ce74c295ef1588342c7308478a1dc6f6aa2cefc063e489a124e536ac32ecfdba\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"fbe95a07558afcf05ef68ff5beb293f527d6ab93dfe79956b5406dc463d78363\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"40a29ce438b5ca497e4389ce52025a9b91c0cf3177b1bd5c8519b041cfdcf75f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"845137604829fbc62550504d7bbe5ae8d55ea1cf474160cd789a72e811000e4b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5322619ef71b1d1ea3204f9014d0341d4402275b6ca23fca69d61cfc9a61e883\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"16b86e50920afda06ca195a717436238f5fca7f2e1bbe0939875bcb7d559cf31\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5da9070dfa3a5637213b5443376170dda26f57f381af542891ff3b19cc7a9d06\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"00ac1aeee65e93fab2ccfd89c11167f4d954e1cfb3e8b09ad3371a4fab4b6369\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"55c23b9552cb66c175ed2202220df6480eae89be2cda2e925458acf31c5bdbce\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"99f16470bd82ba57465b128d1c0fe73ef189001d77c6ead3fc34c98ad3ce27a2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"a6d134df42d4d90d93840f63dc770cadabd22dc22af01f991b6c067e96733c95\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"0be74a5083c4760789001949965ce7020664f6347b769f9f20735f95f9d34989\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4902f5a84509d49ec2fb75275af9692b524b1334f7c919eff1d9f33957acd5c4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4f0e9d14c4d1857d5415458306310b00d6a94ce68179c717917d13d30ede9b87\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"29d1c55f30b76c66bfb15588c297271fac7d5e9ca415f0c938d63e524a8187e5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"df729ecdaa88f0abfee16b94ea7be9c5aa7ccdfe91fbe0676e22ca4bfae35f29\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"69baf76a5f2e8f4f8d3e40025586b942794274a22455dc40e0b7c0116f0d2297\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"8199294e302361a6898546d62809d67d522e9c2b375c8b8727f0d966f7ad4d39\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"61ef91ec2e76cc107813a7351d7e38bb32d1ebbff452efa771b01f8a512fb99e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"f2d9c20918355999f92bc489c836e0d17ed8acb713739da4b73fc8ee019fc8a4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"c19d17a63dc280a83fa4dce8ef0f825a16118c6817d3126d095473335018edd0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"05aa8311318e9111c5925f4be454406e209ab832bc6e8ddf01725ebe4f1ffdcc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e680857c19914d59f115788ea93836704a1ddab04f5e495bf863d62ad8a5aa8e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"96b761d418352e3f8d172aa80bfb5542df670414bec97704e615f2e3e665c8aa\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4a199d441e37ffe8d62509ae7048cfd055df0de5619e9be81a8f47f9a64a7051\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"f17cbb57db714a7faf03a7e4ef3921069096709486e13c6b84b4b75ded84ca96\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"d8631ed26c63871d1138b31e9c971d72ad1152273309b27ee33862700ff4fb0c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"67a5fec0fb2398a03579a732c5e4640c9f9c5db5385b91db90ffb49522369904\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e5b5be5a42ead835fa1a13840fda21cf5afb14b8226da9a3008a321db777f685\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"a01c6bf1aa626b04ec6a9fc85abb6ced9b4a9c4cafe81d2176013cf3b0b4c4aa\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"0eb9568cf0385cf054d8f3ebcce089d8b225a9fe1b6061e3689f7bd26415f872\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"633e4cdca29207ccc8220565a86635db5bf3f227ef564ee1a0da6a5d6076231e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"ecaead2c94524df89be70a7c961f93dee41ef96545655d22914542a89dffe341\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b9f3d06eb6a92218fa1757dab6cb8e66e42102d46c94e6c0db854f694d6d855c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"7054423a069def7a36dcb993faa1143223d985021782b2552d55a522caf2eba9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"deac1d64e5b84f2fc26848a49153d512090eb1e2bffb72dd7091fd21a1234e18\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"3dbcd4467449162cad999d40988202fafebe535215351d004f1bf05937c76508\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"534f6056dec477fad33defb3049c84dc5497dacd9f6e3f2061b13ba089ed1cbd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"fa823b540319ebed6b9b488f79dda81b66933f7e616cfdaebe3543ae31b33b13\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"fb6ca2eee2169356e662d36e92b2b679a1235a86d976f9807297ad56386f6e2a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"0427c8054235bfb15b63a5a467ab470ce1cca867b5a232117e73059a4ec8891c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4aa2417057e81c2889811e45d786ab1591e3dfafc889b838aad26a3ec2cbfe9b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"acb4b8def068bc86711642e3242fd621a66a54452bf86a82586fc6bf69e8192b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"66831c252eeacbf3e19995c48be4a005b1726766550076c58cb47b979bece639\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"a80090acc18b7b092f5e9f2d49fd8643f16514df89a716f8f69afe4a7afebb76\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"f85e753996f9e90384b461c5504814ca0cada63ea0f44d6630a619ab36edbe08\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b72a3d2d64d0ddc05f076a7fcf59d924552b45080846c09e1084e67867a76e9c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"cd58d9e2c4a744adbc8ab336cd016f27bc1f14a1de2e975afa26b7f5113d1bfe\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"29c80f1787fdadd41eb24cbda56972d49e35d261e06b4f4fcd5851c7e2de3068\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"277489d8f3c2c5149e18b965c81958774efa7e81299a66265853d6af2e16037b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"7c211141c74fe1e91cc494ac860a81616dc49e2a5d1951dc70bf0f42824d53e5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"17df13edb14ef5c49ef0cc29deaea97728695c57b5ccad8feb2b23589083e083\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"014f0c5a15872002db778e7e40dfcf7dede4ab2db05bb6a08641f5d523cb3afc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"bdac37244e7b891cd2973e74c7b0db5110c344505a09a86e51fc6486ba35139d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"ea8a88726b68ceff7de514d89e12df024a67856b697e02c26b6e762395fdaf0d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"81df9bef1abee093a91a2eaab4b1a53122eb16d4150f27c879439ca5d99112f3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b3be2474c46178c0c39839b29d8d7c87b103574b042bb23175ac0e9786fde158\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"13fe2d56bb22ec9a1307da7bad05cdda8724fe788533352aa581ffdc96874c78\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"fbd262e90a5eaaf98d72db889488cbe13bdac9381f78343ea46c402679569fb2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"9794c132b0cd770efeb9723db862265df6a3584117821e44e2a5660a971c59eb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7def4ca304ff3869be64c2c02523fd9d2ff43465099dcd1124399f293eb4480f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"a86375603000eab9b808785894e0e63f3e53024a46681e97c41a06c4e0c67023\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"54eea38241838159e47386cb814ad20fc30631ee8c42d57f0ff8da80fbbf62a0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"d5b69938a04a8020c8a8d10df4921f2989326ca4811c3843a7201bdb1d5cb848\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-unconfigured-model/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c5a685f2a5ebdef5f1dee488990c0798a45ddce399cf99e7d0c505a5f46c69ac\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"0fcfc87f76b773c6a38375e46d76e569a372370e3ae2e7003932ed8ef776f5bd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fac07f302f653115fda3d376325a268abaf66025ed0e4af73e88bea3f41fe933\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"aa28eac51fc5e37c385a11a534759b09fb7998ba74bb01195dd8ff89d9e9ec43\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model-2/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"06165835c4461c0b16a2bc5bae936aff3c2f351edbef8aa378f1110874acedfc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"17390f436804c5d305f1dcb9ea78a72032310736cf630bb9589448f605bd1fd6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m-premium/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ad8714d3b8aed2a9ffd68fbcf0288557e9c1c059c1b59ad3e9a09910b37fd61b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"c4353817d988db43a8dd6b0d5c29305f9dcda76e19c9ef2c820808b0384a0bf4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-embedding-model/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"726a74c13fee356e859d9317271facbb60b066acbc5571de22d056f13c60878f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"1415e0d2aa117656e44a7d6aeaaf16aa87f18bdeee129f7e6757b2e1c7f996d3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-trlp-test-model/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cad6ab5a81a65fd4cb03a0fefdab5de82aa18c30a5b95078b1d05214b0606f40\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"0629facd48a81e3c82281be4a3f8566f55e61d1a30a8516b23bbb63c58e8f6f8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e5f81c7f7812462ebef000c68dc043013159f22201d2eeecf05c220e809f96ed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"2e292ccc99f990aa723c04a99267923f5b62fb8f3e0ab1a978e8334b9397ada0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-unconfigured-model/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"68502d1c1143a647ad56f2759ea89a4c5b3c74a8054739f7e7ea9ba6535e3b74\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"2b69b629cb2b5224adc61a8925f43333ba0b52ab39260c124057e9e82898937f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"74b47f1aa1203aad58596cbaab10ae46e8fddd08ac49eb57a26bdba532d88e72\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"d1e427bebfc099de9df176c73ee76d5dbd6f77919e840913d3a10818678c7394\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model-2/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3167d3bf853032a93e8569019dcd3e5aa33af9cb580cf9ca138990567fc9d857\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"482d2a79771eafe7f8d177701f43a13c6c4916251440ca00830042e050247443\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-unconfigured-model/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"99606c4eac496429be47144db9f3f48867815df12eb99d7be8073b767d7e44de\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"e635ba9dc59ae1e09b34ee6e0f2718b1c31e6f6b6ff2bc6d05c094fedc42c40b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m-premium/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5d590119308c6f848b12dd3ecdfb1b06cc2fe172af702455c342075944a045ff\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"caf1a50009b65f25df3a996283d38ada17bb57a2ebed842a552f137f6121c63a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-embedding-model/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0e042276580ed8976d8ad3afd87a71640025c28b9b48f5c88eb159ec9998209f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e17697b7e023603155a06feebe0602591826e794ee2f5189abf795c259be1b37\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-trlp-test-model/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0829dbf2b5dc0900de272826295adf351de381b46fa6fba00b896213530780f6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"1e772a79f4b1660c75cf3493e21c9ddb58d2de640363115c57dac03a10f22c33\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cc1ffc2ee4e05618c28c108cac668c0c02eb8e658953439e47a733edab44a1a0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4fe1d1c6df78a26f30e2392ae9da7fc67b0845dfda48a89e247bee6aa536d8e1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-unconfigured-model/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"486615827938fa99814e929fe7dc62bc16f7563179fef855074eb73dc7ce4724\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"ee2f6a8baeba450552a3e168b9df1808bba4e2c59106ad0881ae78aee4fcbd40\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-echo-model/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"98ec9d74d07c88c1e6923ed1cbafd4c5b41bf1763b3a942282f964f72425ae57\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"653f23106eb8a10791805e2f9355c750c56aa6873ef311fe707e76083d93d55d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model-2/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2ddbced6f2f51d410743da1d9db1257d0006d99f38986dd7cc7efd26620791ad\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"1e776cd43733621e16ebc27c91dbdeea062f73e4dde2f494701c85a6843faeed\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d752a44ad8df3a50b5a1147110eb89039ed764e1fed197b1f77e0935c424a90b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"62f67bf9885222d9a86a95e02ed17ae26ad7cf71e15aae0a7517e647c29618ca\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3083301b5359be118f04faaefcd72fd127f2297a3374ef7231b59a59a31b405c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"e85460469045801c3e6927ab49333ff01612a4899d5a7c29ec27824b9942f3b9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m-premium/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"67c67ce733de50e7b3d797bb248036b01badfe02e958f5f76af05b58a504989c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"f9b414e31cae5d16cc1ad22ba2462b8816d9369a97316f40f32a6e7912fc4f78\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model-2/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2d4a2275e6cbab5c26d5c3cf2d75aa2776066390e5b66f5498b16b26bc596af7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e33110b3dae1dd80b2bfa573def0b488a6fd4f1243962fe81d58e1853ed2d3f5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-embedding-model/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"23672b974f0dbc05100a34c78d2b029e41f1d5a3752f3fcb52915f56db360e25\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"a6183db94e49e3ba0149a19f4e52ff19aebb55d6261b0cacec0656136bd2adf4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-trlp-test-model/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8274337fc3f0de48e5213819aeb4a46559c4f8b3428c1bae43c0d75207ef5264\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"efcdf81b8f74d74207beb897f447376d1f950ae12e8a330f1ae67b0d9dc6a545\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0e89fc4b75d3a5dd95fca2c4d8ae33c7826f05a8016c44eb39e28c3c1860fcfb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"7f0f599e497ae797f3b5922614ceddb3375c007237412d01b520bb7498ef288d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/premium-simulated-simulated-premium/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ab505bdf28287fe00099987c1bde2c2f297c40c792a7f6cb5fbfa5adc44754d3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"06c1aa31be81b1f5c6266514c955712865b30117291a39dd749994f4ce931145\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m-premium/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1704c6bc15d6f547acca888061680f2275f690cb79e5af6fee44747bcf278b95\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"6a8319194e2c2fc998268cdbab03a5aae2d83019f5ac30c316c4e548895b7c63\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"eaeb360b41b3f9e0bd6b247d4dae3eef1ffc3355d6e9408df3f8f71bc7f033b5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"32cfee4e66c307d5ebed6a406d2260f4374553d184b5486fc53cb64bc6ffcd8d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-embedding-model/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"135ffad9bbcd33779a0b9a1c0dc5d5f547356be21489762803640aca855c728a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"3194cef788c3fa9898599a57480aeaed07c6eac2edf957788235b37d22918588\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-trlp-test-model/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"17002b7f0c8e62582ad262d9c2b8b038ee7f2a9327fe34f21fd4f47134b7b8cf\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5acde2b886749c1c54f99db5c33887e6fc5ed0caf412daacfb5df0f329882c66\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a6a6232fd5656520e75d100c41add5f1637dde9705a4ec608bbb90b724c258a5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"37a71c27032e51fdbc7ca688064a47abb86230a8138af6eb55e8069fad975a93\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-echo-model/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"92917da87eaba4f2684cd45947a3698434b99ff4ca6d3ddde51d6573aecb1600\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b2b26e0af9ad7defb486e5d1db19af6bbdd0998559d16f3776651669aeb4d067\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-echo-model/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aa7038625b8f43b0c002f79637065e5ab90468f50f998759d08f2c4640c07c04\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"2a62f0614f6526bc3f195f838aebd1abe29514f2707db40d9ef738d645ccf001\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"de97dd5d45c6eb12b4a1112ed1f362d8544427428d2249a399e26ba069d6aadb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"22b2ec7ec96ee09c9e07a84cd3d313c2223af42433bbb28c5846401f64d5e3c1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/premium-simulated-simulated-premium/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"dc061bec60bd28b1c132bf30965b4810124429576337bcc4a6030617600d1714\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b188b939a496049e47b8ef664d7c7c490722f1753404a08d89ccec1dcb87b8fa\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-echo-model/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"75612d85af2bae456dadd78163b2d2f9015c0a0bf4e20bcb8a555e6a5ab3b8c0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"96bc4fc13cb63707a942ca33034f78d2b39476a10860398523789db3990584d1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a4493fc88328eba553ef36791fbf4706bffae04a1ac501d099b12309ebc85c6b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"d84e45c7a3e370ea510e8e0294e009b29bc2f2ea789c47559293007b6c4410d2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/premium-simulated-simulated-premium/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2d953f7313807988e63546aa32431d96f77e6989c672f8ab42827c1c21918630\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"dd2f15d9a08862ab664dadf9bf5da25828d327a11a07849fa919713f034c2b0d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/facebook-opt-125m-simulated/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d69b9c128f599c9ea1af84bb3e783ed71688baf6b3ad2b86f2b7183f9a4208b9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"4dfeb9ff2318af8f84e70b11545800bb83948c080a97ae1ece5780d4022bb383\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"dd89509e97b96670685602ae2d08749226db8693944d2c6f868af9d3e0a5feb5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"1025db78adc8b9c9592b692cc227b1a306a99ac5502300d9ed4ed7615f5e3ef8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/premium-simulated-simulated-premium/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3386c5e86c72abcdab369776ccd7182024ab8681cbe497e81724868f101a3c0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"58e90354179740b1af406b2911c9997f3f3283475aeb77ce7918f3b3239a293f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9e75e9fd02f51c2f043b145c5d6b82e95f1447b388ee529262aea27a6a2774ef\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b89d1075a79c93acaa097e4e6db4d6a4b23bf3ffe5e964409e29b258ed725a99\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-2-simulated/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0913a452a02695c6681f1037232199b40b64236fed4d29cdbb41561695826340\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5c0b495d1a10c1cf1548ef17998cb18c0ca25371ad42d5ffe1aed42bd55e31ad\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-unconfigured-facebook-opt-125m-simulated')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"010adf02b2e7deb40c572f4729b6dd4619847c8e6344137326b72df28772fc1a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"c04f8a7c7387e6794115c41161cb001d8a07340d2878cb8f36774a8f6a200ba4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"105cf4dd91a8abf4a93abd65b255521c3d37b560b5d23f3ec59757b5b362fae6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"7e7d1a0ec6d957a4d4de94f93078f10e836b23442c9cfa90f11c8520cca12e87\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-embedding-simulated/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"75fd86e2a4870af5fd78f2ad7aa2a9d79aff977b3678d81954b1e207a9315f2c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"c3cfc634a11046a837448628e2f17db0ed3466194da289a808544d874ecf6451\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-trlp-test-simulated/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"54cd0149b818480305f3d0024b3c95629cafb641b48195d003b2b7006d5c6bcd\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"f5bc618bde549671e84473b23ef3632426f8606e2045744a860c603f2a7675d3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bf65ad13397c94660867eb0205e06d1c9bebda4b019f632c0d0b8ef989930381\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"d8d67afd40f17474755bd3f6b00e265761bf5154febca129bc3f2b0bcd749c41\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-simulated/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f9fa9cfc2b4e701183573419a92c79384cd30210289602f0115c75c5029d55aa\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"ac2105eead12bb02dd7d1691cc77fc8a580b903f98564a8fd585dfa345dec1dd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"596921ddc7ba8523386263c5cffcbd6ad9b6a385318ed7e24f72be06f36fc398\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"f4ae34c5c82a0969651301a535f404653a60a5d75f20c7ea56ad9bb89b67e9fb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f95805f0e9b755664735d898c1d644d571943be553204d3f86136bc35719ff13\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"95c39f44eae69bd53f57e5ff93243887dafd591c9b8cf2e736f0ab034e67021d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/facebook-opt-125m-simulated/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8d5571efc1d304f5bcfc2ffb4ac6819154ba5556c29ce33416d460b887427984\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5d6b359055267732253f201a1fe48f0abe6d5e22b011c70e1cb006eea672f535\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e91aceffc2d4f6d6b120625bd3ca23781b74a1cae6cf1da26bda310bbed0ef07\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"c8475d27649a649c955538ff79eb001372050ff4f1d4ad295b01dc6fcc69ba2a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/facebook-opt-125m-simulated/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a402d1681ab35bace735c19b1d084a86eb3d741d4e1c14371cfdaa55d22c3ebe\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"7320c049419b863194fd55db5ebd887462dd24e1289e6308d79f047431f2bed9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-2-simulated/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f9b535aed6243496a67741936e53a0d303bea1b872a06fb62f1f9c27150edc40\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"5eeab80447ec6c71797517b4d94c6623353e89097743360eadd7f31115976dfe\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/facebook-opt-125m-simulated/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a9800464506c58f005016df354e160757732171ff4d19747202524955329b998\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4984a24eb707d1b965a79974a98ed4afc271f2ca356b150cbc8943de1ddcfef8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-embedding-simulated/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c82a1a3dc2ce54c0b664f79a2cd895a3c40f774b3694999badae8cedd328292e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"276f5d5d67b2bd83c05c2b39e4a262885498e6807e3129a866eff0651b3604a9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-trlp-test-simulated/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"669658556fba0f45c2a82def2f57614416614ddf154ed8dc5f4f9188f10130f2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"692f39321f892929348fe56801dc14c8a35eaf749609a3a5f4b5e684edddf17c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-2-simulated/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c4399a95e89654e5b2bb5fabe45bc947d11ccd1448ebf64c30b195b34f239d58\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5b273834f06c6341dd07bba6c809b3297ba2514e6d3b9b5d0f4f8211c68ccf8b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-simulated/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5e4821ff903ad6ca2e1c42162432e34d8b0a2a78052961e753d36b742193432f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"f35ed2fb168a3a608435006c8c1b103242765d7d37f41bf1dbdb7bbc0331da89\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a91faccafad197e2a4065ce3d12a052ac484d2e8fb2fc9265ee48f02b28e6dce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"fbfd0ada86117ffb0a134e591bf8b8390012983d25496ef188c6da73fef5eaec\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-2-simulated/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0020c64019ffd1a0bdcc75e6441e6a30e6d8bb08f463f67bd2408a1e82b95b2a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e78a4964c93ec23890e62f7f50201f5b832b4c714066a914dc734d8ef60e8213\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-embedding-simulated/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7c924aa2b37ea38067b4e69052d541ea2e7c86fbdaa79b19f9ea09e87adbe4ff\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"d5cf96eeeaa56bb891ea0cba28f7beabf17a8c0f061ea01c768ed842dd26334f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-trlp-test-simulated/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"028a8b5bd5d4e690eebb2f20c5fd47cf0b3c6e2a3619ba9e55322bbca7b94cc3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"8fe4100eab1f023f5b06dd8e19bcc80109b82503466d49576acc234cdda9bf0e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-simulated/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"80056c658070f49140955cb6eabdbd252857a614af6b0f2f2de7a1ab1cd47949\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"53aad0199369eb8c8f787ea099e93092089c04344e8f910dcff366f54bc831cb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-embedding-simulated/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2416d7b42d11a09d7152746be0e114f8fdc87d0fbd0efa9dec5b52b011082194\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e0cfec53d1f17771317082d9a7d69806ae3468971bac79a1135f2b0d51ecdc07\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-trlp-test-simulated/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"50c2058cf11e07a931b06ac4446a56eee86855f00badf26618abe486a7bdcfd7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"f3b6e6c38a521fae8ef5c7fddf3b3178baba88effb4e5338e0b387e28ecc468d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"134a7a790ba665547ca14f80f917549f66ee5063fc41096471c0778399db6dd5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"4ddd3fa1f54c642a57a48737e710ec0116705776084d8cebd8134dfa49accdde\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/premium-simulated-simulated-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4d18a96899c43d55ee63d2ae1a7a938c7e873d88b2fd95f06b2e3aae2c7f1c84\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"44e38055536c3f0d49cb81abb42bfefcf2c78faf963a6160afbe459bbc04db39\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-simulated/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8d34bd12ba2030284fcb69127f53b8158bbdd4a1432bfe619165b4c2c96cc061\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"c9dd9c233e43b53241ee27e937246e51b8f3331f30a7fba22640617c1b0bf47a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/echo-simulator/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"319e246831bdaf5e765e63d5511b516594fd2b64527850e2ddabd2a4a85532ea\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"7cfd2ed5cb8a5913fa5f55b92b02805c6778991c01c80eb14a0962cc710a56ff\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/echo-simulator/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a8c8220ad6f1387002e262ace5db78a2c4bb39e5953306702a228215174f6796\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"87e1712d02794c6d66ec1a932f02901d7a4369f46d0f041178cd3efadb7f59b7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/echo-simulator/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1e077a716d89a43572a3c16e8d0b0436816baa48a2ea227603701f10cad6d6f4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"ae9eac2a2b8c8311bb8c6ea82ab445a5d6f50d2d51c3f79962be9d82007097ad\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/facebook-opt-125m-simulated')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3f23315aacd6e16f4ab41f96aeedc9549d1abdfc9476577a47d45d12875dec5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"165d3b8e224f71685dee07aadd133117aeeed097eae99437d561d5bfa2d22233\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/echo-simulator/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6687eb3cec74c6c51428ce3f3d22d50ba269f59015d1bc8f185da49eb095534e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"05ac0e89d0298398d3996609d7c22b514bdf08bfa3787653bc739995c5942441\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-2-simulated')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bfd36c5ed73eb81df97258ffa1aa36d8cbf6f3e7a8096c33ca4ff417be59d002\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"d5ac583036f3821c88111dd82571eab1fc94aa4e9fcd045b27336f798e26075d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-embedding-simulated')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d303c788902ad4467c7ae545d65cbef45564d1c0d56396c93057df3909461aa1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4a6b0d84cc35c0f532405eea81056481fd54e7ad71284a97ce8f6a2424eac819\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-trlp-test-simulated')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2f53b030326b8e1f5908c601aecd3fffcb6d08a8337d0bdc53ee1fc699a4cd71\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5c3bcd9fb119b0fd45f3b4ba5de5f905cacbb4963fec309a0961a40f76a7a7a9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-simulated')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"098187a2b31ef966f647c443716610cb8d70bdafedfed7bbd4f8b1b568817678\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__4542e5a2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7182a301e3dfb7ea\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/external-model-e2e-rt-sw-847782-931a1687e4da\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-e2e-rt-sw-847782\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__4542e5a2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7182a301e3dfb7ea\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/external-model-e2e-rt-sw-847782-931a1687e4da\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-e2e-rt-sw-847782\"]}],\"name\":\"d4bc8ab4f961e4da03ea520b66c210a99261bedcaa3b8ea63bfd065975305cdd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-rt-sw-847782')\",\"request.headers.exists(h, h.lowerAscii() == 'x-ai-routing-candidate' && request.headers[h] == 'llm/e2e-rt-sw-847782/llm/e2e-rt-sw-847782-a-provider')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b278a3f65d6cc70c6e2d022678205eee6ccd6b0dd1185b975c61ea5d681e4fa7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__4542e5a2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7182a301e3dfb7ea\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/external-model-e2e-rt-sw-847782-931a1687e4da\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-e2e-rt-sw-847782\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__4542e5a2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7182a301e3dfb7ea\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/external-model-e2e-rt-sw-847782-931a1687e4da\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-e2e-rt-sw-847782\"]}],\"name\":\"6552a07f5e2833f4750b76f64454853491f84950146659c393be378468143ba3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-rt-sw-847782')\",\"request.headers.exists(h, h.lowerAscii() == 'x-ai-routing-candidate' && request.headers[h] == 'llm/e2e-rt-sw-847782/llm/e2e-rt-sw-847782-b-provider')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f2c2136cce9996c6759167fa60069837847d9ea22d6e56807977daa75c023880\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__4542e5a2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7182a301e3dfb7ea\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/external-model-e2e-rt-sw-847782-931a1687e4da\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-e2e-rt-sw-847782\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__4542e5a2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7182a301e3dfb7ea\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/external-model-e2e-rt-sw-847782-931a1687e4da\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-e2e-rt-sw-847782\"]}],\"name\":\"0287b5f79a9ea9c5727b8e30382d6b00dda3c0780d0d20fe1eb383ba4ba03707\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-rt-sw-847782')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"94ddc5e77f082c32bebc7a36bcebf621518ebf303e83b9c540da1352d04e620b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"50057c9a2acf4ae7152e8c97f7778cb04340d1470974e5272422d0bf244a4e5c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/echo-simulator')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c6918972d1a7f8ad5201880b7d6d9c1191ca1f25376682f691def7868e3fd02\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"01cc37113b4d6c301e355f63decf46a21e93a023494bdfeaeed2890c97ec1f57\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a82769ff87473da04c27497e160e9b4b1a5dd93578e0cf2342be8b2f06845269\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e747b72d92315b743934153588614b27670cf0c9d9dc4fb380ea4965def7f235\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"06b05a8e4dd69bdc4f333ad9509ee8cad3c5c0f5dd48edbe94c1158b60f79ed3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"661962837510c6dc6d1faa64e61ec3086efa9e0a2e7315c6ded616c1879e5ba8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b4bfec1b33959dd0ebfc5cd6fb410688e820d4b55c7f149cb4acc4353f30a9b2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a7740f6e77d024a437502c023fb1d8939cb3cc2b9ed7f4073af7d779e19459eb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"f82564e076ea3e672592bab71e048537faba17a5e909884c2a0204e235905a69\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2ecffd49fe780ea8d7ee498582caa2c41bc635ad490315792e681c7defe84b85\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__4542e5a2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7182a301e3dfb7ea\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/external-model-e2e-rt-sw-847782-931a1687e4da\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-e2e-rt-sw-847782\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__4542e5a2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7182a301e3dfb7ea\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/external-model-e2e-rt-sw-847782-931a1687e4da\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-e2e-rt-sw-847782\"]}],\"name\":\"f9bad537fbe7a6c4935a5a7c8686a356adaa96259346b265b4b0283d55b8466d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'e2e-rt-sw-847782')\",\"request.headers.exists(h, h.lowerAscii() == 'x-ai-routing-candidate' && request.headers[h] == 'llm/e2e-rt-sw-847782/llm/e2e-rt-sw-847782-a-provider')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"528f8663751fc08f3e8ae4ff6fd43a63d61572c7f149dc0fe75912f5f4b33047\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__4542e5a2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7182a301e3dfb7ea\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/external-model-e2e-rt-sw-847782-931a1687e4da\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-e2e-rt-sw-847782\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__4542e5a2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7182a301e3dfb7ea\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/external-model-e2e-rt-sw-847782-931a1687e4da\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-e2e-rt-sw-847782\"]}],\"name\":\"3ab01a6a4b50257801cab44c4e08e694374d0c202b60aafd1e6d17ac6c55021d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'e2e-rt-sw-847782')\",\"request.headers.exists(h, h.lowerAscii() == 'x-ai-routing-candidate' && request.headers[h] == 'llm/e2e-rt-sw-847782/llm/e2e-rt-sw-847782-b-provider')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a908063c86927e6bf07b7d793aad9f277ac3c2a8f5f5d468b116cb9e07929b14\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"fbdfff5b213f506d78434055d011cf63d616653e502ee04408a43578986e1e5c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d1d232e06f90d479cd9b802f24889e83af58c51cf54ba273d5e24dcb8a297688\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b49f2d7e152d4de959577465d2494ee11771b4c439cb6eae71c90bff26224fb4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"810f299b76daf089b33c92cfbe0445ab5cc89a48d38e36df0cc89ed6cd1fe8df\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b27d6255cac73fc039120e157e1f3ce0e99e86995ac5a66974d5e8744df6c64d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4f800155f293f82eeaf5fd6a9553c0a1bee90f47a295bba8d7a04b3f11faea33\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b1ccc7ca46f6a14e90afe1dddfab8763f07f30549ce1cda0bae985581f063098\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ce7d381faee9ff949d68d825ffa1dcb9247dad19667ec59a8e91847320dacbe0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5d72fc7cc241ffd60d83142a900be014cc5d57320142e013493b21ecc86cb534\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6565c4085b3917d5390fe1b0194fb3d8319f1d56b45867e3c68ff740b5c16ef3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"be1ccea8a4cc19c7190600de6631fcb661b63db81e2862348a6ef4f90bf33fa3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8d8c8aae1332bb0300ac2d65be9b8708fbfde6d4b5599ec52380cf1f70956045\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"ca48ea5d9ee701ac5383800306378d945e66ca5427eba33396e6805ebbdc1ea7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f6df6bc14432fdc346191db86ee06e75c8090ed87a32c984493c837e97a10be6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"fc54a1d4f18d4d59e58b6a3aa31dbfaddda2b89e5c28dc9eacf14ff38a414021\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9334f6c4c6b2cfb832fd9a39b0561e5c62f23a08c15c55dfc962b5a6da247320\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__4542e5a2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7182a301e3dfb7ea\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/external-model-e2e-rt-sw-847782-931a1687e4da\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-e2e-rt-sw-847782\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__4542e5a2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7182a301e3dfb7ea\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/external-model-e2e-rt-sw-847782-931a1687e4da\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-e2e-rt-sw-847782\"]}],\"name\":\"6036fdddcec1262c47615be8298664a938467ff4b83bc113d55063da687a966a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'e2e-rt-sw-847782')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"maas-default-gateway"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-maas-default-gateway\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:25:30.023Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-e2e-rt-sw-847782","namespace":"llm","uid":"ac76a284-ab3c-4e2d-94fd-5ea4dec861ab","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-e2e-rt-sw-847782\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:25:30.614Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w2-6fa533","namespace":"e2e-models-e2e-worker-w2-6fa533","uid":"3a128bb2-de88-49aa-ab9e-c8626107a077","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w2-6fa533\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:25:30.733Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-worker-w4-d6cb38","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-worker-w4-d6cb38\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:25:30.764Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"external-model-e2e-rt-sw-847782-931a1687e4da","namespace":"llm","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"external-model-e2e-rt-sw-847782-931a1687e4da\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:25:36.170Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway","AuthConfig","TokenRateLimitPolicy","AuthPolicy","HTTPRoute","ConfigMap","EnvoyFilter","Limitador"],"eventTypes":{"create":7,"update":8}}
{"level":"info","ts":"2026-11-02T21:25:36.297Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:25:36.938Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:25:37.038Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:25:37.038Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:25:38.242Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:25:38.246Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:25:38.242Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:25:38.252Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:25:38.252Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:25:38.252Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:25:38.364Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T21:25:40.492Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w2-6fa533","namespace":"e2e-models-e2e-worker-w2-6fa533","uid":"3a128bb2-de88-49aa-ab9e-c8626107a077","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w2-6fa533\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:25:40.553Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:25:40.556Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:25:46.189Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["HTTPRoute","EnvoyFilter","ConfigMap","AuthConfig","AuthPolicy","TokenRateLimitPolicy","Limitador"],"eventTypes":{"create":12,"delete":2,"update":10}}
{"level":"info","ts":"2026-11-02T21:25:46.322Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:25:47.049Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:25:47.223Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:25:47.223Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:25:48.575Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:25:48.623Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:25:48.638Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-02T21:25:48.638Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:25:48.660Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:25:48.660Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:25:48.664Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:25:50.931Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:25:50.931Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:25:56.701Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Limitador","TokenRateLimitPolicy","ConfigMap","EnvoyFilter","AuthPolicy"],"eventTypes":{"update":17}}
{"level":"info","ts":"2026-11-02T21:25:56.829Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:25:57.434Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:25:57.544Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:25:57.544Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:25:58.849Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:25:58.853Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:25:58.853Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:25:58.864Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:25:58.869Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-02T21:25:58.869Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:25:58.923Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:26:00.645Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:26:00.645Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:26:06.352Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["HTTPRoute","ConfigMap","Gateway"],"eventTypes":{"create":1,"update":3}}
{"level":"info","ts":"2026-11-02T21:26:09.685Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:26:09.690Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:26:09.737Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:26:09.737Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:26:09.739Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:26:09.741Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:26:09.896Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:26:12.382Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:26:12.382Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:26:21.774Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","Gateway","HTTPRoute","EnvoyFilter","AuthPolicy","TokenRateLimitPolicy","Limitador","ConfigMap"],"eventTypes":{"create":13,"update":21}}
{"level":"info","ts":"2026-11-02T21:26:21.954Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:26:22.748Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:26:22.854Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:26:22.854Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:26:24.442Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:26:24.447Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:26:24.451Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:26:24.452Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:26:24.452Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:26:24.456Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-11-02T21:26:24.560Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:26:24.560Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:26:27.030Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:26:27.088Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:26:27.957Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["HTTPRoute","Gateway"],"eventTypes":{"create":1,"update":1}}
{"level":"info","ts":"2026-11-02T21:26:30.550Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:26:30.553Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:26:30.553Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:26:30.557Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:26:30.561Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:26:30.563Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-11-02T21:26:30.668Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:26:30.668Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T21:26:30.675Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/external-model-e2e-rt-eq-d2da5a-04e45017708d","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/external-model-e2e-rt-eq-d2da5a-04e45017708d#rule-6"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"15b2e87aa08919282b8acd840a1e8677e8854f820cb1d4115c0f0ebbeba4b541","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["15b2e87aa08919282b8acd840a1e8677e8854f820cb1d4115c0f0ebbeba4b541"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"15b2e87aa08919282b8acd840a1e8677e8854f820cb1d4115c0f0ebbeba4b541\" already exists"}
{"level":"error","ts":"2026-11-02T21:26:30.742Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"371e486415502802484cc345e68be13e0a37a1abb38f2f6c8cce9f8e79b8d9c1","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["371e486415502802484cc345e68be13e0a37a1abb38f2f6c8cce9f8e79b8d9c1"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"371e486415502802484cc345e68be13e0a37a1abb38f2f6c8cce9f8e79b8d9c1\" already exists"}
{"level":"error","ts":"2026-11-02T21:26:30.834Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/external-model-e2e-rt-eq-d2da5a-04e45017708d","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/external-model-e2e-rt-eq-d2da5a-04e45017708d#rule-3"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"dc6a6f9b82cff312739bacc49810b2d51c7df335dc8178b49ebd65433b463649","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["dc6a6f9b82cff312739bacc49810b2d51c7df335dc8178b49ebd65433b463649"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"dc6a6f9b82cff312739bacc49810b2d51c7df335dc8178b49ebd65433b463649\" already exists"}
{"level":"error","ts":"2026-11-02T21:26:30.902Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route#v1-completions-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"e199374b1d053d8a1ea2fb463b47f0da1b100cb9029acd61282384f0bb2553a2","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["e199374b1d053d8a1ea2fb463b47f0da1b100cb9029acd61282384f0bb2553a2"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"e199374b1d053d8a1ea2fb463b47f0da1b100cb9029acd61282384f0bb2553a2\" already exists"}
{"level":"error","ts":"2026-11-02T21:26:31.005Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-worker-w2-6fa533","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T21:21:58Z","generation":6,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"350cbfc3-ae8f-47d8-bf88-3bc797a06de4\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:25:49Z"}],"name":"kuadrant-e2e-worker-w2-6fa533","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-worker-w2-6fa533","uid":"350cbfc3-ae8f-47d8-bf88-3bc797a06de4"}],"resourceVersion":"33581","uid":"e9c29fe8-1b7a-4730-9bc2-e4f3e80147bd"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2538346ffaabe171687c406d12f294530661f7690a04d14ab2327034447b1886\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"fc3c7a9daa18c716699d2f1fa233a5848a5d36cd60feee59a35bb57159d77252\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"df8548d2a100989756489c2811783626f3836ef18d08ba8c81bfb6b9e9ef9c28\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"983a86a79f65831a149f35f3c7673bbfb37560154023198d82ebb8965ed48c8e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/premium-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"13cb74b6bdfe9b2af39effc13c9d5ade5172cb10a5930c6aefbe733c0ab0cad4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"462645ad06b45e6f5c9824c64f8ebc4010534cdeadc425c4ab2c9b0594a88a7d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2538346ffaabe171687c406d12f294530661f7690a04d14ab2327034447b1886\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"53b8e179280ac5286bf38489ea72372b11c85a8c387359bf689ebecff1663d36\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"df8548d2a100989756489c2811783626f3836ef18d08ba8c81bfb6b9e9ef9c28\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"c166f75566a6849f94f19ff1eaf52bbfeb65e132db0ce99439215a5fba3cf50f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/premium-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"13cb74b6bdfe9b2af39effc13c9d5ade5172cb10a5930c6aefbe733c0ab0cad4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"2eb901a322f6f85745b1b216f71a9aeaf7eef69af5cc7ad9aead13448f127634\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2538346ffaabe171687c406d12f294530661f7690a04d14ab2327034447b1886\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"89b4eca3220447cd92c83c9c71f9e61e645c1f746a07d9b87eac9b2d4af27f2a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"df8548d2a100989756489c2811783626f3836ef18d08ba8c81bfb6b9e9ef9c28\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"82b649105e404b52dbe59777c528effe8ddcaf390c919bc52a045d6654c17d27\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/premium-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"13cb74b6bdfe9b2af39effc13c9d5ade5172cb10a5930c6aefbe733c0ab0cad4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"0491f04b3838b4a997ad42c2f3b87b5bc525f5236ef6a51647a0af61e52bf52d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2538346ffaabe171687c406d12f294530661f7690a04d14ab2327034447b1886\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"0f54f971c3b78f7352580f77fc5be3e00c2117ef445b417be77bf67ea75539a5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"df8548d2a100989756489c2811783626f3836ef18d08ba8c81bfb6b9e9ef9c28\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"616030c276c95a5326d811265a5516c30019307d032046e4dbf9c60aed89bb9f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/premium-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"13cb74b6bdfe9b2af39effc13c9d5ade5172cb10a5930c6aefbe733c0ab0cad4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"60974e3173a2c5fa225357d66a1c4055fbb2b76b845de70e5504acc58902d471\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2538346ffaabe171687c406d12f294530661f7690a04d14ab2327034447b1886\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"6982a3a190cf8786b034f1d39a14b07dab2e5311ed66344e600b389726798c72\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"df8548d2a100989756489c2811783626f3836ef18d08ba8c81bfb6b9e9ef9c28\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"d8b01a7d8bf17be310055802641797f595c1e7290b01b91e2b87cf0300418b94\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/premium-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"13cb74b6bdfe9b2af39effc13c9d5ade5172cb10a5930c6aefbe733c0ab0cad4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"28c14a49b36fb1c2749324536c3bd478da8cea176c30e855a8c62d376476a248\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2538346ffaabe171687c406d12f294530661f7690a04d14ab2327034447b1886\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"87456404dc6fbf2160a52ba615889680b0c5cf40dc6100bb0e888288606dff25\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2538346ffaabe171687c406d12f294530661f7690a04d14ab2327034447b1886\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"8b9c2ea6de06bba9ed1ba2a65e99d1500ef45630a372914ecf445da73d74600a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"df8548d2a100989756489c2811783626f3836ef18d08ba8c81bfb6b9e9ef9c28\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"9222b1bebeb91f5bc797ef6f55e59f628b5f90c3da7305c7a50abb490cf18e24\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/premium-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"df8548d2a100989756489c2811783626f3836ef18d08ba8c81bfb6b9e9ef9c28\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"63ba67de9ead24d6aab10a349447139ea4c7227426ee6072b8939e91ccf0ed30\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/premium-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"13cb74b6bdfe9b2af39effc13c9d5ade5172cb10a5930c6aefbe733c0ab0cad4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"b23898184efef7f96fc649e5d2902d9e6f7d32805be8858eb5f57e88696a09d3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"13cb74b6bdfe9b2af39effc13c9d5ade5172cb10a5930c6aefbe733c0ab0cad4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"652be1bab4f56953c3da93778aeff670b21e92a5d993934466d89aaed158b5b6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2538346ffaabe171687c406d12f294530661f7690a04d14ab2327034447b1886\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"d58c446a6a9364595eaae0256bc0befa6f57ed0387674ac1d6970632cb6b41f0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"df8548d2a100989756489c2811783626f3836ef18d08ba8c81bfb6b9e9ef9c28\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"6e120ade3c6d3506708dea5d54e9bc2fd6306ec4718a0c11f9c0a89c0ea6f1cd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/premium-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"13cb74b6bdfe9b2af39effc13c9d5ade5172cb10a5930c6aefbe733c0ab0cad4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"f9f60e3c0c3c06fefd218a3662bf2dac472c1d5acfd112579332b16c2386f504\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"79e41416d85afbda9f192c421571f899a58b4937465fe640fd4d17dfb0d8240e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-6fa533\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-6fa533\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"af109b5290beff4991ef93d4a835ce24ed3b0986578fba7947a76ca1a6dd65e2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8abe3e629bd34674437803d6e54a0cb90fe0d0df12d2eac23f0b40d2f4990b37\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"ccb67df939c7a3278e2bb82db8d5dc418650599ab46b4bd1d8fe07cf9bb459d0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"371e486415502802484cc345e68be13e0a37a1abb38f2f6c8cce9f8e79b8d9c1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"b41e21a5fb7ad8cd75dbaa2def82137084248aef58468ce3d04ebccec2987b3b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-w2-6fa533/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8f50bf1a21545f68eb583e07935b8b0da52bbc4743a8bc67c4d9545b76da56af\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"7206c2870629f698a99d45c9e7140cc1334b531b1ad5a3c88c147fac40e793b2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/premium-w2-6fa533/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"503064d3f84a23711f1dad5e35d11ef1efceaefb2204608d180ef8d886666ffa\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"1036f7f4f8b7c68faa7a499350cf496a96528b515b125a726c7e904d5297c1e6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e199374b1d053d8a1ea2fb463b47f0da1b100cb9029acd61282384f0bb2553a2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"fc0e1b2816287c18a95319a2d0a9379a9f7bf931fff586f75645e37973bc0009\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-w2-6fa533/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"41e99bc62a2ac4e8034135f4b655088597f627c66b2efc4627394d148bc2b0ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"b2fa16adeef96749257d873656ef49327fe454d7ba806ae3a8a73ec44c8a092d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2f2531e01fa8fc0031706fadbba0c1818c30681dcf9d2c65b1c7c23230ea3a32\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"d04838d25723911d554e0017a035ebf67253923630681f27a1c93b44878b1bcc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/premium-w2-6fa533/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f1edf5f89fd287762fbbefa668581cdc8f1877a3f31497227c537000670166d9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"dbf8e642e7e029e70e317d8df7b5d12be0fc1f008d29ff415d7291c09924eecb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cf13f5a3da5f1ddbc441422b55ececcb0ffd227c7be1c942dc1d4c428387bca0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"0aa6387a836e4d80af5fd5a2d66846f1a40192a89e137f80c52334aa6d868a1c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-w2-6fa533/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"afe9746e0af749da011756561a859419e447efc535f5e3f3773b1d18a5b5a9ac\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"7ae7a5b24207da4f6cb3659a8b6639f53e96a876f02aaa1f0a8b92813f856ad7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/premium-w2-6fa533/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"739e19d51d8fbdeccfc8bc7587afd12132239f688ec6cf8d9586f242a71087f7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"5f4124bfb1cf4c49006c1e2d45346f89a11b72e563d9f8e2d4df054bb65c496c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-w2-6fa533/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8309dc44d5088e48040255bf86dbc622de08fc216837cd0027a69bdf179a9d2a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"206d678ecc5400943db26abb21afd48a2ffc6fee651aa73c8301a56858221aa0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/premium-w2-6fa533/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"206e50a9b0e5f83281f994d9f1d85f92406e3544297c47017c081f763b10dd96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"1d9b68bda9fa73e5f8e8ac869771d602c5f128903fd22e64db2370f9749a3113\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6ed7710bfd4535612b60aefac40ff2eebbe50fc666cc75f29a23130bdd6ea269\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"1245658c93fce9ced820408e5e090ae4dd51a7c56161a6cfb1ef978beecc3557\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"62457e23e29ce9b4e8380d685c5e9e84bc5137e91486a6f9c1c9e352ca3a021c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"957121ddf9ee4c2793cec71a8576e07ee1925a201f93c8de02b6fce446d010d8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1ce9b189744d237515a1896d038a3437e8e31669b01937d8cf3a067728ee7e82\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"672be8f3fbaf802659dc395e46e1b17c7ab1515e557eab74f4c7d2c055ad4cf7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/premium-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"881b63d46f0e94053b88caefbfd71fdab183199879cb564ccb3671b6189fcc2e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"4e3e10829c680ef4fa33002314a596e964d519ea2f3cd6331d666a22cfb597e5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0947683a63afc3251194a3b586cb934b1350dcaa171c4fd826d6773a00d5cf2a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"88202ce79ddf6dca9b8c8b1fbc0aa013155bc9975075ee9158a09c6708287af4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fd7deaf8530c822c1b10ef4c1b0887086bc840af6d5c7a730508ddcb6e179095\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"14655ca6105b9121c6e780127a21626d2e779082f0ea2674b0d77647d247a24c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5ea067858e444716d33ddecbe718b086e12804ce72bba0a6f135b64fb1bb1c60\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"c88bc53da3544fc41175edc07ced29960aa58c4f7ebf17609eb30f993b862ccf\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"60ca770315801fd35b67ab23639ba4ac6a344fcf95fe492c267cc87cb90ce14f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"d7f0af7e7ca785bc5de89e740ff47459e16eb3ba9360c1eee59d6d8d2f7389bd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6d6f6c08f92b4cefaa6a997643ec612cf9c62df4fa750dd0f5d4c3d50d40d2bb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"daf823a39b0f169fe5f258178380bcf0b3e996152ebcc401fb21de178f041b24\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1f83c46a7c87c216ad3b7a3697a1ad6c518cb36972a910efbc3c7eed6ab3956a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"496ec6213c84428bc1374936695dcb9246c04c80a4460a92e53220e4641a7116\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e701c3e95fd6d7e3e60b9f162039289bbc904c42df899db9436b6ad7538d1ffc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"576f13852617450ef4f108d2d8c65426c74c6f743bd5e3d6530d746e72633fbc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"25cb748ea88f201b192c863c4e2fb40e5931cd9cfed0d04ae104e35dbe48f38b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"c49c039641c1cdbec2a8f5cc805b4b722943e1336d082080571a2f2fcb073186\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ad04b751b35d313ca76c5057f5e800aa0d5504bc27298aa1762dd803d351bff2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"a24ccfd407372af3bd4160c32a086ddd01bc5d92e15a1f783cdc3f7d8f642124\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3ecbc6560d7cb2e5396471349d24b95ff664f3b33dfc188e590c2b772721287c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"2e058e1b6b4635806a5e2b8fb08fed6fd11db7595be6907f89a86777a30aa9b5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"319a8bd03b55a51284dd6790058e026879ed8db3e6d527dedb4a9314473afa5b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"ac54aac970a6722b49c3410bffc6b58a3832c579aa7c3629ff80507ab769f2d3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8be72fdf7a1e6b1379ac7dc12f7c40286d882ef14376e9fd3e726b2fb781546c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"ac78bc480a068b655886c2d9dd75e3a680756398111216d2be7e8a3e730e4206\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"23d2f913b5bde1ed64144a38680e6282220982f4f5ea1167fabdda3234dbc67e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"c6c6e62fb02ec82dd2ad63c3690b3887e0701c293e1871ee382d92ea80f88f66\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"51e9e3c7450b52b22ca45c280738926226df3d95852d8df43ff47cf85cca9e5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-6fa533\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-6fa533\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"64fb7512cad2bf5a1c9b6978a7f9de714d5a739282aa9ca951ee3b4f417da286\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"dfa08453b9c8623db01e432dea4f9e09b3d7f80cbbee3a69df753c6d3fbfbded\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-6fa533\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-6fa533\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"af2b1c5e2c0a798508b2ef3249c778b1b43898c8636c878f66d20c220701a6f4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"517c7132d716e14e14b2c9fccd696f86bc7a24a46c391e71d07ac910d0dd1c18\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-6fa533\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-6fa533\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"ee9f66c18cbc8fcbae62d62e57dcbad633d943ff04a829fbc8bb030c121bf426\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b93afde66771848b5188f78e530f2f596324f9fb9f05b2dd8f1cb49489f2bda1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-6fa533\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-6fa533\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"c514ea15546ae0041f8d77a7e65bd51a98d808edee2739e914353f03c270d86d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"de3ca7c8a9dcdebe0c2a67b74b3bc72bdc4a8f34aff1f0c69df675fbb03b1e05\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-6fa533\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-6fa533\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"985f90a1588b57b9e2061e7440127c4729ab98e674bb91d1e90364de9aea35ad\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"edbbdcfc920b88151941be1a4c41ad8be6a38bd6beddae7387db202bc3e9b302\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"15153104d9c89c44b59d96d9d8825fe62d21af5bd4db90b6c300fa53823a0ef0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bf3fa706be871596c50143869f253e98ce7aa463d723d2f419d378a041dbfbe5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"4e925c4610a758f575689b807fc7a61cef2c3891e2cf0a1c1074186e65a2e8fd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/premium-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f09ce0bd9bc651317469310c8a604d792e7c7c55751d184a920638cf66ba0dd5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"499fc57e7a454d5bcd94feeb06b43584bb9133eb048e9ee5f20041a16d87ebaa\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-w2-6fa533')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-worker-w2-6fa533"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-worker-w2-6fa533\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:26:31.011Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route#v1-chat-completions-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"881b63d46f0e94053b88caefbfd71fdab183199879cb564ccb3671b6189fcc2e","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["881b63d46f0e94053b88caefbfd71fdab183199879cb564ccb3671b6189fcc2e"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"881b63d46f0e94053b88caefbfd71fdab183199879cb564ccb3671b6189fcc2e\" already exists"}
{"level":"error","ts":"2026-11-02T21:26:31.078Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route#v1-messages-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"ad04b751b35d313ca76c5057f5e800aa0d5504bc27298aa1762dd803d351bff2","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["ad04b751b35d313ca76c5057f5e800aa0d5504bc27298aa1762dd803d351bff2"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"ad04b751b35d313ca76c5057f5e800aa0d5504bc27298aa1762dd803d351bff2\" already exists"}
{"level":"error","ts":"2026-11-02T21:26:31.145Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"6ed7710bfd4535612b60aefac40ff2eebbe50fc666cc75f29a23130bdd6ea269","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["6ed7710bfd4535612b60aefac40ff2eebbe50fc666cc75f29a23130bdd6ea269"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"6ed7710bfd4535612b60aefac40ff2eebbe50fc666cc75f29a23130bdd6ea269\" already exists"}
{"level":"error","ts":"2026-11-02T21:26:31.210Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route#v1-catch-all-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"8be72fdf7a1e6b1379ac7dc12f7c40286d882ef14376e9fd3e726b2fb781546c","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["8be72fdf7a1e6b1379ac7dc12f7c40286d882ef14376e9fd3e726b2fb781546c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"8be72fdf7a1e6b1379ac7dc12f7c40286d882ef14376e9fd3e726b2fb781546c\" already exists"}
{"level":"error","ts":"2026-11-02T21:26:31.279Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/external-model-e2e-rt-eq-d2da5a-04e45017708d","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/external-model-e2e-rt-eq-d2da5a-04e45017708d#rule-2"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"456e5dd7dfa9810034544082c8cba90a71807c15f93751d5e3f6273265dd2a02","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["456e5dd7dfa9810034544082c8cba90a71807c15f93751d5e3f6273265dd2a02"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"456e5dd7dfa9810034544082c8cba90a71807c15f93751d5e3f6273265dd2a02\" already exists"}
{"level":"error","ts":"2026-11-02T21:26:31.346Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route#v1-completions-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"5ea067858e444716d33ddecbe718b086e12804ce72bba0a6f135b64fb1bb1c60","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["5ea067858e444716d33ddecbe718b086e12804ce72bba0a6f135b64fb1bb1c60"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"5ea067858e444716d33ddecbe718b086e12804ce72bba0a6f135b64fb1bb1c60\" already exists"}
{"level":"error","ts":"2026-11-02T21:26:31.412Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route#v1-responses-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"cf13f5a3da5f1ddbc441422b55ececcb0ffd227c7be1c942dc1d4c428387bca0","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["cf13f5a3da5f1ddbc441422b55ececcb0ffd227c7be1c942dc1d4c428387bca0"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"cf13f5a3da5f1ddbc441422b55ececcb0ffd227c7be1c942dc1d4c428387bca0\" already exists"}
{"level":"error","ts":"2026-11-02T21:26:31.481Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route#v1-model-routing"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"13cb74b6bdfe9b2af39effc13c9d5ade5172cb10a5930c6aefbe733c0ab0cad4","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["13cb74b6bdfe9b2af39effc13c9d5ade5172cb10a5930c6aefbe733c0ab0cad4"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"13cb74b6bdfe9b2af39effc13c9d5ade5172cb10a5930c6aefbe733c0ab0cad4\" already exists"}
{"level":"error","ts":"2026-11-02T21:26:31.551Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route#v1-responses-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"e701c3e95fd6d7e3e60b9f162039289bbc904c42df899db9436b6ad7538d1ffc","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["e701c3e95fd6d7e3e60b9f162039289bbc904c42df899db9436b6ad7538d1ffc"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"e701c3e95fd6d7e3e60b9f162039289bbc904c42df899db9436b6ad7538d1ffc\" already exists"}
{"level":"error","ts":"2026-11-02T21:26:31.608Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/maas-default-gateway","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T21:16:03Z","generation":10,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"371b36ef-c4b7-499a-87db-1bdf4e8f92de\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:26:10Z"}],"name":"kuadrant-maas-default-gateway","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"maas-default-gateway","uid":"371b36ef-c4b7-499a-87db-1bdf4e8f92de"}],"resourceVersion":"34158","uid":"86b5bad7-2bb7-41c9-b2c7-bb4c8f13292a"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"61b044087f8d56658ae99d15d4fab3cf1ad74e6636795c133e054a5aace0540d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e511d90f2140d9cde0b2100a0a488dacadd8f510bb901601d5e6fd25343a0f1c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"1e42d143d6033a677e2aa0de97c78600094e515d7c0d3f86b4925ef8be636163\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"26b7799af8a40e8b9585c255ec018a63b0074c27282d4dccebed45f14e703b5e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"ce74c295ef1588342c7308478a1dc6f6aa2cefc063e489a124e536ac32ecfdba\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"fbe95a07558afcf05ef68ff5beb293f527d6ab93dfe79956b5406dc463d78363\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"40a29ce438b5ca497e4389ce52025a9b91c0cf3177b1bd5c8519b041cfdcf75f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"845137604829fbc62550504d7bbe5ae8d55ea1cf474160cd789a72e811000e4b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5322619ef71b1d1ea3204f9014d0341d4402275b6ca23fca69d61cfc9a61e883\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"16b86e50920afda06ca195a717436238f5fca7f2e1bbe0939875bcb7d559cf31\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5da9070dfa3a5637213b5443376170dda26f57f381af542891ff3b19cc7a9d06\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"00ac1aeee65e93fab2ccfd89c11167f4d954e1cfb3e8b09ad3371a4fab4b6369\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"55c23b9552cb66c175ed2202220df6480eae89be2cda2e925458acf31c5bdbce\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"99f16470bd82ba57465b128d1c0fe73ef189001d77c6ead3fc34c98ad3ce27a2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"a6d134df42d4d90d93840f63dc770cadabd22dc22af01f991b6c067e96733c95\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"0be74a5083c4760789001949965ce7020664f6347b769f9f20735f95f9d34989\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4902f5a84509d49ec2fb75275af9692b524b1334f7c919eff1d9f33957acd5c4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4f0e9d14c4d1857d5415458306310b00d6a94ce68179c717917d13d30ede9b87\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"29d1c55f30b76c66bfb15588c297271fac7d5e9ca415f0c938d63e524a8187e5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"df729ecdaa88f0abfee16b94ea7be9c5aa7ccdfe91fbe0676e22ca4bfae35f29\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"69baf76a5f2e8f4f8d3e40025586b942794274a22455dc40e0b7c0116f0d2297\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"8199294e302361a6898546d62809d67d522e9c2b375c8b8727f0d966f7ad4d39\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"61ef91ec2e76cc107813a7351d7e38bb32d1ebbff452efa771b01f8a512fb99e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"f2d9c20918355999f92bc489c836e0d17ed8acb713739da4b73fc8ee019fc8a4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"c19d17a63dc280a83fa4dce8ef0f825a16118c6817d3126d095473335018edd0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"05aa8311318e9111c5925f4be454406e209ab832bc6e8ddf01725ebe4f1ffdcc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e680857c19914d59f115788ea93836704a1ddab04f5e495bf863d62ad8a5aa8e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"96b761d418352e3f8d172aa80bfb5542df670414bec97704e615f2e3e665c8aa\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4a199d441e37ffe8d62509ae7048cfd055df0de5619e9be81a8f47f9a64a7051\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"f17cbb57db714a7faf03a7e4ef3921069096709486e13c6b84b4b75ded84ca96\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"d8631ed26c63871d1138b31e9c971d72ad1152273309b27ee33862700ff4fb0c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"67a5fec0fb2398a03579a732c5e4640c9f9c5db5385b91db90ffb49522369904\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e5b5be5a42ead835fa1a13840fda21cf5afb14b8226da9a3008a321db777f685\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"a01c6bf1aa626b04ec6a9fc85abb6ced9b4a9c4cafe81d2176013cf3b0b4c4aa\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"0eb9568cf0385cf054d8f3ebcce089d8b225a9fe1b6061e3689f7bd26415f872\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"633e4cdca29207ccc8220565a86635db5bf3f227ef564ee1a0da6a5d6076231e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"ecaead2c94524df89be70a7c961f93dee41ef96545655d22914542a89dffe341\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b9f3d06eb6a92218fa1757dab6cb8e66e42102d46c94e6c0db854f694d6d855c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"7054423a069def7a36dcb993faa1143223d985021782b2552d55a522caf2eba9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"deac1d64e5b84f2fc26848a49153d512090eb1e2bffb72dd7091fd21a1234e18\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"3dbcd4467449162cad999d40988202fafebe535215351d004f1bf05937c76508\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"534f6056dec477fad33defb3049c84dc5497dacd9f6e3f2061b13ba089ed1cbd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"fa823b540319ebed6b9b488f79dda81b66933f7e616cfdaebe3543ae31b33b13\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"fb6ca2eee2169356e662d36e92b2b679a1235a86d976f9807297ad56386f6e2a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"0427c8054235bfb15b63a5a467ab470ce1cca867b5a232117e73059a4ec8891c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4aa2417057e81c2889811e45d786ab1591e3dfafc889b838aad26a3ec2cbfe9b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"acb4b8def068bc86711642e3242fd621a66a54452bf86a82586fc6bf69e8192b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"66831c252eeacbf3e19995c48be4a005b1726766550076c58cb47b979bece639\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"a80090acc18b7b092f5e9f2d49fd8643f16514df89a716f8f69afe4a7afebb76\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"f85e753996f9e90384b461c5504814ca0cada63ea0f44d6630a619ab36edbe08\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b72a3d2d64d0ddc05f076a7fcf59d924552b45080846c09e1084e67867a76e9c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"cd58d9e2c4a744adbc8ab336cd016f27bc1f14a1de2e975afa26b7f5113d1bfe\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"29c80f1787fdadd41eb24cbda56972d49e35d261e06b4f4fcd5851c7e2de3068\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"277489d8f3c2c5149e18b965c81958774efa7e81299a66265853d6af2e16037b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"7c211141c74fe1e91cc494ac860a81616dc49e2a5d1951dc70bf0f42824d53e5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"17df13edb14ef5c49ef0cc29deaea97728695c57b5ccad8feb2b23589083e083\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"014f0c5a15872002db778e7e40dfcf7dede4ab2db05bb6a08641f5d523cb3afc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"bdac37244e7b891cd2973e74c7b0db5110c344505a09a86e51fc6486ba35139d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"ea8a88726b68ceff7de514d89e12df024a67856b697e02c26b6e762395fdaf0d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"81df9bef1abee093a91a2eaab4b1a53122eb16d4150f27c879439ca5d99112f3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b3be2474c46178c0c39839b29d8d7c87b103574b042bb23175ac0e9786fde158\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"13fe2d56bb22ec9a1307da7bad05cdda8724fe788533352aa581ffdc96874c78\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"fbd262e90a5eaaf98d72db889488cbe13bdac9381f78343ea46c402679569fb2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"9794c132b0cd770efeb9723db862265df6a3584117821e44e2a5660a971c59eb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7def4ca304ff3869be64c2c02523fd9d2ff43465099dcd1124399f293eb4480f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"a86375603000eab9b808785894e0e63f3e53024a46681e97c41a06c4e0c67023\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"54eea38241838159e47386cb814ad20fc30631ee8c42d57f0ff8da80fbbf62a0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"d5b69938a04a8020c8a8d10df4921f2989326ca4811c3843a7201bdb1d5cb848\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-unconfigured-model/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c5a685f2a5ebdef5f1dee488990c0798a45ddce399cf99e7d0c505a5f46c69ac\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"0fcfc87f76b773c6a38375e46d76e569a372370e3ae2e7003932ed8ef776f5bd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fac07f302f653115fda3d376325a268abaf66025ed0e4af73e88bea3f41fe933\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"aa28eac51fc5e37c385a11a534759b09fb7998ba74bb01195dd8ff89d9e9ec43\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model-2/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"06165835c4461c0b16a2bc5bae936aff3c2f351edbef8aa378f1110874acedfc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"17390f436804c5d305f1dcb9ea78a72032310736cf630bb9589448f605bd1fd6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m-premium/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ad8714d3b8aed2a9ffd68fbcf0288557e9c1c059c1b59ad3e9a09910b37fd61b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"c4353817d988db43a8dd6b0d5c29305f9dcda76e19c9ef2c820808b0384a0bf4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-embedding-model/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"726a74c13fee356e859d9317271facbb60b066acbc5571de22d056f13c60878f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"1415e0d2aa117656e44a7d6aeaaf16aa87f18bdeee129f7e6757b2e1c7f996d3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-trlp-test-model/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cad6ab5a81a65fd4cb03a0fefdab5de82aa18c30a5b95078b1d05214b0606f40\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"0629facd48a81e3c82281be4a3f8566f55e61d1a30a8516b23bbb63c58e8f6f8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e5f81c7f7812462ebef000c68dc043013159f22201d2eeecf05c220e809f96ed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"2e292ccc99f990aa723c04a99267923f5b62fb8f3e0ab1a978e8334b9397ada0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-unconfigured-model/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"68502d1c1143a647ad56f2759ea89a4c5b3c74a8054739f7e7ea9ba6535e3b74\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"2b69b629cb2b5224adc61a8925f43333ba0b52ab39260c124057e9e82898937f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"74b47f1aa1203aad58596cbaab10ae46e8fddd08ac49eb57a26bdba532d88e72\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"d1e427bebfc099de9df176c73ee76d5dbd6f77919e840913d3a10818678c7394\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model-2/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3167d3bf853032a93e8569019dcd3e5aa33af9cb580cf9ca138990567fc9d857\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"482d2a79771eafe7f8d177701f43a13c6c4916251440ca00830042e050247443\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-unconfigured-model/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"99606c4eac496429be47144db9f3f48867815df12eb99d7be8073b767d7e44de\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"e635ba9dc59ae1e09b34ee6e0f2718b1c31e6f6b6ff2bc6d05c094fedc42c40b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m-premium/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5d590119308c6f848b12dd3ecdfb1b06cc2fe172af702455c342075944a045ff\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"caf1a50009b65f25df3a996283d38ada17bb57a2ebed842a552f137f6121c63a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-embedding-model/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0e042276580ed8976d8ad3afd87a71640025c28b9b48f5c88eb159ec9998209f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e17697b7e023603155a06feebe0602591826e794ee2f5189abf795c259be1b37\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-trlp-test-model/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0829dbf2b5dc0900de272826295adf351de381b46fa6fba00b896213530780f6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"1e772a79f4b1660c75cf3493e21c9ddb58d2de640363115c57dac03a10f22c33\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cc1ffc2ee4e05618c28c108cac668c0c02eb8e658953439e47a733edab44a1a0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4fe1d1c6df78a26f30e2392ae9da7fc67b0845dfda48a89e247bee6aa536d8e1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-unconfigured-model/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"486615827938fa99814e929fe7dc62bc16f7563179fef855074eb73dc7ce4724\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"ee2f6a8baeba450552a3e168b9df1808bba4e2c59106ad0881ae78aee4fcbd40\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-echo-model/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"98ec9d74d07c88c1e6923ed1cbafd4c5b41bf1763b3a942282f964f72425ae57\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"653f23106eb8a10791805e2f9355c750c56aa6873ef311fe707e76083d93d55d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model-2/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2ddbced6f2f51d410743da1d9db1257d0006d99f38986dd7cc7efd26620791ad\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"1e776cd43733621e16ebc27c91dbdeea062f73e4dde2f494701c85a6843faeed\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d752a44ad8df3a50b5a1147110eb89039ed764e1fed197b1f77e0935c424a90b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"62f67bf9885222d9a86a95e02ed17ae26ad7cf71e15aae0a7517e647c29618ca\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3083301b5359be118f04faaefcd72fd127f2297a3374ef7231b59a59a31b405c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"e85460469045801c3e6927ab49333ff01612a4899d5a7c29ec27824b9942f3b9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m-premium/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"67c67ce733de50e7b3d797bb248036b01badfe02e958f5f76af05b58a504989c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"f9b414e31cae5d16cc1ad22ba2462b8816d9369a97316f40f32a6e7912fc4f78\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model-2/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2d4a2275e6cbab5c26d5c3cf2d75aa2776066390e5b66f5498b16b26bc596af7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e33110b3dae1dd80b2bfa573def0b488a6fd4f1243962fe81d58e1853ed2d3f5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-embedding-model/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"23672b974f0dbc05100a34c78d2b029e41f1d5a3752f3fcb52915f56db360e25\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"a6183db94e49e3ba0149a19f4e52ff19aebb55d6261b0cacec0656136bd2adf4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-trlp-test-model/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8274337fc3f0de48e5213819aeb4a46559c4f8b3428c1bae43c0d75207ef5264\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"efcdf81b8f74d74207beb897f447376d1f950ae12e8a330f1ae67b0d9dc6a545\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0e89fc4b75d3a5dd95fca2c4d8ae33c7826f05a8016c44eb39e28c3c1860fcfb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"7f0f599e497ae797f3b5922614ceddb3375c007237412d01b520bb7498ef288d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/premium-simulated-simulated-premium/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ab505bdf28287fe00099987c1bde2c2f297c40c792a7f6cb5fbfa5adc44754d3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"06c1aa31be81b1f5c6266514c955712865b30117291a39dd749994f4ce931145\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m-premium/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1704c6bc15d6f547acca888061680f2275f690cb79e5af6fee44747bcf278b95\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"6a8319194e2c2fc998268cdbab03a5aae2d83019f5ac30c316c4e548895b7c63\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"eaeb360b41b3f9e0bd6b247d4dae3eef1ffc3355d6e9408df3f8f71bc7f033b5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"32cfee4e66c307d5ebed6a406d2260f4374553d184b5486fc53cb64bc6ffcd8d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-embedding-model/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"135ffad9bbcd33779a0b9a1c0dc5d5f547356be21489762803640aca855c728a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"3194cef788c3fa9898599a57480aeaed07c6eac2edf957788235b37d22918588\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-trlp-test-model/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"17002b7f0c8e62582ad262d9c2b8b038ee7f2a9327fe34f21fd4f47134b7b8cf\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5acde2b886749c1c54f99db5c33887e6fc5ed0caf412daacfb5df0f329882c66\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a6a6232fd5656520e75d100c41add5f1637dde9705a4ec608bbb90b724c258a5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"37a71c27032e51fdbc7ca688064a47abb86230a8138af6eb55e8069fad975a93\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-echo-model/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"92917da87eaba4f2684cd45947a3698434b99ff4ca6d3ddde51d6573aecb1600\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b2b26e0af9ad7defb486e5d1db19af6bbdd0998559d16f3776651669aeb4d067\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-echo-model/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aa7038625b8f43b0c002f79637065e5ab90468f50f998759d08f2c4640c07c04\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"2a62f0614f6526bc3f195f838aebd1abe29514f2707db40d9ef738d645ccf001\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"de97dd5d45c6eb12b4a1112ed1f362d8544427428d2249a399e26ba069d6aadb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"22b2ec7ec96ee09c9e07a84cd3d313c2223af42433bbb28c5846401f64d5e3c1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/premium-simulated-simulated-premium/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"dc061bec60bd28b1c132bf30965b4810124429576337bcc4a6030617600d1714\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b188b939a496049e47b8ef664d7c7c490722f1753404a08d89ccec1dcb87b8fa\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-echo-model/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"75612d85af2bae456dadd78163b2d2f9015c0a0bf4e20bcb8a555e6a5ab3b8c0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"96bc4fc13cb63707a942ca33034f78d2b39476a10860398523789db3990584d1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a4493fc88328eba553ef36791fbf4706bffae04a1ac501d099b12309ebc85c6b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"d84e45c7a3e370ea510e8e0294e009b29bc2f2ea789c47559293007b6c4410d2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/premium-simulated-simulated-premium/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2d953f7313807988e63546aa32431d96f77e6989c672f8ab42827c1c21918630\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"dd2f15d9a08862ab664dadf9bf5da25828d327a11a07849fa919713f034c2b0d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/facebook-opt-125m-simulated/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d69b9c128f599c9ea1af84bb3e783ed71688baf6b3ad2b86f2b7183f9a4208b9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"4dfeb9ff2318af8f84e70b11545800bb83948c080a97ae1ece5780d4022bb383\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"dd89509e97b96670685602ae2d08749226db8693944d2c6f868af9d3e0a5feb5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"1025db78adc8b9c9592b692cc227b1a306a99ac5502300d9ed4ed7615f5e3ef8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/premium-simulated-simulated-premium/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3386c5e86c72abcdab369776ccd7182024ab8681cbe497e81724868f101a3c0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"58e90354179740b1af406b2911c9997f3f3283475aeb77ce7918f3b3239a293f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9e75e9fd02f51c2f043b145c5d6b82e95f1447b388ee529262aea27a6a2774ef\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b89d1075a79c93acaa097e4e6db4d6a4b23bf3ffe5e964409e29b258ed725a99\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-2-simulated/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0913a452a02695c6681f1037232199b40b64236fed4d29cdbb41561695826340\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5c0b495d1a10c1cf1548ef17998cb18c0ca25371ad42d5ffe1aed42bd55e31ad\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-unconfigured-facebook-opt-125m-simulated')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"010adf02b2e7deb40c572f4729b6dd4619847c8e6344137326b72df28772fc1a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"c04f8a7c7387e6794115c41161cb001d8a07340d2878cb8f36774a8f6a200ba4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"105cf4dd91a8abf4a93abd65b255521c3d37b560b5d23f3ec59757b5b362fae6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"7e7d1a0ec6d957a4d4de94f93078f10e836b23442c9cfa90f11c8520cca12e87\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-embedding-simulated/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"75fd86e2a4870af5fd78f2ad7aa2a9d79aff977b3678d81954b1e207a9315f2c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"c3cfc634a11046a837448628e2f17db0ed3466194da289a808544d874ecf6451\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-trlp-test-simulated/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"54cd0149b818480305f3d0024b3c95629cafb641b48195d003b2b7006d5c6bcd\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"f5bc618bde549671e84473b23ef3632426f8606e2045744a860c603f2a7675d3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bf65ad13397c94660867eb0205e06d1c9bebda4b019f632c0d0b8ef989930381\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"d8d67afd40f17474755bd3f6b00e265761bf5154febca129bc3f2b0bcd749c41\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-simulated/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f9fa9cfc2b4e701183573419a92c79384cd30210289602f0115c75c5029d55aa\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"ac2105eead12bb02dd7d1691cc77fc8a580b903f98564a8fd585dfa345dec1dd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"596921ddc7ba8523386263c5cffcbd6ad9b6a385318ed7e24f72be06f36fc398\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"f4ae34c5c82a0969651301a535f404653a60a5d75f20c7ea56ad9bb89b67e9fb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f95805f0e9b755664735d898c1d644d571943be553204d3f86136bc35719ff13\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"95c39f44eae69bd53f57e5ff93243887dafd591c9b8cf2e736f0ab034e67021d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/facebook-opt-125m-simulated/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8d5571efc1d304f5bcfc2ffb4ac6819154ba5556c29ce33416d460b887427984\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5d6b359055267732253f201a1fe48f0abe6d5e22b011c70e1cb006eea672f535\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e91aceffc2d4f6d6b120625bd3ca23781b74a1cae6cf1da26bda310bbed0ef07\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"c8475d27649a649c955538ff79eb001372050ff4f1d4ad295b01dc6fcc69ba2a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/facebook-opt-125m-simulated/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a402d1681ab35bace735c19b1d084a86eb3d741d4e1c14371cfdaa55d22c3ebe\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"7320c049419b863194fd55db5ebd887462dd24e1289e6308d79f047431f2bed9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-2-simulated/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f9b535aed6243496a67741936e53a0d303bea1b872a06fb62f1f9c27150edc40\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"5eeab80447ec6c71797517b4d94c6623353e89097743360eadd7f31115976dfe\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/facebook-opt-125m-simulated/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a9800464506c58f005016df354e160757732171ff4d19747202524955329b998\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4984a24eb707d1b965a79974a98ed4afc271f2ca356b150cbc8943de1ddcfef8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-embedding-simulated/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c82a1a3dc2ce54c0b664f79a2cd895a3c40f774b3694999badae8cedd328292e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"276f5d5d67b2bd83c05c2b39e4a262885498e6807e3129a866eff0651b3604a9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-trlp-test-simulated/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"669658556fba0f45c2a82def2f57614416614ddf154ed8dc5f4f9188f10130f2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"692f39321f892929348fe56801dc14c8a35eaf749609a3a5f4b5e684edddf17c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-2-simulated/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c4399a95e89654e5b2bb5fabe45bc947d11ccd1448ebf64c30b195b34f239d58\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5b273834f06c6341dd07bba6c809b3297ba2514e6d3b9b5d0f4f8211c68ccf8b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-simulated/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5e4821ff903ad6ca2e1c42162432e34d8b0a2a78052961e753d36b742193432f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"f35ed2fb168a3a608435006c8c1b103242765d7d37f41bf1dbdb7bbc0331da89\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a91faccafad197e2a4065ce3d12a052ac484d2e8fb2fc9265ee48f02b28e6dce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"fbfd0ada86117ffb0a134e591bf8b8390012983d25496ef188c6da73fef5eaec\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-2-simulated/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0020c64019ffd1a0bdcc75e6441e6a30e6d8bb08f463f67bd2408a1e82b95b2a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e78a4964c93ec23890e62f7f50201f5b832b4c714066a914dc734d8ef60e8213\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-embedding-simulated/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7c924aa2b37ea38067b4e69052d541ea2e7c86fbdaa79b19f9ea09e87adbe4ff\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"d5cf96eeeaa56bb891ea0cba28f7beabf17a8c0f061ea01c768ed842dd26334f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-trlp-test-simulated/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"028a8b5bd5d4e690eebb2f20c5fd47cf0b3c6e2a3619ba9e55322bbca7b94cc3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"8fe4100eab1f023f5b06dd8e19bcc80109b82503466d49576acc234cdda9bf0e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-simulated/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"80056c658070f49140955cb6eabdbd252857a614af6b0f2f2de7a1ab1cd47949\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"53aad0199369eb8c8f787ea099e93092089c04344e8f910dcff366f54bc831cb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-embedding-simulated/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2416d7b42d11a09d7152746be0e114f8fdc87d0fbd0efa9dec5b52b011082194\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e0cfec53d1f17771317082d9a7d69806ae3468971bac79a1135f2b0d51ecdc07\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-trlp-test-simulated/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"50c2058cf11e07a931b06ac4446a56eee86855f00badf26618abe486a7bdcfd7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"f3b6e6c38a521fae8ef5c7fddf3b3178baba88effb4e5338e0b387e28ecc468d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"134a7a790ba665547ca14f80f917549f66ee5063fc41096471c0778399db6dd5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"4ddd3fa1f54c642a57a48737e710ec0116705776084d8cebd8134dfa49accdde\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/premium-simulated-simulated-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4d18a96899c43d55ee63d2ae1a7a938c7e873d88b2fd95f06b2e3aae2c7f1c84\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"44e38055536c3f0d49cb81abb42bfefcf2c78faf963a6160afbe459bbc04db39\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-simulated/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8d34bd12ba2030284fcb69127f53b8158bbdd4a1432bfe619165b4c2c96cc061\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"c9dd9c233e43b53241ee27e937246e51b8f3331f30a7fba22640617c1b0bf47a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/echo-simulator/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"319e246831bdaf5e765e63d5511b516594fd2b64527850e2ddabd2a4a85532ea\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"7cfd2ed5cb8a5913fa5f55b92b02805c6778991c01c80eb14a0962cc710a56ff\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/echo-simulator/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a8c8220ad6f1387002e262ace5db78a2c4bb39e5953306702a228215174f6796\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"87e1712d02794c6d66ec1a932f02901d7a4369f46d0f041178cd3efadb7f59b7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/echo-simulator/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1e077a716d89a43572a3c16e8d0b0436816baa48a2ea227603701f10cad6d6f4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"ae9eac2a2b8c8311bb8c6ea82ab445a5d6f50d2d51c3f79962be9d82007097ad\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/facebook-opt-125m-simulated')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3f23315aacd6e16f4ab41f96aeedc9549d1abdfc9476577a47d45d12875dec5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"165d3b8e224f71685dee07aadd133117aeeed097eae99437d561d5bfa2d22233\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/echo-simulator/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6687eb3cec74c6c51428ce3f3d22d50ba269f59015d1bc8f185da49eb095534e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"05ac0e89d0298398d3996609d7c22b514bdf08bfa3787653bc739995c5942441\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-2-simulated')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bfd36c5ed73eb81df97258ffa1aa36d8cbf6f3e7a8096c33ca4ff417be59d002\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"d5ac583036f3821c88111dd82571eab1fc94aa4e9fcd045b27336f798e26075d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-embedding-simulated')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d303c788902ad4467c7ae545d65cbef45564d1c0d56396c93057df3909461aa1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4a6b0d84cc35c0f532405eea81056481fd54e7ad71284a97ce8f6a2424eac819\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-trlp-test-simulated')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2f53b030326b8e1f5908c601aecd3fffcb6d08a8337d0bdc53ee1fc699a4cd71\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5c3bcd9fb119b0fd45f3b4ba5de5f905cacbb4963fec309a0961a40f76a7a7a9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-simulated')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"098187a2b31ef966f647c443716610cb8d70bdafedfed7bbd4f8b1b568817678\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__4542e5a2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7182a301e3dfb7ea\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/external-model-e2e-rt-sw-847782-931a1687e4da\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-e2e-rt-sw-847782\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__4542e5a2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7182a301e3dfb7ea\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/external-model-e2e-rt-sw-847782-931a1687e4da\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-e2e-rt-sw-847782\"]}],\"name\":\"d4bc8ab4f961e4da03ea520b66c210a99261bedcaa3b8ea63bfd065975305cdd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-rt-sw-847782')\",\"request.headers.exists(h, h.lowerAscii() == 'x-ai-routing-candidate' && request.headers[h] == 'llm/e2e-rt-sw-847782/llm/e2e-rt-sw-847782-a-provider')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3d6689d07457b06902f3cdae810a6a9071ef1bd6fa7f7675596735eeac6d7b7b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/external-model-e2e-rt-eq-d2da5a-04e45017708d\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/external-model-e2e-rt-eq-d2da5a-04e45017708d\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"1212d94356550c83d4bb9d33f6230a0404552b9dfafec12dcaec47d80302f5b6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-rt-eq-d2da5a')\",\"request.headers.exists(h, h.lowerAscii() == 'x-ai-routing-candidate' && request.headers[h] == 'llm/e2e-rt-eq-d2da5a/llm/e2e-rt-eq-d2da5a-a-provider')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"dc6a6f9b82cff312739bacc49810b2d51c7df335dc8178b49ebd65433b463649\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/external-model-e2e-rt-eq-d2da5a-04e45017708d\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/external-model-e2e-rt-eq-d2da5a-04e45017708d\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"ade6cbbb615caf3921555140aa4c671b7f610ad3149d6df2281c15cf939cea65\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-rt-eq-d2da5a')\",\"request.headers.exists(h, h.lowerAscii() == 'x-ai-routing-candidate' && request.headers[h] == 'llm/e2e-rt-eq-d2da5a/llm/e2e-rt-eq-d2da5a-b-provider')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b278a3f65d6cc70c6e2d022678205eee6ccd6b0dd1185b975c61ea5d681e4fa7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__4542e5a2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7182a301e3dfb7ea\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/external-model-e2e-rt-sw-847782-931a1687e4da\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-e2e-rt-sw-847782\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__4542e5a2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7182a301e3dfb7ea\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/external-model-e2e-rt-sw-847782-931a1687e4da\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-e2e-rt-sw-847782\"]}],\"name\":\"6552a07f5e2833f4750b76f64454853491f84950146659c393be378468143ba3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-rt-sw-847782')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"123ca98e9a0a804d113e560c125759c8e2f539b94d72ccb5454ca9563adb403a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/external-model-e2e-rt-eq-d2da5a-04e45017708d\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/external-model-e2e-rt-eq-d2da5a-04e45017708d\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"2fd8df7a0e06e8578c79a9a11e4fb2e2bb4af925019c5460eb76322182a3e241\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-rt-eq-d2da5a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"94ddc5e77f082c32bebc7a36bcebf621518ebf303e83b9c540da1352d04e620b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"50057c9a2acf4ae7152e8c97f7778cb04340d1470974e5272422d0bf244a4e5c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/echo-simulator')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c6918972d1a7f8ad5201880b7d6d9c1191ca1f25376682f691def7868e3fd02\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"01cc37113b4d6c301e355f63decf46a21e93a023494bdfeaeed2890c97ec1f57\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a82769ff87473da04c27497e160e9b4b1a5dd93578e0cf2342be8b2f06845269\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e747b72d92315b743934153588614b27670cf0c9d9dc4fb380ea4965def7f235\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"06b05a8e4dd69bdc4f333ad9509ee8cad3c5c0f5dd48edbe94c1158b60f79ed3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"661962837510c6dc6d1faa64e61ec3086efa9e0a2e7315c6ded616c1879e5ba8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b4bfec1b33959dd0ebfc5cd6fb410688e820d4b55c7f149cb4acc4353f30a9b2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a7740f6e77d024a437502c023fb1d8939cb3cc2b9ed7f4073af7d779e19459eb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"f82564e076ea3e672592bab71e048537faba17a5e909884c2a0204e235905a69\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2ecffd49fe780ea8d7ee498582caa2c41bc635ad490315792e681c7defe84b85\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__4542e5a2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7182a301e3dfb7ea\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/external-model-e2e-rt-sw-847782-931a1687e4da\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-e2e-rt-sw-847782\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__4542e5a2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7182a301e3dfb7ea\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/external-model-e2e-rt-sw-847782-931a1687e4da\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-e2e-rt-sw-847782\"]}],\"name\":\"f9bad537fbe7a6c4935a5a7c8686a356adaa96259346b265b4b0283d55b8466d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'e2e-rt-sw-847782')\",\"request.headers.exists(h, h.lowerAscii() == 'x-ai-routing-candidate' && request.headers[h] == 'llm/e2e-rt-sw-847782/llm/e2e-rt-sw-847782-a-provider')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"456e5dd7dfa9810034544082c8cba90a71807c15f93751d5e3f6273265dd2a02\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/external-model-e2e-rt-eq-d2da5a-04e45017708d\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/external-model-e2e-rt-eq-d2da5a-04e45017708d\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"6b743a940b39e00d96d35e9b87e1933351e7ee65f92bd505732f0e5c135d89ad\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'e2e-rt-eq-d2da5a')\",\"request.headers.exists(h, h.lowerAscii() == 'x-ai-routing-candidate' && request.headers[h] == 'llm/e2e-rt-eq-d2da5a/llm/e2e-rt-eq-d2da5a-a-provider')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"766cf4bb260ece5a17a1555c9563719c5bb7959c9d88b568184ae41abd76eaaa\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/external-model-e2e-rt-eq-d2da5a-04e45017708d\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/external-model-e2e-rt-eq-d2da5a-04e45017708d\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"d2425870b912321cda429080c0c35d1847e04f7ceaacd7520b82dbbc909b1957\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'e2e-rt-eq-d2da5a')\",\"request.headers.exists(h, h.lowerAscii() == 'x-ai-routing-candidate' && request.headers[h] == 'llm/e2e-rt-eq-d2da5a/llm/e2e-rt-eq-d2da5a-b-provider')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a908063c86927e6bf07b7d793aad9f277ac3c2a8f5f5d468b116cb9e07929b14\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"fbdfff5b213f506d78434055d011cf63d616653e502ee04408a43578986e1e5c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d1d232e06f90d479cd9b802f24889e83af58c51cf54ba273d5e24dcb8a297688\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b49f2d7e152d4de959577465d2494ee11771b4c439cb6eae71c90bff26224fb4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"810f299b76daf089b33c92cfbe0445ab5cc89a48d38e36df0cc89ed6cd1fe8df\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b27d6255cac73fc039120e157e1f3ce0e99e86995ac5a66974d5e8744df6c64d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4f800155f293f82eeaf5fd6a9553c0a1bee90f47a295bba8d7a04b3f11faea33\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b1ccc7ca46f6a14e90afe1dddfab8763f07f30549ce1cda0bae985581f063098\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ce7d381faee9ff949d68d825ffa1dcb9247dad19667ec59a8e91847320dacbe0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5d72fc7cc241ffd60d83142a900be014cc5d57320142e013493b21ecc86cb534\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6565c4085b3917d5390fe1b0194fb3d8319f1d56b45867e3c68ff740b5c16ef3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"be1ccea8a4cc19c7190600de6631fcb661b63db81e2862348a6ef4f90bf33fa3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8d8c8aae1332bb0300ac2d65be9b8708fbfde6d4b5599ec52380cf1f70956045\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"ca48ea5d9ee701ac5383800306378d945e66ca5427eba33396e6805ebbdc1ea7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f6df6bc14432fdc346191db86ee06e75c8090ed87a32c984493c837e97a10be6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"fc54a1d4f18d4d59e58b6a3aa31dbfaddda2b89e5c28dc9eacf14ff38a414021\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"528f8663751fc08f3e8ae4ff6fd43a63d61572c7f149dc0fe75912f5f4b33047\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__4542e5a2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7182a301e3dfb7ea\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/external-model-e2e-rt-sw-847782-931a1687e4da\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-e2e-rt-sw-847782\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__4542e5a2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7182a301e3dfb7ea\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/external-model-e2e-rt-sw-847782-931a1687e4da\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-e2e-rt-sw-847782\"]}],\"name\":\"3ab01a6a4b50257801cab44c4e08e694374d0c202b60aafd1e6d17ac6c55021d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'e2e-rt-sw-847782')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"15b2e87aa08919282b8acd840a1e8677e8854f820cb1d4115c0f0ebbeba4b541\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/external-model-e2e-rt-eq-d2da5a-04e45017708d\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/external-model-e2e-rt-eq-d2da5a-04e45017708d\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b02d20e612eb950eb6cfe4b76fafcb895919db7ffc9de648c5b2e962352fe48f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'e2e-rt-eq-d2da5a')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"maas-default-gateway"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-maas-default-gateway\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:26:31.617Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route#v1-messages-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"739e19d51d8fbdeccfc8bc7587afd12132239f688ec6cf8d9586f242a71087f7","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["739e19d51d8fbdeccfc8bc7587afd12132239f688ec6cf8d9586f242a71087f7"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"739e19d51d8fbdeccfc8bc7587afd12132239f688ec6cf8d9586f242a71087f7\" already exists"}
{"level":"error","ts":"2026-11-02T21:26:31.686Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/external-model-e2e-rt-eq-d2da5a-04e45017708d","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/external-model-e2e-rt-eq-d2da5a-04e45017708d#rule-4"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"766cf4bb260ece5a17a1555c9563719c5bb7959c9d88b568184ae41abd76eaaa","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["766cf4bb260ece5a17a1555c9563719c5bb7959c9d88b568184ae41abd76eaaa"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"766cf4bb260ece5a17a1555c9563719c5bb7959c9d88b568184ae41abd76eaaa\" already exists"}
{"level":"error","ts":"2026-11-02T21:26:31.753Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"f09ce0bd9bc651317469310c8a604d792e7c7c55751d184a920638cf66ba0dd5","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f09ce0bd9bc651317469310c8a604d792e7c7c55751d184a920638cf66ba0dd5"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"f09ce0bd9bc651317469310c8a604d792e7c7c55751d184a920638cf66ba0dd5\" already exists"}
{"level":"error","ts":"2026-11-02T21:26:31.823Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/external-model-e2e-rt-eq-d2da5a-04e45017708d","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/external-model-e2e-rt-eq-d2da5a-04e45017708d#rule-1"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"3d6689d07457b06902f3cdae810a6a9071ef1bd6fa7f7675596735eeac6d7b7b","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["3d6689d07457b06902f3cdae810a6a9071ef1bd6fa7f7675596735eeac6d7b7b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"3d6689d07457b06902f3cdae810a6a9071ef1bd6fa7f7675596735eeac6d7b7b\" already exists"}
{"level":"error","ts":"2026-11-02T21:26:31.889Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"llm/external-model-e2e-rt-eq-d2da5a-04e45017708d","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/external-model-e2e-rt-eq-d2da5a-04e45017708d#rule-5"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"123ca98e9a0a804d113e560c125759c8e2f539b94d72ccb5454ca9563adb403a","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["123ca98e9a0a804d113e560c125759c8e2f539b94d72ccb5454ca9563adb403a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"123ca98e9a0a804d113e560c125759c8e2f539b94d72ccb5454ca9563adb403a\" already exists"}
{"level":"error","ts":"2026-11-02T21:26:31.960Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"maas-gateway-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"maas-gateway-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:26:32.026Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-worker-w2-6fa533-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-worker-w2-6fa533-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:26:32.189Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-worker-w1-5f765a-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-worker-w1-5f765a-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:26:33.024Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:26:33.024Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T21:26:33.130Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"external-model-e2e-rt-eq-d2da5a-04e45017708d","namespace":"llm","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"external-model-e2e-rt-eq-d2da5a-04e45017708d\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:26:33.199Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"distinct-w2-6fa533-kserve-route","namespace":"e2e-models-e2e-worker-w2-6fa533","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"distinct-w2-6fa533-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:26:41.572Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","AuthPolicy","HTTPRoute","Limitador","EnvoyFilter","TokenRateLimitPolicy","ConfigMap"],"eventTypes":{"create":19,"update":9}}
{"level":"info","ts":"2026-11-02T21:26:41.750Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:26:42.429Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:26:42.567Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:26:42.567Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:26:44.125Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:26:44.129Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:26:44.129Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:26:44.131Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:26:44.136Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:26:44.138Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:26:44.292Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:26:46.561Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:26:46.561Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:26:47.508Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["HTTPRoute","Gateway"],"eventTypes":{"create":1,"update":1}}
{"level":"info","ts":"2026-11-02T21:26:50.474Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:26:50.480Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:26:50.480Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:26:50.484Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:26:50.488Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:26:50.527Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"error","ts":"2026-11-02T21:26:50.594Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:26:50.594Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T21:26:50.604Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"e2e-models-e2e-worker-w4-d6cb38/e2e-conflict-b-00e30839-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-d6cb38/e2e-conflict-b-00e30839-kserve-route#v1-completions-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"eadb6a7d6f02867d748c9df2b385bc6f0ef64b12f4a78bc2ec405a0b74c1e489","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["eadb6a7d6f02867d748c9df2b385bc6f0ef64b12f4a78bc2ec405a0b74c1e489"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-d6cb38.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-d6cb38.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"eadb6a7d6f02867d748c9df2b385bc6f0ef64b12f4a78bc2ec405a0b74c1e489\" already exists"}
{"level":"error","ts":"2026-11-02T21:26:50.671Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"e2e-models-e2e-worker-w4-d6cb38/e2e-conflict-b-00e30839-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-d6cb38/e2e-conflict-b-00e30839-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"83bb1b97e9aadc07db3743a6651672685e34c290135dc942fa72f478a66e5fa8","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["83bb1b97e9aadc07db3743a6651672685e34c290135dc942fa72f478a66e5fa8"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-d6cb38.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-d6cb38.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"83bb1b97e9aadc07db3743a6651672685e34c290135dc942fa72f478a66e5fa8\" already exists"}
{"level":"error","ts":"2026-11-02T21:26:50.739Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"e2e-models-e2e-worker-w4-d6cb38/e2e-conflict-b-00e30839-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-d6cb38/e2e-conflict-b-00e30839-kserve-route#v1-responses-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"decd3da4c01813aad7b20f941fc8db4c361a5ae944965f7f204b4667cfc3b67f","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["decd3da4c01813aad7b20f941fc8db4c361a5ae944965f7f204b4667cfc3b67f"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-d6cb38.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-d6cb38.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"decd3da4c01813aad7b20f941fc8db4c361a5ae944965f7f204b4667cfc3b67f\" already exists"}
{"level":"error","ts":"2026-11-02T21:26:50.824Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"e2e-models-e2e-worker-w4-d6cb38/e2e-conflict-b-00e30839-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-d6cb38/e2e-conflict-b-00e30839-kserve-route#v1-catch-all-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"d1f6ef05b7178d05a0f291462a07f64061a3744c43a38cda317da12ec42593d2","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d1f6ef05b7178d05a0f291462a07f64061a3744c43a38cda317da12ec42593d2"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-d6cb38.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-d6cb38.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"d1f6ef05b7178d05a0f291462a07f64061a3744c43a38cda317da12ec42593d2\" already exists"}
{"level":"error","ts":"2026-11-02T21:26:50.890Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"e2e-models-e2e-worker-w4-d6cb38/e2e-conflict-b-00e30839-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-d6cb38/e2e-conflict-b-00e30839-kserve-route#v1-completions-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"ffa07e9cc2abd888cc63b1c0d37ff1eb4f3efbfe8d6d554814630b4c04819355","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["ffa07e9cc2abd888cc63b1c0d37ff1eb4f3efbfe8d6d554814630b4c04819355"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-d6cb38.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-d6cb38.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"ffa07e9cc2abd888cc63b1c0d37ff1eb4f3efbfe8d6d554814630b4c04819355\" already exists"}
{"level":"error","ts":"2026-11-02T21:26:50.959Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"e2e-models-e2e-worker-w4-d6cb38/e2e-conflict-b-00e30839-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-d6cb38/e2e-conflict-b-00e30839-kserve-route#v1-messages-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"7b072f859283c6eb5c61bf4ba487bbafc01f8c48582280db598457737341dd11","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["7b072f859283c6eb5c61bf4ba487bbafc01f8c48582280db598457737341dd11"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-d6cb38.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-d6cb38.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"7b072f859283c6eb5c61bf4ba487bbafc01f8c48582280db598457737341dd11\" already exists"}
{"level":"error","ts":"2026-11-02T21:26:51.113Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"e2e-models-e2e-worker-w4-d6cb38/e2e-conflict-b-00e30839-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-d6cb38/e2e-conflict-b-00e30839-kserve-route#v1-chat-completions-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"6c93211933d113e61eca474cd3f8bf9988cddebeafb9c91e5909f07aa2694136","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["6c93211933d113e61eca474cd3f8bf9988cddebeafb9c91e5909f07aa2694136"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-d6cb38.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-d6cb38.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"6c93211933d113e61eca474cd3f8bf9988cddebeafb9c91e5909f07aa2694136\" already exists"}
{"level":"error","ts":"2026-11-02T21:26:51.170Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/maas-default-gateway","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T21:16:03Z","generation":11,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"371b36ef-c4b7-499a-87db-1bdf4e8f92de\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:26:25Z"}],"name":"kuadrant-maas-default-gateway","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"maas-default-gateway","uid":"371b36ef-c4b7-499a-87db-1bdf4e8f92de"}],"resourceVersion":"34563","uid":"86b5bad7-2bb7-41c9-b2c7-bb4c8f13292a"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"61b044087f8d56658ae99d15d4fab3cf1ad74e6636795c133e054a5aace0540d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e511d90f2140d9cde0b2100a0a488dacadd8f510bb901601d5e6fd25343a0f1c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"1e42d143d6033a677e2aa0de97c78600094e515d7c0d3f86b4925ef8be636163\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"26b7799af8a40e8b9585c255ec018a63b0074c27282d4dccebed45f14e703b5e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"ce74c295ef1588342c7308478a1dc6f6aa2cefc063e489a124e536ac32ecfdba\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"fbe95a07558afcf05ef68ff5beb293f527d6ab93dfe79956b5406dc463d78363\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"40a29ce438b5ca497e4389ce52025a9b91c0cf3177b1bd5c8519b041cfdcf75f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"845137604829fbc62550504d7bbe5ae8d55ea1cf474160cd789a72e811000e4b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5322619ef71b1d1ea3204f9014d0341d4402275b6ca23fca69d61cfc9a61e883\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"16b86e50920afda06ca195a717436238f5fca7f2e1bbe0939875bcb7d559cf31\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5da9070dfa3a5637213b5443376170dda26f57f381af542891ff3b19cc7a9d06\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"00ac1aeee65e93fab2ccfd89c11167f4d954e1cfb3e8b09ad3371a4fab4b6369\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"55c23b9552cb66c175ed2202220df6480eae89be2cda2e925458acf31c5bdbce\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"99f16470bd82ba57465b128d1c0fe73ef189001d77c6ead3fc34c98ad3ce27a2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"a6d134df42d4d90d93840f63dc770cadabd22dc22af01f991b6c067e96733c95\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"0be74a5083c4760789001949965ce7020664f6347b769f9f20735f95f9d34989\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4902f5a84509d49ec2fb75275af9692b524b1334f7c919eff1d9f33957acd5c4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4f0e9d14c4d1857d5415458306310b00d6a94ce68179c717917d13d30ede9b87\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"29d1c55f30b76c66bfb15588c297271fac7d5e9ca415f0c938d63e524a8187e5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"df729ecdaa88f0abfee16b94ea7be9c5aa7ccdfe91fbe0676e22ca4bfae35f29\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"69baf76a5f2e8f4f8d3e40025586b942794274a22455dc40e0b7c0116f0d2297\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"8199294e302361a6898546d62809d67d522e9c2b375c8b8727f0d966f7ad4d39\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"61ef91ec2e76cc107813a7351d7e38bb32d1ebbff452efa771b01f8a512fb99e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"f2d9c20918355999f92bc489c836e0d17ed8acb713739da4b73fc8ee019fc8a4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"c19d17a63dc280a83fa4dce8ef0f825a16118c6817d3126d095473335018edd0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"05aa8311318e9111c5925f4be454406e209ab832bc6e8ddf01725ebe4f1ffdcc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e680857c19914d59f115788ea93836704a1ddab04f5e495bf863d62ad8a5aa8e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"96b761d418352e3f8d172aa80bfb5542df670414bec97704e615f2e3e665c8aa\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4a199d441e37ffe8d62509ae7048cfd055df0de5619e9be81a8f47f9a64a7051\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"f17cbb57db714a7faf03a7e4ef3921069096709486e13c6b84b4b75ded84ca96\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"d8631ed26c63871d1138b31e9c971d72ad1152273309b27ee33862700ff4fb0c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"67a5fec0fb2398a03579a732c5e4640c9f9c5db5385b91db90ffb49522369904\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e5b5be5a42ead835fa1a13840fda21cf5afb14b8226da9a3008a321db777f685\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"a01c6bf1aa626b04ec6a9fc85abb6ced9b4a9c4cafe81d2176013cf3b0b4c4aa\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"0eb9568cf0385cf054d8f3ebcce089d8b225a9fe1b6061e3689f7bd26415f872\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"633e4cdca29207ccc8220565a86635db5bf3f227ef564ee1a0da6a5d6076231e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"ecaead2c94524df89be70a7c961f93dee41ef96545655d22914542a89dffe341\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b9f3d06eb6a92218fa1757dab6cb8e66e42102d46c94e6c0db854f694d6d855c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"7054423a069def7a36dcb993faa1143223d985021782b2552d55a522caf2eba9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"deac1d64e5b84f2fc26848a49153d512090eb1e2bffb72dd7091fd21a1234e18\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"3dbcd4467449162cad999d40988202fafebe535215351d004f1bf05937c76508\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"534f6056dec477fad33defb3049c84dc5497dacd9f6e3f2061b13ba089ed1cbd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"fa823b540319ebed6b9b488f79dda81b66933f7e616cfdaebe3543ae31b33b13\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"fb6ca2eee2169356e662d36e92b2b679a1235a86d976f9807297ad56386f6e2a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"0427c8054235bfb15b63a5a467ab470ce1cca867b5a232117e73059a4ec8891c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4aa2417057e81c2889811e45d786ab1591e3dfafc889b838aad26a3ec2cbfe9b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"acb4b8def068bc86711642e3242fd621a66a54452bf86a82586fc6bf69e8192b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"66831c252eeacbf3e19995c48be4a005b1726766550076c58cb47b979bece639\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"a80090acc18b7b092f5e9f2d49fd8643f16514df89a716f8f69afe4a7afebb76\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"f85e753996f9e90384b461c5504814ca0cada63ea0f44d6630a619ab36edbe08\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b72a3d2d64d0ddc05f076a7fcf59d924552b45080846c09e1084e67867a76e9c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"cd58d9e2c4a744adbc8ab336cd016f27bc1f14a1de2e975afa26b7f5113d1bfe\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"29c80f1787fdadd41eb24cbda56972d49e35d261e06b4f4fcd5851c7e2de3068\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"277489d8f3c2c5149e18b965c81958774efa7e81299a66265853d6af2e16037b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"7c211141c74fe1e91cc494ac860a81616dc49e2a5d1951dc70bf0f42824d53e5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"17df13edb14ef5c49ef0cc29deaea97728695c57b5ccad8feb2b23589083e083\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"014f0c5a15872002db778e7e40dfcf7dede4ab2db05bb6a08641f5d523cb3afc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"bdac37244e7b891cd2973e74c7b0db5110c344505a09a86e51fc6486ba35139d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"ea8a88726b68ceff7de514d89e12df024a67856b697e02c26b6e762395fdaf0d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"81df9bef1abee093a91a2eaab4b1a53122eb16d4150f27c879439ca5d99112f3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b3be2474c46178c0c39839b29d8d7c87b103574b042bb23175ac0e9786fde158\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"13fe2d56bb22ec9a1307da7bad05cdda8724fe788533352aa581ffdc96874c78\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"fbd262e90a5eaaf98d72db889488cbe13bdac9381f78343ea46c402679569fb2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"9794c132b0cd770efeb9723db862265df6a3584117821e44e2a5660a971c59eb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7def4ca304ff3869be64c2c02523fd9d2ff43465099dcd1124399f293eb4480f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"a86375603000eab9b808785894e0e63f3e53024a46681e97c41a06c4e0c67023\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"54eea38241838159e47386cb814ad20fc30631ee8c42d57f0ff8da80fbbf62a0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"d5b69938a04a8020c8a8d10df4921f2989326ca4811c3843a7201bdb1d5cb848\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-unconfigured-model/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c5a685f2a5ebdef5f1dee488990c0798a45ddce399cf99e7d0c505a5f46c69ac\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"0fcfc87f76b773c6a38375e46d76e569a372370e3ae2e7003932ed8ef776f5bd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fac07f302f653115fda3d376325a268abaf66025ed0e4af73e88bea3f41fe933\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"aa28eac51fc5e37c385a11a534759b09fb7998ba74bb01195dd8ff89d9e9ec43\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model-2/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"06165835c4461c0b16a2bc5bae936aff3c2f351edbef8aa378f1110874acedfc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"17390f436804c5d305f1dcb9ea78a72032310736cf630bb9589448f605bd1fd6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m-premium/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ad8714d3b8aed2a9ffd68fbcf0288557e9c1c059c1b59ad3e9a09910b37fd61b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"c4353817d988db43a8dd6b0d5c29305f9dcda76e19c9ef2c820808b0384a0bf4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-embedding-model/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"726a74c13fee356e859d9317271facbb60b066acbc5571de22d056f13c60878f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"1415e0d2aa117656e44a7d6aeaaf16aa87f18bdeee129f7e6757b2e1c7f996d3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-trlp-test-model/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cad6ab5a81a65fd4cb03a0fefdab5de82aa18c30a5b95078b1d05214b0606f40\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"0629facd48a81e3c82281be4a3f8566f55e61d1a30a8516b23bbb63c58e8f6f8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e5f81c7f7812462ebef000c68dc043013159f22201d2eeecf05c220e809f96ed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"2e292ccc99f990aa723c04a99267923f5b62fb8f3e0ab1a978e8334b9397ada0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-unconfigured-model/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"68502d1c1143a647ad56f2759ea89a4c5b3c74a8054739f7e7ea9ba6535e3b74\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"2b69b629cb2b5224adc61a8925f43333ba0b52ab39260c124057e9e82898937f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"74b47f1aa1203aad58596cbaab10ae46e8fddd08ac49eb57a26bdba532d88e72\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"d1e427bebfc099de9df176c73ee76d5dbd6f77919e840913d3a10818678c7394\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model-2/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3167d3bf853032a93e8569019dcd3e5aa33af9cb580cf9ca138990567fc9d857\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"482d2a79771eafe7f8d177701f43a13c6c4916251440ca00830042e050247443\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-unconfigured-model/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"99606c4eac496429be47144db9f3f48867815df12eb99d7be8073b767d7e44de\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"e635ba9dc59ae1e09b34ee6e0f2718b1c31e6f6b6ff2bc6d05c094fedc42c40b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m-premium/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5d590119308c6f848b12dd3ecdfb1b06cc2fe172af702455c342075944a045ff\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"caf1a50009b65f25df3a996283d38ada17bb57a2ebed842a552f137f6121c63a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-embedding-model/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0e042276580ed8976d8ad3afd87a71640025c28b9b48f5c88eb159ec9998209f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e17697b7e023603155a06feebe0602591826e794ee2f5189abf795c259be1b37\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-trlp-test-model/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0829dbf2b5dc0900de272826295adf351de381b46fa6fba00b896213530780f6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"1e772a79f4b1660c75cf3493e21c9ddb58d2de640363115c57dac03a10f22c33\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cc1ffc2ee4e05618c28c108cac668c0c02eb8e658953439e47a733edab44a1a0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4fe1d1c6df78a26f30e2392ae9da7fc67b0845dfda48a89e247bee6aa536d8e1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-unconfigured-model/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"486615827938fa99814e929fe7dc62bc16f7563179fef855074eb73dc7ce4724\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"ee2f6a8baeba450552a3e168b9df1808bba4e2c59106ad0881ae78aee4fcbd40\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-echo-model/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"98ec9d74d07c88c1e6923ed1cbafd4c5b41bf1763b3a942282f964f72425ae57\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"653f23106eb8a10791805e2f9355c750c56aa6873ef311fe707e76083d93d55d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model-2/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2ddbced6f2f51d410743da1d9db1257d0006d99f38986dd7cc7efd26620791ad\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"1e776cd43733621e16ebc27c91dbdeea062f73e4dde2f494701c85a6843faeed\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d752a44ad8df3a50b5a1147110eb89039ed764e1fed197b1f77e0935c424a90b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"62f67bf9885222d9a86a95e02ed17ae26ad7cf71e15aae0a7517e647c29618ca\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3083301b5359be118f04faaefcd72fd127f2297a3374ef7231b59a59a31b405c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"e85460469045801c3e6927ab49333ff01612a4899d5a7c29ec27824b9942f3b9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m-premium/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"67c67ce733de50e7b3d797bb248036b01badfe02e958f5f76af05b58a504989c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"f9b414e31cae5d16cc1ad22ba2462b8816d9369a97316f40f32a6e7912fc4f78\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model-2/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2d4a2275e6cbab5c26d5c3cf2d75aa2776066390e5b66f5498b16b26bc596af7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e33110b3dae1dd80b2bfa573def0b488a6fd4f1243962fe81d58e1853ed2d3f5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-embedding-model/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"23672b974f0dbc05100a34c78d2b029e41f1d5a3752f3fcb52915f56db360e25\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"a6183db94e49e3ba0149a19f4e52ff19aebb55d6261b0cacec0656136bd2adf4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-trlp-test-model/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8274337fc3f0de48e5213819aeb4a46559c4f8b3428c1bae43c0d75207ef5264\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"efcdf81b8f74d74207beb897f447376d1f950ae12e8a330f1ae67b0d9dc6a545\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0e89fc4b75d3a5dd95fca2c4d8ae33c7826f05a8016c44eb39e28c3c1860fcfb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"7f0f599e497ae797f3b5922614ceddb3375c007237412d01b520bb7498ef288d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/premium-simulated-simulated-premium/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ab505bdf28287fe00099987c1bde2c2f297c40c792a7f6cb5fbfa5adc44754d3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"06c1aa31be81b1f5c6266514c955712865b30117291a39dd749994f4ce931145\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m-premium/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1704c6bc15d6f547acca888061680f2275f690cb79e5af6fee44747bcf278b95\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"6a8319194e2c2fc998268cdbab03a5aae2d83019f5ac30c316c4e548895b7c63\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"eaeb360b41b3f9e0bd6b247d4dae3eef1ffc3355d6e9408df3f8f71bc7f033b5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"32cfee4e66c307d5ebed6a406d2260f4374553d184b5486fc53cb64bc6ffcd8d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-embedding-model/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"135ffad9bbcd33779a0b9a1c0dc5d5f547356be21489762803640aca855c728a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"3194cef788c3fa9898599a57480aeaed07c6eac2edf957788235b37d22918588\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-trlp-test-model/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"17002b7f0c8e62582ad262d9c2b8b038ee7f2a9327fe34f21fd4f47134b7b8cf\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5acde2b886749c1c54f99db5c33887e6fc5ed0caf412daacfb5df0f329882c66\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a6a6232fd5656520e75d100c41add5f1637dde9705a4ec608bbb90b724c258a5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"37a71c27032e51fdbc7ca688064a47abb86230a8138af6eb55e8069fad975a93\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-echo-model/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"92917da87eaba4f2684cd45947a3698434b99ff4ca6d3ddde51d6573aecb1600\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b2b26e0af9ad7defb486e5d1db19af6bbdd0998559d16f3776651669aeb4d067\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-echo-model/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aa7038625b8f43b0c002f79637065e5ab90468f50f998759d08f2c4640c07c04\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"2a62f0614f6526bc3f195f838aebd1abe29514f2707db40d9ef738d645ccf001\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"de97dd5d45c6eb12b4a1112ed1f362d8544427428d2249a399e26ba069d6aadb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"22b2ec7ec96ee09c9e07a84cd3d313c2223af42433bbb28c5846401f64d5e3c1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/premium-simulated-simulated-premium/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"dc061bec60bd28b1c132bf30965b4810124429576337bcc4a6030617600d1714\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b188b939a496049e47b8ef664d7c7c490722f1753404a08d89ccec1dcb87b8fa\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-echo-model/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"75612d85af2bae456dadd78163b2d2f9015c0a0bf4e20bcb8a555e6a5ab3b8c0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"96bc4fc13cb63707a942ca33034f78d2b39476a10860398523789db3990584d1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a4493fc88328eba553ef36791fbf4706bffae04a1ac501d099b12309ebc85c6b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"d84e45c7a3e370ea510e8e0294e009b29bc2f2ea789c47559293007b6c4410d2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/premium-simulated-simulated-premium/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2d953f7313807988e63546aa32431d96f77e6989c672f8ab42827c1c21918630\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"dd2f15d9a08862ab664dadf9bf5da25828d327a11a07849fa919713f034c2b0d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/facebook-opt-125m-simulated/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d69b9c128f599c9ea1af84bb3e783ed71688baf6b3ad2b86f2b7183f9a4208b9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"4dfeb9ff2318af8f84e70b11545800bb83948c080a97ae1ece5780d4022bb383\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"dd89509e97b96670685602ae2d08749226db8693944d2c6f868af9d3e0a5feb5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"1025db78adc8b9c9592b692cc227b1a306a99ac5502300d9ed4ed7615f5e3ef8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/premium-simulated-simulated-premium/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3386c5e86c72abcdab369776ccd7182024ab8681cbe497e81724868f101a3c0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"58e90354179740b1af406b2911c9997f3f3283475aeb77ce7918f3b3239a293f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9e75e9fd02f51c2f043b145c5d6b82e95f1447b388ee529262aea27a6a2774ef\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b89d1075a79c93acaa097e4e6db4d6a4b23bf3ffe5e964409e29b258ed725a99\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-2-simulated/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0913a452a02695c6681f1037232199b40b64236fed4d29cdbb41561695826340\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5c0b495d1a10c1cf1548ef17998cb18c0ca25371ad42d5ffe1aed42bd55e31ad\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-unconfigured-facebook-opt-125m-simulated')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"010adf02b2e7deb40c572f4729b6dd4619847c8e6344137326b72df28772fc1a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"c04f8a7c7387e6794115c41161cb001d8a07340d2878cb8f36774a8f6a200ba4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"105cf4dd91a8abf4a93abd65b255521c3d37b560b5d23f3ec59757b5b362fae6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"7e7d1a0ec6d957a4d4de94f93078f10e836b23442c9cfa90f11c8520cca12e87\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-embedding-simulated/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"75fd86e2a4870af5fd78f2ad7aa2a9d79aff977b3678d81954b1e207a9315f2c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"c3cfc634a11046a837448628e2f17db0ed3466194da289a808544d874ecf6451\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-trlp-test-simulated/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"54cd0149b818480305f3d0024b3c95629cafb641b48195d003b2b7006d5c6bcd\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"f5bc618bde549671e84473b23ef3632426f8606e2045744a860c603f2a7675d3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bf65ad13397c94660867eb0205e06d1c9bebda4b019f632c0d0b8ef989930381\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"d8d67afd40f17474755bd3f6b00e265761bf5154febca129bc3f2b0bcd749c41\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-simulated/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f9fa9cfc2b4e701183573419a92c79384cd30210289602f0115c75c5029d55aa\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"ac2105eead12bb02dd7d1691cc77fc8a580b903f98564a8fd585dfa345dec1dd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"596921ddc7ba8523386263c5cffcbd6ad9b6a385318ed7e24f72be06f36fc398\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"f4ae34c5c82a0969651301a535f404653a60a5d75f20c7ea56ad9bb89b67e9fb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f95805f0e9b755664735d898c1d644d571943be553204d3f86136bc35719ff13\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"95c39f44eae69bd53f57e5ff93243887dafd591c9b8cf2e736f0ab034e67021d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/facebook-opt-125m-simulated/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8d5571efc1d304f5bcfc2ffb4ac6819154ba5556c29ce33416d460b887427984\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5d6b359055267732253f201a1fe48f0abe6d5e22b011c70e1cb006eea672f535\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e91aceffc2d4f6d6b120625bd3ca23781b74a1cae6cf1da26bda310bbed0ef07\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"c8475d27649a649c955538ff79eb001372050ff4f1d4ad295b01dc6fcc69ba2a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/facebook-opt-125m-simulated/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a402d1681ab35bace735c19b1d084a86eb3d741d4e1c14371cfdaa55d22c3ebe\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"7320c049419b863194fd55db5ebd887462dd24e1289e6308d79f047431f2bed9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-2-simulated/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f9b535aed6243496a67741936e53a0d303bea1b872a06fb62f1f9c27150edc40\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"5eeab80447ec6c71797517b4d94c6623353e89097743360eadd7f31115976dfe\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/facebook-opt-125m-simulated/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a9800464506c58f005016df354e160757732171ff4d19747202524955329b998\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4984a24eb707d1b965a79974a98ed4afc271f2ca356b150cbc8943de1ddcfef8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-embedding-simulated/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c82a1a3dc2ce54c0b664f79a2cd895a3c40f774b3694999badae8cedd328292e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"276f5d5d67b2bd83c05c2b39e4a262885498e6807e3129a866eff0651b3604a9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-trlp-test-simulated/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"669658556fba0f45c2a82def2f57614416614ddf154ed8dc5f4f9188f10130f2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"692f39321f892929348fe56801dc14c8a35eaf749609a3a5f4b5e684edddf17c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-2-simulated/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c4399a95e89654e5b2bb5fabe45bc947d11ccd1448ebf64c30b195b34f239d58\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5b273834f06c6341dd07bba6c809b3297ba2514e6d3b9b5d0f4f8211c68ccf8b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-simulated/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5e4821ff903ad6ca2e1c42162432e34d8b0a2a78052961e753d36b742193432f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"f35ed2fb168a3a608435006c8c1b103242765d7d37f41bf1dbdb7bbc0331da89\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a91faccafad197e2a4065ce3d12a052ac484d2e8fb2fc9265ee48f02b28e6dce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"fbfd0ada86117ffb0a134e591bf8b8390012983d25496ef188c6da73fef5eaec\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-2-simulated/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0020c64019ffd1a0bdcc75e6441e6a30e6d8bb08f463f67bd2408a1e82b95b2a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e78a4964c93ec23890e62f7f50201f5b832b4c714066a914dc734d8ef60e8213\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-embedding-simulated/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7c924aa2b37ea38067b4e69052d541ea2e7c86fbdaa79b19f9ea09e87adbe4ff\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"d5cf96eeeaa56bb891ea0cba28f7beabf17a8c0f061ea01c768ed842dd26334f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-trlp-test-simulated/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"028a8b5bd5d4e690eebb2f20c5fd47cf0b3c6e2a3619ba9e55322bbca7b94cc3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"8fe4100eab1f023f5b06dd8e19bcc80109b82503466d49576acc234cdda9bf0e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-simulated/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"80056c658070f49140955cb6eabdbd252857a614af6b0f2f2de7a1ab1cd47949\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"53aad0199369eb8c8f787ea099e93092089c04344e8f910dcff366f54bc831cb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-embedding-simulated/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2416d7b42d11a09d7152746be0e114f8fdc87d0fbd0efa9dec5b52b011082194\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e0cfec53d1f17771317082d9a7d69806ae3468971bac79a1135f2b0d51ecdc07\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-trlp-test-simulated/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"50c2058cf11e07a931b06ac4446a56eee86855f00badf26618abe486a7bdcfd7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"f3b6e6c38a521fae8ef5c7fddf3b3178baba88effb4e5338e0b387e28ecc468d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"134a7a790ba665547ca14f80f917549f66ee5063fc41096471c0778399db6dd5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"4ddd3fa1f54c642a57a48737e710ec0116705776084d8cebd8134dfa49accdde\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/premium-simulated-simulated-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4d18a96899c43d55ee63d2ae1a7a938c7e873d88b2fd95f06b2e3aae2c7f1c84\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"44e38055536c3f0d49cb81abb42bfefcf2c78faf963a6160afbe459bbc04db39\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-simulated/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8d34bd12ba2030284fcb69127f53b8158bbdd4a1432bfe619165b4c2c96cc061\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"c9dd9c233e43b53241ee27e937246e51b8f3331f30a7fba22640617c1b0bf47a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/echo-simulator/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"319e246831bdaf5e765e63d5511b516594fd2b64527850e2ddabd2a4a85532ea\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"7cfd2ed5cb8a5913fa5f55b92b02805c6778991c01c80eb14a0962cc710a56ff\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/echo-simulator/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a8c8220ad6f1387002e262ace5db78a2c4bb39e5953306702a228215174f6796\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"87e1712d02794c6d66ec1a932f02901d7a4369f46d0f041178cd3efadb7f59b7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/echo-simulator/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1e077a716d89a43572a3c16e8d0b0436816baa48a2ea227603701f10cad6d6f4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"ae9eac2a2b8c8311bb8c6ea82ab445a5d6f50d2d51c3f79962be9d82007097ad\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/facebook-opt-125m-simulated')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3f23315aacd6e16f4ab41f96aeedc9549d1abdfc9476577a47d45d12875dec5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"165d3b8e224f71685dee07aadd133117aeeed097eae99437d561d5bfa2d22233\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/echo-simulator/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6687eb3cec74c6c51428ce3f3d22d50ba269f59015d1bc8f185da49eb095534e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"05ac0e89d0298398d3996609d7c22b514bdf08bfa3787653bc739995c5942441\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-2-simulated')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bfd36c5ed73eb81df97258ffa1aa36d8cbf6f3e7a8096c33ca4ff417be59d002\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"d5ac583036f3821c88111dd82571eab1fc94aa4e9fcd045b27336f798e26075d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-embedding-simulated')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d303c788902ad4467c7ae545d65cbef45564d1c0d56396c93057df3909461aa1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4a6b0d84cc35c0f532405eea81056481fd54e7ad71284a97ce8f6a2424eac819\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-trlp-test-simulated')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2f53b030326b8e1f5908c601aecd3fffcb6d08a8337d0bdc53ee1fc699a4cd71\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5c3bcd9fb119b0fd45f3b4ba5de5f905cacbb4963fec309a0961a40f76a7a7a9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-simulated')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"098187a2b31ef966f647c443716610cb8d70bdafedfed7bbd4f8b1b568817678\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__4542e5a2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7182a301e3dfb7ea\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/external-model-e2e-rt-sw-847782-931a1687e4da\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-e2e-rt-sw-847782\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__4542e5a2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7182a301e3dfb7ea\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/external-model-e2e-rt-sw-847782-931a1687e4da\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-e2e-rt-sw-847782\"]}],\"name\":\"d4bc8ab4f961e4da03ea520b66c210a99261bedcaa3b8ea63bfd065975305cdd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-rt-sw-847782')\",\"request.headers.exists(h, h.lowerAscii() == 'x-ai-routing-candidate' && request.headers[h] == 'llm/e2e-rt-sw-847782/llm/e2e-rt-sw-847782-a-provider')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3d6689d07457b06902f3cdae810a6a9071ef1bd6fa7f7675596735eeac6d7b7b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__575f1caf\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8b265e835591899a\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/external-model-e2e-rt-eq-d2da5a-04e45017708d\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-e2e-rt-eq-d2da5a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__575f1caf\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8b265e835591899a\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/external-model-e2e-rt-eq-d2da5a-04e45017708d\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-e2e-rt-eq-d2da5a\"]}],\"name\":\"1212d94356550c83d4bb9d33f6230a0404552b9dfafec12dcaec47d80302f5b6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-rt-eq-d2da5a')\",\"request.headers.exists(h, h.lowerAscii() == 'x-ai-routing-candidate' && request.headers[h] == 'llm/e2e-rt-eq-d2da5a/llm/e2e-rt-eq-d2da5a-a-provider')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"dc6a6f9b82cff312739bacc49810b2d51c7df335dc8178b49ebd65433b463649\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__575f1caf\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8b265e835591899a\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/external-model-e2e-rt-eq-d2da5a-04e45017708d\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-e2e-rt-eq-d2da5a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__575f1caf\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8b265e835591899a\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/external-model-e2e-rt-eq-d2da5a-04e45017708d\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-e2e-rt-eq-d2da5a\"]}],\"name\":\"ade6cbbb615caf3921555140aa4c671b7f610ad3149d6df2281c15cf939cea65\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-rt-eq-d2da5a')\",\"request.headers.exists(h, h.lowerAscii() == 'x-ai-routing-candidate' && request.headers[h] == 'llm/e2e-rt-eq-d2da5a/llm/e2e-rt-eq-d2da5a-b-provider')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b278a3f65d6cc70c6e2d022678205eee6ccd6b0dd1185b975c61ea5d681e4fa7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__4542e5a2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7182a301e3dfb7ea\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/external-model-e2e-rt-sw-847782-931a1687e4da\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-e2e-rt-sw-847782\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__4542e5a2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7182a301e3dfb7ea\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/external-model-e2e-rt-sw-847782-931a1687e4da\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-e2e-rt-sw-847782\"]}],\"name\":\"6552a07f5e2833f4750b76f64454853491f84950146659c393be378468143ba3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-rt-sw-847782')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"123ca98e9a0a804d113e560c125759c8e2f539b94d72ccb5454ca9563adb403a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__575f1caf\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8b265e835591899a\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/external-model-e2e-rt-eq-d2da5a-04e45017708d\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-e2e-rt-eq-d2da5a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__575f1caf\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8b265e835591899a\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/external-model-e2e-rt-eq-d2da5a-04e45017708d\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-e2e-rt-eq-d2da5a\"]}],\"name\":\"2fd8df7a0e06e8578c79a9a11e4fb2e2bb4af925019c5460eb76322182a3e241\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-rt-eq-d2da5a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"94ddc5e77f082c32bebc7a36bcebf621518ebf303e83b9c540da1352d04e620b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"50057c9a2acf4ae7152e8c97f7778cb04340d1470974e5272422d0bf244a4e5c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/echo-simulator')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c6918972d1a7f8ad5201880b7d6d9c1191ca1f25376682f691def7868e3fd02\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"01cc37113b4d6c301e355f63decf46a21e93a023494bdfeaeed2890c97ec1f57\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a82769ff87473da04c27497e160e9b4b1a5dd93578e0cf2342be8b2f06845269\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e747b72d92315b743934153588614b27670cf0c9d9dc4fb380ea4965def7f235\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"06b05a8e4dd69bdc4f333ad9509ee8cad3c5c0f5dd48edbe94c1158b60f79ed3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"661962837510c6dc6d1faa64e61ec3086efa9e0a2e7315c6ded616c1879e5ba8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b4bfec1b33959dd0ebfc5cd6fb410688e820d4b55c7f149cb4acc4353f30a9b2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a7740f6e77d024a437502c023fb1d8939cb3cc2b9ed7f4073af7d779e19459eb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"f82564e076ea3e672592bab71e048537faba17a5e909884c2a0204e235905a69\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2ecffd49fe780ea8d7ee498582caa2c41bc635ad490315792e681c7defe84b85\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__4542e5a2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7182a301e3dfb7ea\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/external-model-e2e-rt-sw-847782-931a1687e4da\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-e2e-rt-sw-847782\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__4542e5a2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7182a301e3dfb7ea\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/external-model-e2e-rt-sw-847782-931a1687e4da\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-e2e-rt-sw-847782\"]}],\"name\":\"f9bad537fbe7a6c4935a5a7c8686a356adaa96259346b265b4b0283d55b8466d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'e2e-rt-sw-847782')\",\"request.headers.exists(h, h.lowerAscii() == 'x-ai-routing-candidate' && request.headers[h] == 'llm/e2e-rt-sw-847782/llm/e2e-rt-sw-847782-a-provider')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"456e5dd7dfa9810034544082c8cba90a71807c15f93751d5e3f6273265dd2a02\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__575f1caf\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8b265e835591899a\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/external-model-e2e-rt-eq-d2da5a-04e45017708d\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-e2e-rt-eq-d2da5a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__575f1caf\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8b265e835591899a\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/external-model-e2e-rt-eq-d2da5a-04e45017708d\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-e2e-rt-eq-d2da5a\"]}],\"name\":\"6b743a940b39e00d96d35e9b87e1933351e7ee65f92bd505732f0e5c135d89ad\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'e2e-rt-eq-d2da5a')\",\"request.headers.exists(h, h.lowerAscii() == 'x-ai-routing-candidate' && request.headers[h] == 'llm/e2e-rt-eq-d2da5a/llm/e2e-rt-eq-d2da5a-a-provider')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"766cf4bb260ece5a17a1555c9563719c5bb7959c9d88b568184ae41abd76eaaa\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__575f1caf\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8b265e835591899a\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/external-model-e2e-rt-eq-d2da5a-04e45017708d\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-e2e-rt-eq-d2da5a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__575f1caf\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8b265e835591899a\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/external-model-e2e-rt-eq-d2da5a-04e45017708d\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-e2e-rt-eq-d2da5a\"]}],\"name\":\"d2425870b912321cda429080c0c35d1847e04f7ceaacd7520b82dbbc909b1957\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'e2e-rt-eq-d2da5a')\",\"request.headers.exists(h, h.lowerAscii() == 'x-ai-routing-candidate' && request.headers[h] == 'llm/e2e-rt-eq-d2da5a/llm/e2e-rt-eq-d2da5a-b-provider')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a908063c86927e6bf07b7d793aad9f277ac3c2a8f5f5d468b116cb9e07929b14\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"fbdfff5b213f506d78434055d011cf63d616653e502ee04408a43578986e1e5c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d1d232e06f90d479cd9b802f24889e83af58c51cf54ba273d5e24dcb8a297688\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b49f2d7e152d4de959577465d2494ee11771b4c439cb6eae71c90bff26224fb4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"810f299b76daf089b33c92cfbe0445ab5cc89a48d38e36df0cc89ed6cd1fe8df\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b27d6255cac73fc039120e157e1f3ce0e99e86995ac5a66974d5e8744df6c64d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4f800155f293f82eeaf5fd6a9553c0a1bee90f47a295bba8d7a04b3f11faea33\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b1ccc7ca46f6a14e90afe1dddfab8763f07f30549ce1cda0bae985581f063098\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ce7d381faee9ff949d68d825ffa1dcb9247dad19667ec59a8e91847320dacbe0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5d72fc7cc241ffd60d83142a900be014cc5d57320142e013493b21ecc86cb534\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6565c4085b3917d5390fe1b0194fb3d8319f1d56b45867e3c68ff740b5c16ef3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"be1ccea8a4cc19c7190600de6631fcb661b63db81e2862348a6ef4f90bf33fa3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8d8c8aae1332bb0300ac2d65be9b8708fbfde6d4b5599ec52380cf1f70956045\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"ca48ea5d9ee701ac5383800306378d945e66ca5427eba33396e6805ebbdc1ea7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f6df6bc14432fdc346191db86ee06e75c8090ed87a32c984493c837e97a10be6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"fc54a1d4f18d4d59e58b6a3aa31dbfaddda2b89e5c28dc9eacf14ff38a414021\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"528f8663751fc08f3e8ae4ff6fd43a63d61572c7f149dc0fe75912f5f4b33047\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__4542e5a2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7182a301e3dfb7ea\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/external-model-e2e-rt-sw-847782-931a1687e4da\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-e2e-rt-sw-847782\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__4542e5a2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7182a301e3dfb7ea\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/external-model-e2e-rt-sw-847782-931a1687e4da\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-e2e-rt-sw-847782\"]}],\"name\":\"3ab01a6a4b50257801cab44c4e08e694374d0c202b60aafd1e6d17ac6c55021d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'e2e-rt-sw-847782')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"15b2e87aa08919282b8acd840a1e8677e8854f820cb1d4115c0f0ebbeba4b541\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__575f1caf\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8b265e835591899a\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/external-model-e2e-rt-eq-d2da5a-04e45017708d\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-e2e-rt-eq-d2da5a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__575f1caf\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8b265e835591899a\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/external-model-e2e-rt-eq-d2da5a-04e45017708d\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-e2e-rt-eq-d2da5a\"]}],\"name\":\"b02d20e612eb950eb6cfe4b76fafcb895919db7ffc9de648c5b2e962352fe48f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'e2e-rt-eq-d2da5a')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"maas-default-gateway"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-maas-default-gateway\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:26:51.182Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"e2e-models-e2e-worker-w4-d6cb38/e2e-conflict-b-00e30839-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-d6cb38/e2e-conflict-b-00e30839-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"e60f7badc46aec1644cd0060173958f8fcd6e909d6fee036d0d9ee2d7df7422a","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["e60f7badc46aec1644cd0060173958f8fcd6e909d6fee036d0d9ee2d7df7422a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-d6cb38.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-d6cb38.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"e60f7badc46aec1644cd0060173958f8fcd6e909d6fee036d0d9ee2d7df7422a\" already exists"}
{"level":"error","ts":"2026-11-02T21:26:51.251Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"e2e-models-e2e-worker-w4-d6cb38/e2e-conflict-b-00e30839-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-d6cb38/e2e-conflict-b-00e30839-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"e0544a5ed9d09675f4d41df91cb7222206c434c3b765059d4fd0b1fba1e7f990","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["e0544a5ed9d09675f4d41df91cb7222206c434c3b765059d4fd0b1fba1e7f990"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-d6cb38.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-d6cb38.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"e0544a5ed9d09675f4d41df91cb7222206c434c3b765059d4fd0b1fba1e7f990\" already exists"}
{"level":"error","ts":"2026-11-02T21:26:51.317Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"e2e-models-e2e-worker-w4-d6cb38/e2e-conflict-b-00e30839-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-d6cb38/e2e-conflict-b-00e30839-kserve-route#v1-messages-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"0ba957aff0ff0a4cb61ecb0f1c32719c450140b7899792c398706298d61bec49","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["0ba957aff0ff0a4cb61ecb0f1c32719c450140b7899792c398706298d61bec49"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-d6cb38.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-d6cb38.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"0ba957aff0ff0a4cb61ecb0f1c32719c450140b7899792c398706298d61bec49\" already exists"}
{"level":"error","ts":"2026-11-02T21:26:51.388Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"e2e-models-e2e-worker-w4-d6cb38/e2e-conflict-b-00e30839-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-d6cb38/e2e-conflict-b-00e30839-kserve-route#v1-responses-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"9dc5c3c6b653b81536ffdb2aeb92c595f353d8c2b956e78a0dc7be54d9b9bcc0","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["9dc5c3c6b653b81536ffdb2aeb92c595f353d8c2b956e78a0dc7be54d9b9bcc0"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-d6cb38.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-d6cb38.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"9dc5c3c6b653b81536ffdb2aeb92c595f353d8c2b956e78a0dc7be54d9b9bcc0\" already exists"}
{"level":"error","ts":"2026-11-02T21:26:51.457Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"e2e-models-e2e-worker-w4-d6cb38/e2e-conflict-b-00e30839-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-d6cb38/e2e-conflict-b-00e30839-kserve-route#v1-model-routing"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"bd25d2afd9c786b5981205b98bae3db6e723aec2f20a927b7e833a2e0bac8c60","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["bd25d2afd9c786b5981205b98bae3db6e723aec2f20a927b7e833a2e0bac8c60"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-d6cb38.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-d6cb38.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"bd25d2afd9c786b5981205b98bae3db6e723aec2f20a927b7e833a2e0bac8c60\" already exists"}
{"level":"error","ts":"2026-11-02T21:26:51.477Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-worker-w4-d6cb38","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T21:21:30Z","generation":7,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"36c0d6c0-4ad3-4739-8e18-24485ab1bc48\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:25:39Z"}],"name":"kuadrant-e2e-worker-w4-d6cb38","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-worker-w4-d6cb38","uid":"36c0d6c0-4ad3-4739-8e18-24485ab1bc48"}],"resourceVersion":"33338","uid":"2255fc2d-ab48-428d-86a8-4726b25b244c"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7f9f489fba4cc345dba07951f043d704ea999478c1da34cd23037357dcdf1384\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"f61d2b7d2f64f1d64a2dcee70f47ce24c9c6eb4854589984128561c58f6171ac\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"12f3d170c629c434ef1558f623819a2294b75940427c1164b50933cdad3fb52f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"4d6b2e7d73dcdd0567dbe7811fffb6b677ae17a404dd4e000e5586417b4abff9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cc96dbf4ea257d73d60712e8c847f61b4e4ddfd52e42ff7b0ed78bab89f419ef\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/e2e-conflict-a-00e30839-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/e2e-conflict-a-00e30839-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"30045cbd78c222c29bc59e61945a00b5dc21dfe73f50c886bf9cc4fd4df110a5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/test/e2e-identity-conflict-00e30839')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bd25d2afd9c786b5981205b98bae3db6e723aec2f20a927b7e833a2e0bac8c60\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/e2e-conflict-b-00e30839-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/e2e-conflict-b-00e30839-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"3e081a6e8e57cc295d1185b9a7e911bb87eb7e62bd6c44ae18a4543a32ffd2df\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/test/e2e-identity-conflict-00e30839')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7f9f489fba4cc345dba07951f043d704ea999478c1da34cd23037357dcdf1384\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"5b984da304c827646ff112362de545fa451a799e7f6999eac00f25f038606c2a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"12f3d170c629c434ef1558f623819a2294b75940427c1164b50933cdad3fb52f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"ad40721e9bd95807ea332811f94d79eb07b9dd045127a232886a7924332cbc73\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cc96dbf4ea257d73d60712e8c847f61b4e4ddfd52e42ff7b0ed78bab89f419ef\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/e2e-conflict-a-00e30839-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/e2e-conflict-a-00e30839-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"998eb9aa37550c363730239b1879ecd40d8b7202ca1d0d54707215337f8e043a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/test/e2e-identity-conflict-00e30839')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bd25d2afd9c786b5981205b98bae3db6e723aec2f20a927b7e833a2e0bac8c60\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/e2e-conflict-b-00e30839-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/e2e-conflict-b-00e30839-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"4521d97422d3f0d1c2d88e8dbf9cefa77044fda2b2513494fe8b037b8959a3bb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/test/e2e-identity-conflict-00e30839')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7f9f489fba4cc345dba07951f043d704ea999478c1da34cd23037357dcdf1384\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"b91256531abbaaf08ed45e4a93b53e9af9ebb53002123196214bb374517e81f0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"12f3d170c629c434ef1558f623819a2294b75940427c1164b50933cdad3fb52f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"597cf592078ae14c96f33099e96fee363339bedb2f5d430fdd69e28e8be2a8ff\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cc96dbf4ea257d73d60712e8c847f61b4e4ddfd52e42ff7b0ed78bab89f419ef\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/e2e-conflict-a-00e30839-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/e2e-conflict-a-00e30839-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"e991e0919ecd07f3d1422a6da268e00de60562d5f45392f51bcb2371ba35590e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/test/e2e-identity-conflict-00e30839')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bd25d2afd9c786b5981205b98bae3db6e723aec2f20a927b7e833a2e0bac8c60\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/e2e-conflict-b-00e30839-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/e2e-conflict-b-00e30839-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"efedaef4b6a85f9c8685e5a3086f9948640a84f7f36fe5096dc24bacab4c2c43\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/test/e2e-identity-conflict-00e30839')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7f9f489fba4cc345dba07951f043d704ea999478c1da34cd23037357dcdf1384\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"490344715bd8708a2d31131fc3b4e370beef7eb7d9942ba89fc82080284e6244\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"12f3d170c629c434ef1558f623819a2294b75940427c1164b50933cdad3fb52f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"aeb99e2df9a1951917065c7b887084431b3e62a6f4d47287af43193676a5b8be\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cc96dbf4ea257d73d60712e8c847f61b4e4ddfd52e42ff7b0ed78bab89f419ef\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/e2e-conflict-a-00e30839-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/e2e-conflict-a-00e30839-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"f0bfa7bbca981638c7a81eeed5538634f9b566711526b1d8844116ae067fa633\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/test/e2e-identity-conflict-00e30839')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bd25d2afd9c786b5981205b98bae3db6e723aec2f20a927b7e833a2e0bac8c60\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/e2e-conflict-b-00e30839-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/e2e-conflict-b-00e30839-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"17e6e921370fc0b50ee5271bc03421391165788b7d84db24027490d61da2ccdf\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/test/e2e-identity-conflict-00e30839')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7f9f489fba4cc345dba07951f043d704ea999478c1da34cd23037357dcdf1384\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"fa28a7ae652b865919d1ff4c61fd33bb8512d3139af38d1ceb9697a99e63cc6b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"12f3d170c629c434ef1558f623819a2294b75940427c1164b50933cdad3fb52f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"601d68ffdf7137fde779cf41214f1c74f63e6b717be0b7aad1eb56041a2d9b76\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cc96dbf4ea257d73d60712e8c847f61b4e4ddfd52e42ff7b0ed78bab89f419ef\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/e2e-conflict-a-00e30839-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/e2e-conflict-a-00e30839-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"893e31ce4585566c411fa2c772bd264aa816224dee32c07ba1acbb5105fb221f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/test/e2e-identity-conflict-00e30839')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bd25d2afd9c786b5981205b98bae3db6e723aec2f20a927b7e833a2e0bac8c60\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/e2e-conflict-b-00e30839-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/e2e-conflict-b-00e30839-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"be0d28e4b52ac25308ff2d63618f8782bb4e107932384e8150956311d5789335\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/test/e2e-identity-conflict-00e30839')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7f9f489fba4cc345dba07951f043d704ea999478c1da34cd23037357dcdf1384\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"2dea78ba3797dedd7edd7b687182785345cfd95029e2131769c5797e3b752eb5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7f9f489fba4cc345dba07951f043d704ea999478c1da34cd23037357dcdf1384\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"cdb3a0c564011d63952f137daa521c84f02a66f8a75696ef9ac4f1f2cc9ea8c9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"12f3d170c629c434ef1558f623819a2294b75940427c1164b50933cdad3fb52f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"e019089f573a8879defa7fdce139828725d9f042c5a4dc9974b9185a8a382c51\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"12f3d170c629c434ef1558f623819a2294b75940427c1164b50933cdad3fb52f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"6a08c6dd0c7522c09a18466dfa733eb68e8c593cdc8d2890ccff2f5c9064fcc0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cc96dbf4ea257d73d60712e8c847f61b4e4ddfd52e42ff7b0ed78bab89f419ef\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/e2e-conflict-a-00e30839-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/e2e-conflict-a-00e30839-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"5f203430adf2a92e7fcef5caa6472d22be6fdecdfa22593f229d3d4d32734294\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/test/e2e-identity-conflict-00e30839')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cc96dbf4ea257d73d60712e8c847f61b4e4ddfd52e42ff7b0ed78bab89f419ef\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/e2e-conflict-a-00e30839-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/e2e-conflict-a-00e30839-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"1df33029564dcf21210d080dc17aaa597289adc6b32b5d1ba7f08efca564bf81\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/test/e2e-identity-conflict-00e30839')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bd25d2afd9c786b5981205b98bae3db6e723aec2f20a927b7e833a2e0bac8c60\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/e2e-conflict-b-00e30839-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/e2e-conflict-b-00e30839-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"8cbd1df30a80a484b26e45c9e88570256444bd14717bf6deca03b821b2e57416\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/test/e2e-identity-conflict-00e30839')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bd25d2afd9c786b5981205b98bae3db6e723aec2f20a927b7e833a2e0bac8c60\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/e2e-conflict-b-00e30839-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/e2e-conflict-b-00e30839-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"0b552c3909ade94d4bf5dffacf334ccf0e8e75b6bde8fa8aa0dcb1f4b77b605b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/test/e2e-identity-conflict-00e30839')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7f9f489fba4cc345dba07951f043d704ea999478c1da34cd23037357dcdf1384\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"31c0c96d54839068517aaeb062676423451143447943cafff7ee595d9fd1feca\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"12f3d170c629c434ef1558f623819a2294b75940427c1164b50933cdad3fb52f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"aebde4a102828558eb0fbde9709268d7adabc75fadf451c730e0573c086e2f07\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cc96dbf4ea257d73d60712e8c847f61b4e4ddfd52e42ff7b0ed78bab89f419ef\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/e2e-conflict-a-00e30839-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/e2e-conflict-a-00e30839-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"323d7527b3e5e5633e1567961fecea90799726a8b7f296210503a97014ff526f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/test/e2e-identity-conflict-00e30839')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bd25d2afd9c786b5981205b98bae3db6e723aec2f20a927b7e833a2e0bac8c60\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/e2e-conflict-b-00e30839-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/e2e-conflict-b-00e30839-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"546a84bf9f56d1b63e2f027a29aae267c46e98327ab1794ee165c27b82d52b40\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/test/e2e-identity-conflict-00e30839')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a69bb45bad035c53dd8c7176828b1cc26d0c9d3f775d2059034b1639ca1b49d8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"79db77eb448edf55b65761a293f7f6fc07c9d4365912f7a8595364cdbf33d994\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"86ad7c7e6dbc840bdea5534b45691318d15c6ce0337b47f348909beac33bb9a4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/e2e-conflict-a-00e30839-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/e2e-conflict-a-00e30839-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"9292e1721aed4b5b18536ed9d436254e1a206c8e2fffa9c0321b2a025a8457a8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/test/e2e-identity-conflict-00e30839/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"83bb1b97e9aadc07db3743a6651672685e34c290135dc942fa72f478a66e5fa8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/e2e-conflict-b-00e30839-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/e2e-conflict-b-00e30839-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"9282ceb2422aa986769248b49e5011c9679fce44c750855398100e590fbf001a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/test/e2e-identity-conflict-00e30839/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8060bf3fd40726da919699608d3cfae2e75c9ee177c91100a89514410e7d1458\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/e2e-conflict-a-00e30839-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/e2e-conflict-a-00e30839-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"46b273736f96e54e2f1efc02a78012fd95ff94e000adb28b9ec1bf89e9e35042\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/test/e2e-identity-conflict-00e30839/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ffa07e9cc2abd888cc63b1c0d37ff1eb4f3efbfe8d6d554814630b4c04819355\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/e2e-conflict-b-00e30839-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/e2e-conflict-b-00e30839-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"5fe3b8195660f5051a284b077e85c217e86dd93a868b84863e60987bf28ca8d8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/test/e2e-identity-conflict-00e30839/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bc922184404ee148a21ce241c97a2ccb12aee72ef50012c5ce16c77c0b52fd37\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/e2e-conflict-a-00e30839-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/e2e-conflict-a-00e30839-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"6a060c964374de1ca9cd579654f16ac00c9832a380e28cc2592d7704d31329c6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/test/e2e-identity-conflict-00e30839/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"decd3da4c01813aad7b20f941fc8db4c361a5ae944965f7f204b4667cfc3b67f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/e2e-conflict-b-00e30839-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/e2e-conflict-b-00e30839-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"61b4f356d318da314a99a6b8178f18e53f5bb560182ad8a6973a706064633990\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/test/e2e-identity-conflict-00e30839/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3b1cb178e85b8fd11320d8564777fc71ad557e2b9fe91e462914dbc3976f6a7b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/e2e-conflict-a-00e30839-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/e2e-conflict-a-00e30839-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"af2934ab6d11d8fb56513410835e5d9d1c036ad1f935c40469ee2a95945eb475\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/test/e2e-identity-conflict-00e30839/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7b072f859283c6eb5c61bf4ba487bbafc01f8c48582280db598457737341dd11\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/e2e-conflict-b-00e30839-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/e2e-conflict-b-00e30839-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"fe597b8a999c9778b50273f51b6ef668832d805a1903a5680c796c9a321299a9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/test/e2e-identity-conflict-00e30839/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e5e9b9fa41efe7f56f3ea6e9079d12a9f3e89cd596105815b30b04ba7ba1281b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"9b7cb9a28ed2fc7fdfa23c7d8d869cc573e3e72423805bef3f945a77d2785710\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"dff7a596e1042978304d40238abe84063cc499f4a6a2f9def85e7c84d1df1ebc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"4ebe0e741886c221cfcd8d1126bcb3535dcbe15c7f802a713d3b2ceb8cee37e1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4db1dd6250896b02d5f97b90471902db72d349ea082f211b7b5e4046c827d477\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"9e4cdffa79635674b661188290cd9c853017f5721accaa1f268edc6c6b7f2590\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8ea982efbe7afcd4f8dbaa4e864584b38ec852971d686ed11c87e99f1b9f4f9a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"1ed83021e2408187ee74cd1a66732d37b92c80d46439951ce5e0f654f1542381\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7d8b4229a4e8df0df0b627da5317c526c045e2ab5837161d638a7835193820d5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"36ee8c63f509519eef9ec6e2c257745b647d322586f8289611274ca06f90ec11\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2c4b4abb753457c4ad4bd5815f6ce55723fcfcf44f298a47923e03e51d023a49\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"3ce9856de6f3b95cc2ed4fe4abeef13ecb59b5b1ef0102b858e5d3ec0d8afa89\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"418ebb8af9ea13fbd983ac6a66465cfdb429cdcd44fff013139b557fa140580d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/e2e-conflict-a-00e30839-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/e2e-conflict-a-00e30839-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"04fff5833d8c96ebab6a819c0bbe014350a3d786ed00660e4cffca6fbad8d6e0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/test/e2e-identity-conflict-00e30839')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e60f7badc46aec1644cd0060173958f8fcd6e909d6fee036d0d9ee2d7df7422a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/e2e-conflict-b-00e30839-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/e2e-conflict-b-00e30839-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"4096d508b42d61fb240fbdc6c84138bade6ec8effe890fd47b74394c8b4b8335\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/test/e2e-identity-conflict-00e30839')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7fdbd59414185d321c56439c757d9c725c67465b49a83a52b935fdd9c5f0df82\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"2eb3ad4b5e4be8080b2e0309815371172455a7e5f61cf9c3c595f17e99e6f681\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bb82cce53996fd9a50a4f33832b37ff599d227ab91d54895bf0ab989d1eb0b01\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"138b7da9a4ea2091f7b13106ba292672e2ca1d22138b32de717b07cab221eebc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aa4cdf1fd2108500b02394e8b26e800679a875068d8913ad4d968dc008d373fb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/e2e-conflict-a-00e30839-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/e2e-conflict-a-00e30839-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"21b6bf3aa648fcb0944d4d67aff5b20e953239dacb42149d6e8e4ffc460b5992\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/e2e-conflict-a-00e30839/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6c93211933d113e61eca474cd3f8bf9988cddebeafb9c91e5909f07aa2694136\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/e2e-conflict-b-00e30839-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/e2e-conflict-b-00e30839-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"33647ed58f7a155bbb10c9d12310e701f4d942e3e1b3c301942a54345d84e9d8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/e2e-conflict-b-00e30839/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7ebdbd5a6be861834fc366408f369ad8f021dfe8f061cbc93334bc801f3df98f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"be4080fc1058816edd779c6c2b40a1657320a89a6a86b4ff7358026a6adb2e23\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a6e80d640d49da44f2b60f9db62279137aa6839ed5acbca6493b96977b1f3f9b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"b470ad22bfeca185d9d86c6a107cdea6e62f1aaf494ef31244de0d30052bbcfc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b1fdba63ead328fd43c505e06394bc2adb7e5e2dfb0a1e55ef2c41d8f345142f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"30a1d05fede91486be251352bb7291a36ac69d50b6fce18433612afe29f1b4b1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e6e0130bddf4c6eb5ef3b791364bf6c36f3d11363b6a9a79ea626214a148efd7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/e2e-conflict-a-00e30839-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/e2e-conflict-a-00e30839-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"72aa28f9a73920f3a061ad38c4286db26460325e59bb85fea59c4293f7ad8c5d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/e2e-conflict-a-00e30839/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"eadb6a7d6f02867d748c9df2b385bc6f0ef64b12f4a78bc2ec405a0b74c1e489\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/e2e-conflict-b-00e30839-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/e2e-conflict-b-00e30839-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"b5f057c4bbf5f7285d961362319cd4a40e28c5d708a3ba9fd7d01809ccb33762\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/e2e-conflict-b-00e30839/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f2655bcd7b6a7d3d8a4479c1c943c5f2b4d4fbb7d96408fc7ce07c4e7bd9f30c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"12835533e58f43762872e20b92b523339a9de435dc7d0f689b42133b367fae44\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0b34ea4a2ed4e51285726eeb6c0d2255098ff7a0227e3ae2fe7d40f1a6fb02c2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/e2e-conflict-a-00e30839-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/e2e-conflict-a-00e30839-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"902defa23e3cbf0c06eaf4f51e824d6712152257e5175b5a96519ba0d1a3551a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/e2e-conflict-a-00e30839/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9dc5c3c6b653b81536ffdb2aeb92c595f353d8c2b956e78a0dc7be54d9b9bcc0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/e2e-conflict-b-00e30839-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/e2e-conflict-b-00e30839-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"ac774dc1464ae32cca787c4a55dd13fe0357fb2185e5d129848ae352cd5476a7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/e2e-conflict-b-00e30839/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c4529da130989574bcdb533c1e0e24362f26d9f197cbf7df610ae03a1fbce4e7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/e2e-conflict-a-00e30839-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/e2e-conflict-a-00e30839-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"0c8723b793070d87662ce1d893ce8e6e6dd8f9c6f656f96cd4cfb6512f5d2238\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/e2e-conflict-a-00e30839/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0ba957aff0ff0a4cb61ecb0f1c32719c450140b7899792c398706298d61bec49\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/e2e-conflict-b-00e30839-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/e2e-conflict-b-00e30839-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"987a685744b692d29ac38eee859d2c6b4eceb01bf498735b903b4f249615bf4a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/e2e-conflict-b-00e30839/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"309f6b916a61539853033efc6ca2e083c01c99e5b96f857a7c78b89f9816f598\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"788f4c0f9a4e5a97247c2043b8125cf170fe6674c40d873723dc972c4d5d93af\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9a1afd5e20de63bb2c85d93c9c3fd7aae15a0f45cb6e07dc467b8063b97decee\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"4c928eaa593596b5c3719a02958892d193943b2129a32e43035c896d93b232c1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4b5d6544ef7fd39f49a5af0551f4a404b0a5f49df3054a95306b7f797216c599\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"8773bca7122a801a4f199775b03693ad30e316ffebea5bcaf72af079bf14f24d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3474cd3af51b646106406cc4778f6a5608fdc62b1fd92f27ccbcf8ab285bc05c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"f0bc235629f48b82dcaad76bce5cdb80abfa82763d9ad220a11c3e27d70223d5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c34c962f04362894a54cdf652c523865dbd1633f051244729b008181d474e55\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"2c3bfc8693c69427d3231717a8df2d14aba0f1fb87d9fd82bb191f0ebb31c308\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e12ef81cd87aec42f5b2528c46a9aeefe6b1bca82398f07b17a52a4bf6e91945\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"bd1615998be1912965bb2d26173bc1bd1e2565f8996f1f21fc476ccff3b1ad05\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"afad78a84f7065860afbdba46c6a63b40d724d1b9ab8d52752f53b815386ea50\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/e2e-conflict-a-00e30839-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/e2e-conflict-a-00e30839-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"886d5c38899d41857a4c3da2e622b9e477cd981e0d9d14ec0d28220cd077148c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/e2e-conflict-a-00e30839')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d1f6ef05b7178d05a0f291462a07f64061a3744c43a38cda317da12ec42593d2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/e2e-conflict-b-00e30839-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/e2e-conflict-b-00e30839-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"2d906c065cd7d5ef49994cdc3b70f4b4bdfe3f63f17db2f7023d6efeaf765315\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/e2e-conflict-b-00e30839')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a6fa5c95daf46871f07bc4e3ef7985a19659c040a1ef2a7baccccaa90e241705\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"3a34ac7af354fbf7d29872077cc2e557a29218e220d9e4e79e21710f2084e770\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"16cb85f469e7c5716866312b8b4cc95d7bd4782b54923c1571be2b995ef85c30\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"a65b58c28d5a781726a832c59d62e640ea9d347c008d6795a6bc79865414532f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3aa68add648f18fb79f3def0d73f0c2f29d8ab60b1352cf4548a1a038cf3d923\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"fad9cba453f811618739c6f08a8544a889f48ec7511f7d3ccac0f71ba988967b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"099191e40682a5a6b1df435c6dc10936b8b4e31a891f3520e8e9f8418b1acc3e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"adbf9660bf8db4b1489d019993fddbd2863d0cf7c72174df8663c00e565a1e21\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"13694f4cecc05b3e953bb7d1aa68f96fad9b8548456e1357cc504ba9936493bf\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"fd3f6d135cf69e39efa3702af6a7e665f47a40ddb90f71d1f37cad11438027bc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"db8ed9490207e877020d08d86f8a9769046fd69225998abd4e476e93ef7b9431\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"e3ae0784ebe4c51499f320023e5e93f640f2a33ae4fea237cb7e068df1c76739\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"12dec0ddb151cc18ef75cfe2b4260788095e28a391f359fc3f7da7c75381b728\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"8f6398fb66bae44affa747ad532a12445774a5b43ca2c7196a633d5d03da8c80\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"735d43fce555e32c36cd137abc0678ce944fbfe58a677497d16ab8d9ab37074f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"1016de6b3250a59509e3bc1de65ad0a68ae6faf776c4eaa853d86bce7dd96698\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9a442413f7e81c114c48c6bbdd04c0e3809cdcdf4def1f524f6d3adf70468027\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"785762b8cbcc7dd30b578476b081ad2df517e9e450947fa2591a488b59407126\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2a787a4ad1373a3e209fa1c9cccc9fdc70b28bc84c085432c148210833c3f17e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/e2e-conflict-a-00e30839-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/e2e-conflict-a-00e30839-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"40e35aa04042e99fa7293abea06d2cf928e8b4a53abd72da6a8d442f0b3d9596\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/test/e2e-identity-conflict-00e30839')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e0544a5ed9d09675f4d41df91cb7222206c434c3b765059d4fd0b1fba1e7f990\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/e2e-conflict-b-00e30839-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/e2e-conflict-b-00e30839-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"39ea6a8f32ee68dbe98531c82bd2bcc6571f56d6a3a65f01fc9a3a6c9e58bf12\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/test/e2e-identity-conflict-00e30839')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-worker-w4-d6cb38"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-worker-w4-d6cb38\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:26:51.619Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"maas-gateway-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"maas-gateway-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:26:51.907Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-e2e-rt-eq-d2da5a","namespace":"llm","uid":"b2b6010d-4d0e-4c54-98e8-4772fd8d7077","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-e2e-rt-eq-d2da5a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:26:51.920Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-worker-w4-d6cb38-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-worker-w4-d6cb38-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:26:52.053Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-worker-w2-6fa533-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-worker-w2-6fa533-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:26:52.743Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:26:52.743Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T21:26:52.983Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"external-model-e2e-rt-eq-d2da5a-04e45017708d","namespace":"llm","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"external-model-e2e-rt-eq-d2da5a-04e45017708d\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:26:53.075Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"e2e-conflict-b-00e30839-kserve-route","namespace":"e2e-models-e2e-worker-w4-d6cb38","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"e2e-conflict-b-00e30839-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:26:59.270Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","HTTPRoute","AuthPolicy","TokenRateLimitPolicy","Limitador","ConfigMap","EnvoyFilter"],"eventTypes":{"create":12,"update":10}}
{"level":"info","ts":"2026-11-02T21:26:59.454Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:27:00.333Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:27:00.524Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:27:00.524Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:27:02.153Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:27:02.162Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:27:02.162Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:27:02.173Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:27:02.173Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:27:02.234Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-02T21:27:02.234Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:27:04.177Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:27:04.177Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:27:07.484Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","Limitador","ConfigMap","AuthPolicy"],"eventTypes":{"update":17}}
{"level":"info","ts":"2026-11-02T21:27:07.619Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:27:08.567Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:27:08.662Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:27:08.662Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:27:10.250Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:27:10.251Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:27:10.255Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-02T21:27:10.255Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:27:10.260Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:27:10.261Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:27:10.261Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:27:12.185Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:27:12.185Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T21:27:12.541Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-worker-w1-5f765a","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-worker-w1-5f765a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:27:18.323Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway","ConfigMap","HTTPRoute"],"eventTypes":{"create":1,"update":2}}
{"level":"info","ts":"2026-11-02T21:27:21.139Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:27:21.141Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:27:21.150Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:27:21.154Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:27:21.154Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:27:21.165Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:27:21.307Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:27:23.433Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:27:23.433Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:27:29.537Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","AuthConfig","EnvoyFilter","ConfigMap","Limitador","HTTPRoute","AuthPolicy"],"eventTypes":{"create":12,"update":19}}
{"level":"info","ts":"2026-11-02T21:27:29.721Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:27:30.466Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:27:30.558Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:27:30.558Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:27:32.457Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:27:32.457Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:27:32.474Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-02T21:27:32.474Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:27:32.523Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:27:32.525Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:27:32.525Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:27:34.634Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:27:34.634Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T21:27:34.697Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-worker-w0-0c9014","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-worker-w0-0c9014\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:27:40.799Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","Limitador","Gateway","AuthPolicy","ConfigMap","HTTPRoute"],"eventTypes":{"create":1,"update":18}}
{"level":"info","ts":"2026-11-02T21:27:40.929Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:27:41.858Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:27:41.963Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:27:41.963Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:27:44.035Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:27:44.037Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:27:44.041Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:27:44.041Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:27:44.043Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:27:44.046Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:27:44.199Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:27:46.308Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:27:46.308Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:27:55.395Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","AuthConfig","EnvoyFilter","AuthPolicy","HTTPRoute","Gateway","ConfigMap","Limitador"],"eventTypes":{"create":12,"delete":1,"update":20}}
{"level":"info","ts":"2026-11-02T21:27:55.578Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:27:56.727Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:27:56.862Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:27:56.862Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:27:58.661Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:27:58.662Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:27:58.668Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:27:58.671Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:27:58.671Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:27:58.671Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-02T21:27:58.773Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:27:58.773Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:28:02.346Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:28:02.346Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T21:28:02.671Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"data-science-gateway","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"data-science-gateway\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:28:03.139Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway","HTTPRoute"],"eventTypes":{"create":1,"delete":1,"update":2}}
{"level":"info","ts":"2026-11-02T21:28:06.025Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:28:06.028Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:28:06.028Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:28:06.031Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:28:06.036Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:28:06.039Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-11-02T21:28:06.149Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:28:06.149Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T21:28:06.149Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route#v1-messages-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"5cddd3e1918c7df14f710eb09cebc745d043be6f81e6c1e1f2a3803e2f0c6513","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["5cddd3e1918c7df14f710eb09cebc745d043be6f81e6c1e1f2a3803e2f0c6513"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"5cddd3e1918c7df14f710eb09cebc745d043be6f81e6c1e1f2a3803e2f0c6513\" already exists"}
{"level":"error","ts":"2026-11-02T21:28:06.216Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route#v1-completions-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"66eb2a66302c20c8061f062df1542c7ad1db513c8b1988f81768f7d266f6665c","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["66eb2a66302c20c8061f062df1542c7ad1db513c8b1988f81768f7d266f6665c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"66eb2a66302c20c8061f062df1542c7ad1db513c8b1988f81768f7d266f6665c\" already exists"}
{"level":"error","ts":"2026-11-02T21:28:06.289Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route#v1-messages-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"7be093b94c77d8e466548a812b2fd67ba6e4cdbef2e705474d1a124d26a40f56","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["7be093b94c77d8e466548a812b2fd67ba6e4cdbef2e705474d1a124d26a40f56"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"7be093b94c77d8e466548a812b2fd67ba6e4cdbef2e705474d1a124d26a40f56\" already exists"}
{"level":"error","ts":"2026-11-02T21:28:06.356Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"bc33498b2dcdc2f8d2612aa17c0e640458a4442c9d7f2ad45303aeb15b5bccb9","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["bc33498b2dcdc2f8d2612aa17c0e640458a4442c9d7f2ad45303aeb15b5bccb9"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"bc33498b2dcdc2f8d2612aa17c0e640458a4442c9d7f2ad45303aeb15b5bccb9\" already exists"}
{"level":"error","ts":"2026-11-02T21:28:06.426Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"c17d6c6438d8754832a843b7a082fa7fc719ecd30696a3551f3ca815dd52f28b","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["c17d6c6438d8754832a843b7a082fa7fc719ecd30696a3551f3ca815dd52f28b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"c17d6c6438d8754832a843b7a082fa7fc719ecd30696a3551f3ca815dd52f28b\" already exists"}
{"level":"error","ts":"2026-11-02T21:28:06.585Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-worker-w2-6fa533","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T21:21:58Z","generation":7,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"350cbfc3-ae8f-47d8-bf88-3bc797a06de4\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:26:25Z"}],"name":"kuadrant-e2e-worker-w2-6fa533","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-worker-w2-6fa533","uid":"350cbfc3-ae8f-47d8-bf88-3bc797a06de4"}],"resourceVersion":"34575","uid":"e9c29fe8-1b7a-4730-9bc2-e4f3e80147bd"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2538346ffaabe171687c406d12f294530661f7690a04d14ab2327034447b1886\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"fc3c7a9daa18c716699d2f1fa233a5848a5d36cd60feee59a35bb57159d77252\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"df8548d2a100989756489c2811783626f3836ef18d08ba8c81bfb6b9e9ef9c28\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"983a86a79f65831a149f35f3c7673bbfb37560154023198d82ebb8965ed48c8e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/premium-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"13cb74b6bdfe9b2af39effc13c9d5ade5172cb10a5930c6aefbe733c0ab0cad4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"462645ad06b45e6f5c9824c64f8ebc4010534cdeadc425c4ab2c9b0594a88a7d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b565990bc269af90f4e0533dedaf97fc37dc70b037af910a7605358eda2713f5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"b369d9c3b4e9e1fbdb75c9e353f7e25f066823d31fb733c322ac2192463d58e1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-2-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2538346ffaabe171687c406d12f294530661f7690a04d14ab2327034447b1886\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"53b8e179280ac5286bf38489ea72372b11c85a8c387359bf689ebecff1663d36\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"df8548d2a100989756489c2811783626f3836ef18d08ba8c81bfb6b9e9ef9c28\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"c166f75566a6849f94f19ff1eaf52bbfeb65e132db0ce99439215a5fba3cf50f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/premium-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"13cb74b6bdfe9b2af39effc13c9d5ade5172cb10a5930c6aefbe733c0ab0cad4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"2eb901a322f6f85745b1b216f71a9aeaf7eef69af5cc7ad9aead13448f127634\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b565990bc269af90f4e0533dedaf97fc37dc70b037af910a7605358eda2713f5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"fae945183d4744cfc72f99d3814545646a9a87e750465f9b67476229ff21e62f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-2-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2538346ffaabe171687c406d12f294530661f7690a04d14ab2327034447b1886\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"89b4eca3220447cd92c83c9c71f9e61e645c1f746a07d9b87eac9b2d4af27f2a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"df8548d2a100989756489c2811783626f3836ef18d08ba8c81bfb6b9e9ef9c28\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"82b649105e404b52dbe59777c528effe8ddcaf390c919bc52a045d6654c17d27\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/premium-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"13cb74b6bdfe9b2af39effc13c9d5ade5172cb10a5930c6aefbe733c0ab0cad4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"0491f04b3838b4a997ad42c2f3b87b5bc525f5236ef6a51647a0af61e52bf52d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b565990bc269af90f4e0533dedaf97fc37dc70b037af910a7605358eda2713f5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"e160eef909b8d94a314732c333511d40579117e325a0f92347c702a5ee49c702\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-2-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2538346ffaabe171687c406d12f294530661f7690a04d14ab2327034447b1886\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"0f54f971c3b78f7352580f77fc5be3e00c2117ef445b417be77bf67ea75539a5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"df8548d2a100989756489c2811783626f3836ef18d08ba8c81bfb6b9e9ef9c28\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"616030c276c95a5326d811265a5516c30019307d032046e4dbf9c60aed89bb9f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/premium-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"13cb74b6bdfe9b2af39effc13c9d5ade5172cb10a5930c6aefbe733c0ab0cad4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"60974e3173a2c5fa225357d66a1c4055fbb2b76b845de70e5504acc58902d471\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b565990bc269af90f4e0533dedaf97fc37dc70b037af910a7605358eda2713f5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"18b6544f1fecef176364e89f35a905f48ff233680f0d7e6adfd1caf2b5f57048\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-2-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2538346ffaabe171687c406d12f294530661f7690a04d14ab2327034447b1886\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"6982a3a190cf8786b034f1d39a14b07dab2e5311ed66344e600b389726798c72\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"df8548d2a100989756489c2811783626f3836ef18d08ba8c81bfb6b9e9ef9c28\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"d8b01a7d8bf17be310055802641797f595c1e7290b01b91e2b87cf0300418b94\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/premium-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"13cb74b6bdfe9b2af39effc13c9d5ade5172cb10a5930c6aefbe733c0ab0cad4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"28c14a49b36fb1c2749324536c3bd478da8cea176c30e855a8c62d376476a248\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b565990bc269af90f4e0533dedaf97fc37dc70b037af910a7605358eda2713f5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"d42afd956ea2d4dcd0f0aaadc1669934e404dadfe3651ba4498df28db6f58683\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-2-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2538346ffaabe171687c406d12f294530661f7690a04d14ab2327034447b1886\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"87456404dc6fbf2160a52ba615889680b0c5cf40dc6100bb0e888288606dff25\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2538346ffaabe171687c406d12f294530661f7690a04d14ab2327034447b1886\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"8b9c2ea6de06bba9ed1ba2a65e99d1500ef45630a372914ecf445da73d74600a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"df8548d2a100989756489c2811783626f3836ef18d08ba8c81bfb6b9e9ef9c28\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"9222b1bebeb91f5bc797ef6f55e59f628b5f90c3da7305c7a50abb490cf18e24\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/premium-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"df8548d2a100989756489c2811783626f3836ef18d08ba8c81bfb6b9e9ef9c28\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"63ba67de9ead24d6aab10a349447139ea4c7227426ee6072b8939e91ccf0ed30\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/premium-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"13cb74b6bdfe9b2af39effc13c9d5ade5172cb10a5930c6aefbe733c0ab0cad4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"b23898184efef7f96fc649e5d2902d9e6f7d32805be8858eb5f57e88696a09d3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"13cb74b6bdfe9b2af39effc13c9d5ade5172cb10a5930c6aefbe733c0ab0cad4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"652be1bab4f56953c3da93778aeff670b21e92a5d993934466d89aaed158b5b6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b565990bc269af90f4e0533dedaf97fc37dc70b037af910a7605358eda2713f5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"e11de01e8f11e362fe12a9bcc574088487751f93b5de75b1bd8c99739acc40b0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-2-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b565990bc269af90f4e0533dedaf97fc37dc70b037af910a7605358eda2713f5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"4672868f1e2492bd2ac79be6374bbac36317364afff96ce0c9c7ac3d568f0b14\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-2-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2538346ffaabe171687c406d12f294530661f7690a04d14ab2327034447b1886\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"d58c446a6a9364595eaae0256bc0befa6f57ed0387674ac1d6970632cb6b41f0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"df8548d2a100989756489c2811783626f3836ef18d08ba8c81bfb6b9e9ef9c28\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"6e120ade3c6d3506708dea5d54e9bc2fd6306ec4718a0c11f9c0a89c0ea6f1cd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/premium-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"13cb74b6bdfe9b2af39effc13c9d5ade5172cb10a5930c6aefbe733c0ab0cad4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"f9f60e3c0c3c06fefd218a3662bf2dac472c1d5acfd112579332b16c2386f504\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b565990bc269af90f4e0533dedaf97fc37dc70b037af910a7605358eda2713f5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"6f55ce1a1c1254c42ba8a4204eaa5d732a42974a08d182b225b6ac98681f141a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-2-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"79e41416d85afbda9f192c421571f899a58b4937465fe640fd4d17dfb0d8240e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-6fa533\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-6fa533\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"af109b5290beff4991ef93d4a835ce24ed3b0986578fba7947a76ca1a6dd65e2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c17d6c6438d8754832a843b7a082fa7fc719ecd30696a3551f3ca815dd52f28b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"fcc5f235388ea2c13a59ae86bacfc4eb4fab79468e3ee8c91a602bb5eeeec1c9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-2-w2-6fa533/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8abe3e629bd34674437803d6e54a0cb90fe0d0df12d2eac23f0b40d2f4990b37\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"ccb67df939c7a3278e2bb82db8d5dc418650599ab46b4bd1d8fe07cf9bb459d0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"371e486415502802484cc345e68be13e0a37a1abb38f2f6c8cce9f8e79b8d9c1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"b41e21a5fb7ad8cd75dbaa2def82137084248aef58468ce3d04ebccec2987b3b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-w2-6fa533/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8f50bf1a21545f68eb583e07935b8b0da52bbc4743a8bc67c4d9545b76da56af\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"7206c2870629f698a99d45c9e7140cc1334b531b1ad5a3c88c147fac40e793b2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/premium-w2-6fa533/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d4fbd382871bb4f5406c37842f4848012cdca0b01e2d7698dc28e396dc18659d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"4924ec7c564baa67e51d989aa281cf4421dc82ba2910dd5cbc5e8ec66fd31e46\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-2-w2-6fa533/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"503064d3f84a23711f1dad5e35d11ef1efceaefb2204608d180ef8d886666ffa\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"1036f7f4f8b7c68faa7a499350cf496a96528b515b125a726c7e904d5297c1e6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e199374b1d053d8a1ea2fb463b47f0da1b100cb9029acd61282384f0bb2553a2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"fc0e1b2816287c18a95319a2d0a9379a9f7bf931fff586f75645e37973bc0009\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-w2-6fa533/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b3a9fbda204f0b6bfe85682d0fee9fd7a9712977e22af554d2d82ba07f1a075a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"e94cca1d60d77f1db698aae8d99dc62d60279b8e5de4556def17f51ea3d8b77b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-2-w2-6fa533/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"41e99bc62a2ac4e8034135f4b655088597f627c66b2efc4627394d148bc2b0ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"b2fa16adeef96749257d873656ef49327fe454d7ba806ae3a8a73ec44c8a092d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2f2531e01fa8fc0031706fadbba0c1818c30681dcf9d2c65b1c7c23230ea3a32\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"d04838d25723911d554e0017a035ebf67253923630681f27a1c93b44878b1bcc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/premium-w2-6fa533/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7be093b94c77d8e466548a812b2fd67ba6e4cdbef2e705474d1a124d26a40f56\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"89ba01e718f4b0e60188b8031e9bd1e3cf1d64712b57d397151cd36a5d6214df\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-2-w2-6fa533/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f1edf5f89fd287762fbbefa668581cdc8f1877a3f31497227c537000670166d9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"dbf8e642e7e029e70e317d8df7b5d12be0fc1f008d29ff415d7291c09924eecb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cf13f5a3da5f1ddbc441422b55ececcb0ffd227c7be1c942dc1d4c428387bca0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"0aa6387a836e4d80af5fd5a2d66846f1a40192a89e137f80c52334aa6d868a1c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-w2-6fa533/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"afe9746e0af749da011756561a859419e447efc535f5e3f3773b1d18a5b5a9ac\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"7ae7a5b24207da4f6cb3659a8b6639f53e96a876f02aaa1f0a8b92813f856ad7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/premium-w2-6fa533/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"739e19d51d8fbdeccfc8bc7587afd12132239f688ec6cf8d9586f242a71087f7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"5f4124bfb1cf4c49006c1e2d45346f89a11b72e563d9f8e2d4df054bb65c496c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-w2-6fa533/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8309dc44d5088e48040255bf86dbc622de08fc216837cd0027a69bdf179a9d2a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"206d678ecc5400943db26abb21afd48a2ffc6fee651aa73c8301a56858221aa0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/premium-w2-6fa533/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8f577e4cdeda37406cbf43b607fe4ff7a6bd85c0d3b2c53a45b82a9207f437f9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"7cdf48530943053e434f696a48871881d26809d6cd1a88e8b6daa617fd34d36f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-2-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"206e50a9b0e5f83281f994d9f1d85f92406e3544297c47017c081f763b10dd96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"1d9b68bda9fa73e5f8e8ac869771d602c5f128903fd22e64db2370f9749a3113\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6ed7710bfd4535612b60aefac40ff2eebbe50fc666cc75f29a23130bdd6ea269\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"1245658c93fce9ced820408e5e090ae4dd51a7c56161a6cfb1ef978beecc3557\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"313f15eb64d50822c9c91871179d7a6ffa3111f658f213fdc0612575f480add7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"eb5df92dd93dfd3d0bc54e95c455fd8d583232e993ed8aed3db80f624312b066\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"62457e23e29ce9b4e8380d685c5e9e84bc5137e91486a6f9c1c9e352ca3a021c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"957121ddf9ee4c2793cec71a8576e07ee1925a201f93c8de02b6fce446d010d8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1ce9b189744d237515a1896d038a3437e8e31669b01937d8cf3a067728ee7e82\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"672be8f3fbaf802659dc395e46e1b17c7ab1515e557eab74f4c7d2c055ad4cf7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/premium-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"881b63d46f0e94053b88caefbfd71fdab183199879cb564ccb3671b6189fcc2e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"4e3e10829c680ef4fa33002314a596e964d519ea2f3cd6331d666a22cfb597e5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0947683a63afc3251194a3b586cb934b1350dcaa171c4fd826d6773a00d5cf2a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"88202ce79ddf6dca9b8c8b1fbc0aa013155bc9975075ee9158a09c6708287af4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"66eb2a66302c20c8061f062df1542c7ad1db513c8b1988f81768f7d266f6665c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"64c175753cea5698cd255c8a903061deed215a3afcc403ae39f57d7b0f7600be\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fd7deaf8530c822c1b10ef4c1b0887086bc840af6d5c7a730508ddcb6e179095\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"14655ca6105b9121c6e780127a21626d2e779082f0ea2674b0d77647d247a24c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5ea067858e444716d33ddecbe718b086e12804ce72bba0a6f135b64fb1bb1c60\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"c88bc53da3544fc41175edc07ced29960aa58c4f7ebf17609eb30f993b862ccf\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"828fe179b1caaef8c4abb4ba71cbe53ab31fc04108a1194889605dd8100c90f1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"f249401e68d6dcd41e2325910ee9db0254c3afa92a19923e1751980966a4694d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"60ca770315801fd35b67ab23639ba4ac6a344fcf95fe492c267cc87cb90ce14f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"d7f0af7e7ca785bc5de89e740ff47459e16eb3ba9360c1eee59d6d8d2f7389bd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6d6f6c08f92b4cefaa6a997643ec612cf9c62df4fa750dd0f5d4c3d50d40d2bb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"daf823a39b0f169fe5f258178380bcf0b3e996152ebcc401fb21de178f041b24\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5cddd3e1918c7df14f710eb09cebc745d043be6f81e6c1e1f2a3803e2f0c6513\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"b1d5e4fa434bbb80c0f5baf3d8ee1797394841413a8f28625f4e0c9d2388764b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1f83c46a7c87c216ad3b7a3697a1ad6c518cb36972a910efbc3c7eed6ab3956a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"496ec6213c84428bc1374936695dcb9246c04c80a4460a92e53220e4641a7116\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e701c3e95fd6d7e3e60b9f162039289bbc904c42df899db9436b6ad7538d1ffc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"576f13852617450ef4f108d2d8c65426c74c6f743bd5e3d6530d746e72633fbc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"25cb748ea88f201b192c863c4e2fb40e5931cd9cfed0d04ae104e35dbe48f38b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"c49c039641c1cdbec2a8f5cc805b4b722943e1336d082080571a2f2fcb073186\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ad04b751b35d313ca76c5057f5e800aa0d5504bc27298aa1762dd803d351bff2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"a24ccfd407372af3bd4160c32a086ddd01bc5d92e15a1f783cdc3f7d8f642124\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3ecbc6560d7cb2e5396471349d24b95ff664f3b33dfc188e590c2b772721287c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"2e058e1b6b4635806a5e2b8fb08fed6fd11db7595be6907f89a86777a30aa9b5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f27c742360d050f8cfba473367fd8076f0a6abdf57b30c6116d8b1fa7559bcc0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"b7571ee2e0ac1a2c804f33ccb2108d7694841ff5c0b7595435bea59672db0c41\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"319a8bd03b55a51284dd6790058e026879ed8db3e6d527dedb4a9314473afa5b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"ac54aac970a6722b49c3410bffc6b58a3832c579aa7c3629ff80507ab769f2d3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8be72fdf7a1e6b1379ac7dc12f7c40286d882ef14376e9fd3e726b2fb781546c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"ac78bc480a068b655886c2d9dd75e3a680756398111216d2be7e8a3e730e4206\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"23d2f913b5bde1ed64144a38680e6282220982f4f5ea1167fabdda3234dbc67e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"c6c6e62fb02ec82dd2ad63c3690b3887e0701c293e1871ee382d92ea80f88f66\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"51e9e3c7450b52b22ca45c280738926226df3d95852d8df43ff47cf85cca9e5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-6fa533\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-6fa533\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"64fb7512cad2bf5a1c9b6978a7f9de714d5a739282aa9ca951ee3b4f417da286\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"dfa08453b9c8623db01e432dea4f9e09b3d7f80cbbee3a69df753c6d3fbfbded\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-6fa533\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-6fa533\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"af2b1c5e2c0a798508b2ef3249c778b1b43898c8636c878f66d20c220701a6f4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"517c7132d716e14e14b2c9fccd696f86bc7a24a46c391e71d07ac910d0dd1c18\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-6fa533\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-6fa533\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"ee9f66c18cbc8fcbae62d62e57dcbad633d943ff04a829fbc8bb030c121bf426\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b93afde66771848b5188f78e530f2f596324f9fb9f05b2dd8f1cb49489f2bda1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-6fa533\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-6fa533\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"c514ea15546ae0041f8d77a7e65bd51a98d808edee2739e914353f03c270d86d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"de3ca7c8a9dcdebe0c2a67b74b3bc72bdc4a8f34aff1f0c69df675fbb03b1e05\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-6fa533\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-6fa533\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"985f90a1588b57b9e2061e7440127c4729ab98e674bb91d1e90364de9aea35ad\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"edbbdcfc920b88151941be1a4c41ad8be6a38bd6beddae7387db202bc3e9b302\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"15153104d9c89c44b59d96d9d8825fe62d21af5bd4db90b6c300fa53823a0ef0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bf3fa706be871596c50143869f253e98ce7aa463d723d2f419d378a041dbfbe5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"4e925c4610a758f575689b807fc7a61cef2c3891e2cf0a1c1074186e65a2e8fd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/premium-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f09ce0bd9bc651317469310c8a604d792e7c7c55751d184a920638cf66ba0dd5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"499fc57e7a454d5bcd94feeb06b43584bb9133eb048e9ee5f20041a16d87ebaa\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bc33498b2dcdc2f8d2612aa17c0e640458a4442c9d7f2ad45303aeb15b5bccb9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"7ad42a3389048956d61fafc75400a2a68540cd2e35da26f1e7b80db45868f7dd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-2-w2-6fa533')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-worker-w2-6fa533"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-worker-w2-6fa533\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:28:06.590Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route#v1-model-routing"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"b565990bc269af90f4e0533dedaf97fc37dc70b037af910a7605358eda2713f5","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["b565990bc269af90f4e0533dedaf97fc37dc70b037af910a7605358eda2713f5"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"b565990bc269af90f4e0533dedaf97fc37dc70b037af910a7605358eda2713f5\" already exists"}
{"level":"error","ts":"2026-11-02T21:28:06.659Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route#v1-responses-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"b3a9fbda204f0b6bfe85682d0fee9fd7a9712977e22af554d2d82ba07f1a075a","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["b3a9fbda204f0b6bfe85682d0fee9fd7a9712977e22af554d2d82ba07f1a075a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"b3a9fbda204f0b6bfe85682d0fee9fd7a9712977e22af554d2d82ba07f1a075a\" already exists"}
{"level":"error","ts":"2026-11-02T21:28:06.738Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route#v1-completions-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"d4fbd382871bb4f5406c37842f4848012cdca0b01e2d7698dc28e396dc18659d","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d4fbd382871bb4f5406c37842f4848012cdca0b01e2d7698dc28e396dc18659d"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"d4fbd382871bb4f5406c37842f4848012cdca0b01e2d7698dc28e396dc18659d\" already exists"}
{"level":"error","ts":"2026-11-02T21:28:06.807Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"8f577e4cdeda37406cbf43b607fe4ff7a6bd85c0d3b2c53a45b82a9207f437f9","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["8f577e4cdeda37406cbf43b607fe4ff7a6bd85c0d3b2c53a45b82a9207f437f9"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"8f577e4cdeda37406cbf43b607fe4ff7a6bd85c0d3b2c53a45b82a9207f437f9\" already exists"}
{"level":"error","ts":"2026-11-02T21:28:06.876Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route#v1-catch-all-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"f27c742360d050f8cfba473367fd8076f0a6abdf57b30c6116d8b1fa7559bcc0","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f27c742360d050f8cfba473367fd8076f0a6abdf57b30c6116d8b1fa7559bcc0"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"f27c742360d050f8cfba473367fd8076f0a6abdf57b30c6116d8b1fa7559bcc0\" already exists"}
{"level":"error","ts":"2026-11-02T21:28:06.943Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route#v1-chat-completions-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"313f15eb64d50822c9c91871179d7a6ffa3111f658f213fdc0612575f480add7","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["313f15eb64d50822c9c91871179d7a6ffa3111f658f213fdc0612575f480add7"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"313f15eb64d50822c9c91871179d7a6ffa3111f658f213fdc0612575f480add7\" already exists"}
{"level":"error","ts":"2026-11-02T21:28:06.985Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-worker-w4-d6cb38","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T21:21:30Z","generation":8,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"36c0d6c0-4ad3-4739-8e18-24485ab1bc48\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:26:45Z"}],"name":"kuadrant-e2e-worker-w4-d6cb38","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-worker-w4-d6cb38","uid":"36c0d6c0-4ad3-4739-8e18-24485ab1bc48"}],"resourceVersion":"34995","uid":"2255fc2d-ab48-428d-86a8-4726b25b244c"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7f9f489fba4cc345dba07951f043d704ea999478c1da34cd23037357dcdf1384\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"f61d2b7d2f64f1d64a2dcee70f47ce24c9c6eb4854589984128561c58f6171ac\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"12f3d170c629c434ef1558f623819a2294b75940427c1164b50933cdad3fb52f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"4d6b2e7d73dcdd0567dbe7811fffb6b677ae17a404dd4e000e5586417b4abff9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7f9f489fba4cc345dba07951f043d704ea999478c1da34cd23037357dcdf1384\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"5b984da304c827646ff112362de545fa451a799e7f6999eac00f25f038606c2a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"12f3d170c629c434ef1558f623819a2294b75940427c1164b50933cdad3fb52f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"ad40721e9bd95807ea332811f94d79eb07b9dd045127a232886a7924332cbc73\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7f9f489fba4cc345dba07951f043d704ea999478c1da34cd23037357dcdf1384\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"b91256531abbaaf08ed45e4a93b53e9af9ebb53002123196214bb374517e81f0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"12f3d170c629c434ef1558f623819a2294b75940427c1164b50933cdad3fb52f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"597cf592078ae14c96f33099e96fee363339bedb2f5d430fdd69e28e8be2a8ff\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7f9f489fba4cc345dba07951f043d704ea999478c1da34cd23037357dcdf1384\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"490344715bd8708a2d31131fc3b4e370beef7eb7d9942ba89fc82080284e6244\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"12f3d170c629c434ef1558f623819a2294b75940427c1164b50933cdad3fb52f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"aeb99e2df9a1951917065c7b887084431b3e62a6f4d47287af43193676a5b8be\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7f9f489fba4cc345dba07951f043d704ea999478c1da34cd23037357dcdf1384\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"fa28a7ae652b865919d1ff4c61fd33bb8512d3139af38d1ceb9697a99e63cc6b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"12f3d170c629c434ef1558f623819a2294b75940427c1164b50933cdad3fb52f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"601d68ffdf7137fde779cf41214f1c74f63e6b717be0b7aad1eb56041a2d9b76\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7f9f489fba4cc345dba07951f043d704ea999478c1da34cd23037357dcdf1384\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"2dea78ba3797dedd7edd7b687182785345cfd95029e2131769c5797e3b752eb5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7f9f489fba4cc345dba07951f043d704ea999478c1da34cd23037357dcdf1384\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"cdb3a0c564011d63952f137daa521c84f02a66f8a75696ef9ac4f1f2cc9ea8c9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"12f3d170c629c434ef1558f623819a2294b75940427c1164b50933cdad3fb52f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"e019089f573a8879defa7fdce139828725d9f042c5a4dc9974b9185a8a382c51\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"12f3d170c629c434ef1558f623819a2294b75940427c1164b50933cdad3fb52f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"6a08c6dd0c7522c09a18466dfa733eb68e8c593cdc8d2890ccff2f5c9064fcc0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7f9f489fba4cc345dba07951f043d704ea999478c1da34cd23037357dcdf1384\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"31c0c96d54839068517aaeb062676423451143447943cafff7ee595d9fd1feca\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"12f3d170c629c434ef1558f623819a2294b75940427c1164b50933cdad3fb52f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"aebde4a102828558eb0fbde9709268d7adabc75fadf451c730e0573c086e2f07\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a69bb45bad035c53dd8c7176828b1cc26d0c9d3f775d2059034b1639ca1b49d8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"79db77eb448edf55b65761a293f7f6fc07c9d4365912f7a8595364cdbf33d994\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e5e9b9fa41efe7f56f3ea6e9079d12a9f3e89cd596105815b30b04ba7ba1281b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"9b7cb9a28ed2fc7fdfa23c7d8d869cc573e3e72423805bef3f945a77d2785710\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"dff7a596e1042978304d40238abe84063cc499f4a6a2f9def85e7c84d1df1ebc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"4ebe0e741886c221cfcd8d1126bcb3535dcbe15c7f802a713d3b2ceb8cee37e1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4db1dd6250896b02d5f97b90471902db72d349ea082f211b7b5e4046c827d477\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"9e4cdffa79635674b661188290cd9c853017f5721accaa1f268edc6c6b7f2590\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8ea982efbe7afcd4f8dbaa4e864584b38ec852971d686ed11c87e99f1b9f4f9a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"1ed83021e2408187ee74cd1a66732d37b92c80d46439951ce5e0f654f1542381\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7d8b4229a4e8df0df0b627da5317c526c045e2ab5837161d638a7835193820d5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"36ee8c63f509519eef9ec6e2c257745b647d322586f8289611274ca06f90ec11\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2c4b4abb753457c4ad4bd5815f6ce55723fcfcf44f298a47923e03e51d023a49\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"3ce9856de6f3b95cc2ed4fe4abeef13ecb59b5b1ef0102b858e5d3ec0d8afa89\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7fdbd59414185d321c56439c757d9c725c67465b49a83a52b935fdd9c5f0df82\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"2eb3ad4b5e4be8080b2e0309815371172455a7e5f61cf9c3c595f17e99e6f681\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bb82cce53996fd9a50a4f33832b37ff599d227ab91d54895bf0ab989d1eb0b01\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"138b7da9a4ea2091f7b13106ba292672e2ca1d22138b32de717b07cab221eebc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7ebdbd5a6be861834fc366408f369ad8f021dfe8f061cbc93334bc801f3df98f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"be4080fc1058816edd779c6c2b40a1657320a89a6a86b4ff7358026a6adb2e23\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a6e80d640d49da44f2b60f9db62279137aa6839ed5acbca6493b96977b1f3f9b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"b470ad22bfeca185d9d86c6a107cdea6e62f1aaf494ef31244de0d30052bbcfc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b1fdba63ead328fd43c505e06394bc2adb7e5e2dfb0a1e55ef2c41d8f345142f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"30a1d05fede91486be251352bb7291a36ac69d50b6fce18433612afe29f1b4b1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f2655bcd7b6a7d3d8a4479c1c943c5f2b4d4fbb7d96408fc7ce07c4e7bd9f30c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"12835533e58f43762872e20b92b523339a9de435dc7d0f689b42133b367fae44\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"309f6b916a61539853033efc6ca2e083c01c99e5b96f857a7c78b89f9816f598\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"788f4c0f9a4e5a97247c2043b8125cf170fe6674c40d873723dc972c4d5d93af\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9a1afd5e20de63bb2c85d93c9c3fd7aae15a0f45cb6e07dc467b8063b97decee\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"4c928eaa593596b5c3719a02958892d193943b2129a32e43035c896d93b232c1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4b5d6544ef7fd39f49a5af0551f4a404b0a5f49df3054a95306b7f797216c599\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"8773bca7122a801a4f199775b03693ad30e316ffebea5bcaf72af079bf14f24d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3474cd3af51b646106406cc4778f6a5608fdc62b1fd92f27ccbcf8ab285bc05c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"f0bc235629f48b82dcaad76bce5cdb80abfa82763d9ad220a11c3e27d70223d5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c34c962f04362894a54cdf652c523865dbd1633f051244729b008181d474e55\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"2c3bfc8693c69427d3231717a8df2d14aba0f1fb87d9fd82bb191f0ebb31c308\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e12ef81cd87aec42f5b2528c46a9aeefe6b1bca82398f07b17a52a4bf6e91945\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"bd1615998be1912965bb2d26173bc1bd1e2565f8996f1f21fc476ccff3b1ad05\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a6fa5c95daf46871f07bc4e3ef7985a19659c040a1ef2a7baccccaa90e241705\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"3a34ac7af354fbf7d29872077cc2e557a29218e220d9e4e79e21710f2084e770\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"16cb85f469e7c5716866312b8b4cc95d7bd4782b54923c1571be2b995ef85c30\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"a65b58c28d5a781726a832c59d62e640ea9d347c008d6795a6bc79865414532f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3aa68add648f18fb79f3def0d73f0c2f29d8ab60b1352cf4548a1a038cf3d923\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"fad9cba453f811618739c6f08a8544a889f48ec7511f7d3ccac0f71ba988967b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"099191e40682a5a6b1df435c6dc10936b8b4e31a891f3520e8e9f8418b1acc3e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"adbf9660bf8db4b1489d019993fddbd2863d0cf7c72174df8663c00e565a1e21\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"13694f4cecc05b3e953bb7d1aa68f96fad9b8548456e1357cc504ba9936493bf\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"fd3f6d135cf69e39efa3702af6a7e665f47a40ddb90f71d1f37cad11438027bc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"db8ed9490207e877020d08d86f8a9769046fd69225998abd4e476e93ef7b9431\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"e3ae0784ebe4c51499f320023e5e93f640f2a33ae4fea237cb7e068df1c76739\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"12dec0ddb151cc18ef75cfe2b4260788095e28a391f359fc3f7da7c75381b728\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"8f6398fb66bae44affa747ad532a12445774a5b43ca2c7196a633d5d03da8c80\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"735d43fce555e32c36cd137abc0678ce944fbfe58a677497d16ab8d9ab37074f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"1016de6b3250a59509e3bc1de65ad0a68ae6faf776c4eaa853d86bce7dd96698\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9a442413f7e81c114c48c6bbdd04c0e3809cdcdf4def1f524f6d3adf70468027\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"785762b8cbcc7dd30b578476b081ad2df517e9e450947fa2591a488b59407126\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-worker-w4-d6cb38"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-worker-w4-d6cb38\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:28:07.012Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route#v1-responses-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"828fe179b1caaef8c4abb4ba71cbe53ab31fc04108a1194889605dd8100c90f1","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["828fe179b1caaef8c4abb4ba71cbe53ab31fc04108a1194889605dd8100c90f1"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"828fe179b1caaef8c4abb4ba71cbe53ab31fc04108a1194889605dd8100c90f1\" already exists"}
{"level":"error","ts":"2026-11-02T21:28:07.070Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/bd25d2afd9c786b5981205b98bae3db6e723aec2f20a927b7e833a2e0bac8c60","error":"authconfigs.authorino.kuadrant.io \"bd25d2afd9c786b5981205b98bae3db6e723aec2f20a927b7e833a2e0bac8c60\" not found"}
{"level":"error","ts":"2026-11-02T21:28:07.125Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/0ba957aff0ff0a4cb61ecb0f1c32719c450140b7899792c398706298d61bec49","error":"authconfigs.authorino.kuadrant.io \"0ba957aff0ff0a4cb61ecb0f1c32719c450140b7899792c398706298d61bec49\" not found"}
{"level":"error","ts":"2026-11-02T21:28:07.180Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/bc922184404ee148a21ce241c97a2ccb12aee72ef50012c5ce16c77c0b52fd37","error":"authconfigs.authorino.kuadrant.io \"bc922184404ee148a21ce241c97a2ccb12aee72ef50012c5ce16c77c0b52fd37\" not found"}
{"level":"error","ts":"2026-11-02T21:28:07.235Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/9dc5c3c6b653b81536ffdb2aeb92c595f353d8c2b956e78a0dc7be54d9b9bcc0","error":"authconfigs.authorino.kuadrant.io \"9dc5c3c6b653b81536ffdb2aeb92c595f353d8c2b956e78a0dc7be54d9b9bcc0\" not found"}
{"level":"error","ts":"2026-11-02T21:28:07.290Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/8060bf3fd40726da919699608d3cfae2e75c9ee177c91100a89514410e7d1458","error":"authconfigs.authorino.kuadrant.io \"8060bf3fd40726da919699608d3cfae2e75c9ee177c91100a89514410e7d1458\" not found"}
{"level":"error","ts":"2026-11-02T21:28:07.345Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/e6e0130bddf4c6eb5ef3b791364bf6c36f3d11363b6a9a79ea626214a148efd7","error":"authconfigs.authorino.kuadrant.io \"e6e0130bddf4c6eb5ef3b791364bf6c36f3d11363b6a9a79ea626214a148efd7\" not found"}
{"level":"error","ts":"2026-11-02T21:28:07.400Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/decd3da4c01813aad7b20f941fc8db4c361a5ae944965f7f204b4667cfc3b67f","error":"authconfigs.authorino.kuadrant.io \"decd3da4c01813aad7b20f941fc8db4c361a5ae944965f7f204b4667cfc3b67f\" not found"}
{"level":"error","ts":"2026-11-02T21:28:07.455Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/afad78a84f7065860afbdba46c6a63b40d724d1b9ab8d52752f53b815386ea50","error":"authconfigs.authorino.kuadrant.io \"afad78a84f7065860afbdba46c6a63b40d724d1b9ab8d52752f53b815386ea50\" not found"}
{"level":"error","ts":"2026-11-02T21:28:07.509Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/86ad7c7e6dbc840bdea5534b45691318d15c6ce0337b47f348909beac33bb9a4","error":"authconfigs.authorino.kuadrant.io \"86ad7c7e6dbc840bdea5534b45691318d15c6ce0337b47f348909beac33bb9a4\" not found"}
{"level":"error","ts":"2026-11-02T21:28:07.565Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/eadb6a7d6f02867d748c9df2b385bc6f0ef64b12f4a78bc2ec405a0b74c1e489","error":"authconfigs.authorino.kuadrant.io \"eadb6a7d6f02867d748c9df2b385bc6f0ef64b12f4a78bc2ec405a0b74c1e489\" not found"}
{"level":"error","ts":"2026-11-02T21:28:07.621Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/aa4cdf1fd2108500b02394e8b26e800679a875068d8913ad4d968dc008d373fb","error":"authconfigs.authorino.kuadrant.io \"aa4cdf1fd2108500b02394e8b26e800679a875068d8913ad4d968dc008d373fb\" not found"}
{"level":"error","ts":"2026-11-02T21:28:07.675Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/e0544a5ed9d09675f4d41df91cb7222206c434c3b765059d4fd0b1fba1e7f990","error":"authconfigs.authorino.kuadrant.io \"e0544a5ed9d09675f4d41df91cb7222206c434c3b765059d4fd0b1fba1e7f990\" not found"}
{"level":"error","ts":"2026-11-02T21:28:07.731Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/418ebb8af9ea13fbd983ac6a66465cfdb429cdcd44fff013139b557fa140580d","error":"authconfigs.authorino.kuadrant.io \"418ebb8af9ea13fbd983ac6a66465cfdb429cdcd44fff013139b557fa140580d\" not found"}
{"level":"error","ts":"2026-11-02T21:28:07.786Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/d1f6ef05b7178d05a0f291462a07f64061a3744c43a38cda317da12ec42593d2","error":"authconfigs.authorino.kuadrant.io \"d1f6ef05b7178d05a0f291462a07f64061a3744c43a38cda317da12ec42593d2\" not found"}
{"level":"error","ts":"2026-11-02T21:28:07.841Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/cc96dbf4ea257d73d60712e8c847f61b4e4ddfd52e42ff7b0ed78bab89f419ef","error":"authconfigs.authorino.kuadrant.io \"cc96dbf4ea257d73d60712e8c847f61b4e4ddfd52e42ff7b0ed78bab89f419ef\" not found"}
{"level":"error","ts":"2026-11-02T21:28:07.896Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/7b072f859283c6eb5c61bf4ba487bbafc01f8c48582280db598457737341dd11","error":"authconfigs.authorino.kuadrant.io \"7b072f859283c6eb5c61bf4ba487bbafc01f8c48582280db598457737341dd11\" not found"}
{"level":"error","ts":"2026-11-02T21:28:07.951Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/2a787a4ad1373a3e209fa1c9cccc9fdc70b28bc84c085432c148210833c3f17e","error":"authconfigs.authorino.kuadrant.io \"2a787a4ad1373a3e209fa1c9cccc9fdc70b28bc84c085432c148210833c3f17e\" not found"}
{"level":"error","ts":"2026-11-02T21:28:08.005Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/0b34ea4a2ed4e51285726eeb6c0d2255098ff7a0227e3ae2fe7d40f1a6fb02c2","error":"authconfigs.authorino.kuadrant.io \"0b34ea4a2ed4e51285726eeb6c0d2255098ff7a0227e3ae2fe7d40f1a6fb02c2\" not found"}
{"level":"error","ts":"2026-11-02T21:28:08.060Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/ffa07e9cc2abd888cc63b1c0d37ff1eb4f3efbfe8d6d554814630b4c04819355","error":"authconfigs.authorino.kuadrant.io \"ffa07e9cc2abd888cc63b1c0d37ff1eb4f3efbfe8d6d554814630b4c04819355\" not found"}
{"level":"error","ts":"2026-11-02T21:28:08.115Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/c4529da130989574bcdb533c1e0e24362f26d9f197cbf7df610ae03a1fbce4e7","error":"authconfigs.authorino.kuadrant.io \"c4529da130989574bcdb533c1e0e24362f26d9f197cbf7df610ae03a1fbce4e7\" not found"}
{"level":"error","ts":"2026-11-02T21:28:08.170Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/e60f7badc46aec1644cd0060173958f8fcd6e909d6fee036d0d9ee2d7df7422a","error":"authconfigs.authorino.kuadrant.io \"e60f7badc46aec1644cd0060173958f8fcd6e909d6fee036d0d9ee2d7df7422a\" not found"}
{"level":"error","ts":"2026-11-02T21:28:08.227Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/6c93211933d113e61eca474cd3f8bf9988cddebeafb9c91e5909f07aa2694136","error":"authconfigs.authorino.kuadrant.io \"6c93211933d113e61eca474cd3f8bf9988cddebeafb9c91e5909f07aa2694136\" not found"}
{"level":"error","ts":"2026-11-02T21:28:08.282Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/83bb1b97e9aadc07db3743a6651672685e34c290135dc942fa72f478a66e5fa8","error":"authconfigs.authorino.kuadrant.io \"83bb1b97e9aadc07db3743a6651672685e34c290135dc942fa72f478a66e5fa8\" not found"}
{"level":"error","ts":"2026-11-02T21:28:08.337Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/3b1cb178e85b8fd11320d8564777fc71ad557e2b9fe91e462914dbc3976f6a7b","error":"authconfigs.authorino.kuadrant.io \"3b1cb178e85b8fd11320d8564777fc71ad557e2b9fe91e462914dbc3976f6a7b\" not found"}
{"level":"error","ts":"2026-11-02T21:28:08.406Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-worker-w2-6fa533-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-worker-w2-6fa533-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:28:08.726Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-worker-w0-0c9014-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-worker-w0-0c9014-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:28:09.527Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:28:09.527Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T21:28:09.625Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"distinct-2-w2-6fa533-kserve-route","namespace":"e2e-models-e2e-worker-w2-6fa533","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"distinct-2-w2-6fa533-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:28:10.039Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"data-science-gateway","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"data-science-gateway\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:28:15.650Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["EnvoyFilter","AuthConfig","ConfigMap","Gateway","AuthPolicy","Limitador","HTTPRoute","TokenRateLimitPolicy"],"eventTypes":{"create":14,"delete":24,"update":8}}
{"level":"info","ts":"2026-11-02T21:28:15.781Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:28:16.666Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:28:16.736Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:28:16.736Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:28:18.664Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:28:18.668Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:28:18.668Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:28:18.723Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:28:18.723Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:28:18.728Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:28:18.857Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T21:28:19.939Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-distinct-2-w1-5f765a","namespace":"e2e-models-e2e-worker-w1-5f765a","uid":"0c2c3e70-b48e-4e6d-9275-24235f2a27c6","error":"tokenratelimitpolicies.kuadrant.io \"maas-trlp-distinct-2-w1-5f765a\" not found"}
{"level":"error","ts":"2026-11-02T21:28:20.888Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-distinct-w1-5f765a","namespace":"e2e-models-e2e-worker-w1-5f765a","uid":"b6a649c9-c799-41da-b033-6f90d8159ad7","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-distinct-w1-5f765a\": StorageError: invalid object, Code: 4, Key: /kubernetes.io/kuadrant.io/tokenratelimitpolicies/e2e-models-e2e-worker-w1-5f765a/maas-trlp-distinct-w1-5f765a, ResourceVersion: 0, AdditionalErrorMsg: Precondition failed: UID in precondition: b6a649c9-c799-41da-b033-6f90d8159ad7, UID in object meta: 99bd7ac4-c4c8-4760-9c06-cdc422b9bf4b"}
{"level":"info","ts":"2026-11-02T21:28:21.067Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:28:21.067Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T21:28:21.199Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"data-science-gateway","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"data-science-gateway\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:28:30.155Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["HTTPRoute","EnvoyFilter","TokenRateLimitPolicy","AuthPolicy","Gateway","Limitador","ConfigMap"],"eventTypes":{"create":2,"delete":2,"update":7}}
{"level":"info","ts":"2026-11-02T21:28:30.337Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:28:31.424Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:28:31.543Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:28:31.543Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:28:33.257Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:28:33.262Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:28:33.262Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:28:33.272Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:28:33.273Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:28:33.277Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-02T21:28:33.277Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T21:28:35.720Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-distinct-w1-5f765a","namespace":"e2e-models-e2e-worker-w1-5f765a","uid":"99bd7ac4-c4c8-4760-9c06-cdc422b9bf4b","error":"tokenratelimitpolicies.kuadrant.io \"maas-trlp-distinct-w1-5f765a\" not found"}
{"level":"info","ts":"2026-11-02T21:28:35.908Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:28:35.908Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T21:28:36.340Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"data-science-gateway","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"data-science-gateway\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:28:36.663Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy"],"eventTypes":{"update":1}}
{"level":"info","ts":"2026-11-02T21:28:39.337Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:28:39.342Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-02T21:28:39.342Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:28:39.345Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:28:39.345Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-02T21:28:39.846Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-worker-w2-6fa533","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T21:21:58Z","generation":8,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"350cbfc3-ae8f-47d8-bf88-3bc797a06de4\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:27:59Z"}],"name":"kuadrant-e2e-worker-w2-6fa533","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-worker-w2-6fa533","uid":"350cbfc3-ae8f-47d8-bf88-3bc797a06de4"}],"resourceVersion":"36577","uid":"e9c29fe8-1b7a-4730-9bc2-e4f3e80147bd"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2538346ffaabe171687c406d12f294530661f7690a04d14ab2327034447b1886\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" || auth.identity.selected_subscription_id == \\\"7b2e48c7269b0586\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" || auth.identity.selected_subscription_id == \\\"7b2e48c7269b0586\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"fc3c7a9daa18c716699d2f1fa233a5848a5d36cd60feee59a35bb57159d77252\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"df8548d2a100989756489c2811783626f3836ef18d08ba8c81bfb6b9e9ef9c28\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"983a86a79f65831a149f35f3c7673bbfb37560154023198d82ebb8965ed48c8e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/premium-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"13cb74b6bdfe9b2af39effc13c9d5ade5172cb10a5930c6aefbe733c0ab0cad4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"462645ad06b45e6f5c9824c64f8ebc4010534cdeadc425c4ab2c9b0594a88a7d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b565990bc269af90f4e0533dedaf97fc37dc70b037af910a7605358eda2713f5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"b369d9c3b4e9e1fbdb75c9e353f7e25f066823d31fb733c322ac2192463d58e1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-2-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2538346ffaabe171687c406d12f294530661f7690a04d14ab2327034447b1886\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" || auth.identity.selected_subscription_id == \\\"7b2e48c7269b0586\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" || auth.identity.selected_subscription_id == \\\"7b2e48c7269b0586\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"53b8e179280ac5286bf38489ea72372b11c85a8c387359bf689ebecff1663d36\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"df8548d2a100989756489c2811783626f3836ef18d08ba8c81bfb6b9e9ef9c28\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"c166f75566a6849f94f19ff1eaf52bbfeb65e132db0ce99439215a5fba3cf50f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/premium-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"13cb74b6bdfe9b2af39effc13c9d5ade5172cb10a5930c6aefbe733c0ab0cad4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"2eb901a322f6f85745b1b216f71a9aeaf7eef69af5cc7ad9aead13448f127634\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b565990bc269af90f4e0533dedaf97fc37dc70b037af910a7605358eda2713f5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"fae945183d4744cfc72f99d3814545646a9a87e750465f9b67476229ff21e62f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-2-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2538346ffaabe171687c406d12f294530661f7690a04d14ab2327034447b1886\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" || auth.identity.selected_subscription_id == \\\"7b2e48c7269b0586\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" || auth.identity.selected_subscription_id == \\\"7b2e48c7269b0586\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"89b4eca3220447cd92c83c9c71f9e61e645c1f746a07d9b87eac9b2d4af27f2a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"df8548d2a100989756489c2811783626f3836ef18d08ba8c81bfb6b9e9ef9c28\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"82b649105e404b52dbe59777c528effe8ddcaf390c919bc52a045d6654c17d27\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/premium-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"13cb74b6bdfe9b2af39effc13c9d5ade5172cb10a5930c6aefbe733c0ab0cad4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"0491f04b3838b4a997ad42c2f3b87b5bc525f5236ef6a51647a0af61e52bf52d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b565990bc269af90f4e0533dedaf97fc37dc70b037af910a7605358eda2713f5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"e160eef909b8d94a314732c333511d40579117e325a0f92347c702a5ee49c702\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-2-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2538346ffaabe171687c406d12f294530661f7690a04d14ab2327034447b1886\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" || auth.identity.selected_subscription_id == \\\"7b2e48c7269b0586\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" || auth.identity.selected_subscription_id == \\\"7b2e48c7269b0586\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"0f54f971c3b78f7352580f77fc5be3e00c2117ef445b417be77bf67ea75539a5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"df8548d2a100989756489c2811783626f3836ef18d08ba8c81bfb6b9e9ef9c28\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"616030c276c95a5326d811265a5516c30019307d032046e4dbf9c60aed89bb9f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/premium-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"13cb74b6bdfe9b2af39effc13c9d5ade5172cb10a5930c6aefbe733c0ab0cad4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"60974e3173a2c5fa225357d66a1c4055fbb2b76b845de70e5504acc58902d471\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b565990bc269af90f4e0533dedaf97fc37dc70b037af910a7605358eda2713f5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"18b6544f1fecef176364e89f35a905f48ff233680f0d7e6adfd1caf2b5f57048\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-2-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2538346ffaabe171687c406d12f294530661f7690a04d14ab2327034447b1886\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" || auth.identity.selected_subscription_id == \\\"7b2e48c7269b0586\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" || auth.identity.selected_subscription_id == \\\"7b2e48c7269b0586\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"6982a3a190cf8786b034f1d39a14b07dab2e5311ed66344e600b389726798c72\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"df8548d2a100989756489c2811783626f3836ef18d08ba8c81bfb6b9e9ef9c28\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"d8b01a7d8bf17be310055802641797f595c1e7290b01b91e2b87cf0300418b94\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/premium-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"13cb74b6bdfe9b2af39effc13c9d5ade5172cb10a5930c6aefbe733c0ab0cad4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"28c14a49b36fb1c2749324536c3bd478da8cea176c30e855a8c62d376476a248\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b565990bc269af90f4e0533dedaf97fc37dc70b037af910a7605358eda2713f5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"d42afd956ea2d4dcd0f0aaadc1669934e404dadfe3651ba4498df28db6f58683\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-2-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2538346ffaabe171687c406d12f294530661f7690a04d14ab2327034447b1886\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" || auth.identity.selected_subscription_id == \\\"7b2e48c7269b0586\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" || auth.identity.selected_subscription_id == \\\"7b2e48c7269b0586\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"87456404dc6fbf2160a52ba615889680b0c5cf40dc6100bb0e888288606dff25\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2538346ffaabe171687c406d12f294530661f7690a04d14ab2327034447b1886\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" || auth.identity.selected_subscription_id == \\\"7b2e48c7269b0586\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" || auth.identity.selected_subscription_id == \\\"7b2e48c7269b0586\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"8b9c2ea6de06bba9ed1ba2a65e99d1500ef45630a372914ecf445da73d74600a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"df8548d2a100989756489c2811783626f3836ef18d08ba8c81bfb6b9e9ef9c28\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"9222b1bebeb91f5bc797ef6f55e59f628b5f90c3da7305c7a50abb490cf18e24\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/premium-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"df8548d2a100989756489c2811783626f3836ef18d08ba8c81bfb6b9e9ef9c28\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"63ba67de9ead24d6aab10a349447139ea4c7227426ee6072b8939e91ccf0ed30\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/premium-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"13cb74b6bdfe9b2af39effc13c9d5ade5172cb10a5930c6aefbe733c0ab0cad4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"b23898184efef7f96fc649e5d2902d9e6f7d32805be8858eb5f57e88696a09d3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"13cb74b6bdfe9b2af39effc13c9d5ade5172cb10a5930c6aefbe733c0ab0cad4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"652be1bab4f56953c3da93778aeff670b21e92a5d993934466d89aaed158b5b6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b565990bc269af90f4e0533dedaf97fc37dc70b037af910a7605358eda2713f5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"e11de01e8f11e362fe12a9bcc574088487751f93b5de75b1bd8c99739acc40b0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-2-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b565990bc269af90f4e0533dedaf97fc37dc70b037af910a7605358eda2713f5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"4672868f1e2492bd2ac79be6374bbac36317364afff96ce0c9c7ac3d568f0b14\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-2-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2538346ffaabe171687c406d12f294530661f7690a04d14ab2327034447b1886\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" || auth.identity.selected_subscription_id == \\\"7b2e48c7269b0586\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" || auth.identity.selected_subscription_id == \\\"7b2e48c7269b0586\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"d58c446a6a9364595eaae0256bc0befa6f57ed0387674ac1d6970632cb6b41f0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"df8548d2a100989756489c2811783626f3836ef18d08ba8c81bfb6b9e9ef9c28\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"6e120ade3c6d3506708dea5d54e9bc2fd6306ec4718a0c11f9c0a89c0ea6f1cd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/premium-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"13cb74b6bdfe9b2af39effc13c9d5ade5172cb10a5930c6aefbe733c0ab0cad4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"f9f60e3c0c3c06fefd218a3662bf2dac472c1d5acfd112579332b16c2386f504\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b565990bc269af90f4e0533dedaf97fc37dc70b037af910a7605358eda2713f5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"6f55ce1a1c1254c42ba8a4204eaa5d732a42974a08d182b225b6ac98681f141a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-2-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"79e41416d85afbda9f192c421571f899a58b4937465fe640fd4d17dfb0d8240e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-6fa533\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-6fa533\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"af109b5290beff4991ef93d4a835ce24ed3b0986578fba7947a76ca1a6dd65e2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c17d6c6438d8754832a843b7a082fa7fc719ecd30696a3551f3ca815dd52f28b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"fcc5f235388ea2c13a59ae86bacfc4eb4fab79468e3ee8c91a602bb5eeeec1c9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-2-w2-6fa533/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8abe3e629bd34674437803d6e54a0cb90fe0d0df12d2eac23f0b40d2f4990b37\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" || auth.identity.selected_subscription_id == \\\"7b2e48c7269b0586\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" || auth.identity.selected_subscription_id == \\\"7b2e48c7269b0586\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"ccb67df939c7a3278e2bb82db8d5dc418650599ab46b4bd1d8fe07cf9bb459d0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"371e486415502802484cc345e68be13e0a37a1abb38f2f6c8cce9f8e79b8d9c1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"b41e21a5fb7ad8cd75dbaa2def82137084248aef58468ce3d04ebccec2987b3b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-w2-6fa533/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8f50bf1a21545f68eb583e07935b8b0da52bbc4743a8bc67c4d9545b76da56af\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"7206c2870629f698a99d45c9e7140cc1334b531b1ad5a3c88c147fac40e793b2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/premium-w2-6fa533/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d4fbd382871bb4f5406c37842f4848012cdca0b01e2d7698dc28e396dc18659d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"4924ec7c564baa67e51d989aa281cf4421dc82ba2910dd5cbc5e8ec66fd31e46\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-2-w2-6fa533/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"503064d3f84a23711f1dad5e35d11ef1efceaefb2204608d180ef8d886666ffa\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" || auth.identity.selected_subscription_id == \\\"7b2e48c7269b0586\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" || auth.identity.selected_subscription_id == \\\"7b2e48c7269b0586\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"1036f7f4f8b7c68faa7a499350cf496a96528b515b125a726c7e904d5297c1e6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e199374b1d053d8a1ea2fb463b47f0da1b100cb9029acd61282384f0bb2553a2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"fc0e1b2816287c18a95319a2d0a9379a9f7bf931fff586f75645e37973bc0009\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-w2-6fa533/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b3a9fbda204f0b6bfe85682d0fee9fd7a9712977e22af554d2d82ba07f1a075a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"e94cca1d60d77f1db698aae8d99dc62d60279b8e5de4556def17f51ea3d8b77b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-2-w2-6fa533/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"41e99bc62a2ac4e8034135f4b655088597f627c66b2efc4627394d148bc2b0ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" || auth.identity.selected_subscription_id == \\\"7b2e48c7269b0586\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" || auth.identity.selected_subscription_id == \\\"7b2e48c7269b0586\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"b2fa16adeef96749257d873656ef49327fe454d7ba806ae3a8a73ec44c8a092d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2f2531e01fa8fc0031706fadbba0c1818c30681dcf9d2c65b1c7c23230ea3a32\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"d04838d25723911d554e0017a035ebf67253923630681f27a1c93b44878b1bcc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/premium-w2-6fa533/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7be093b94c77d8e466548a812b2fd67ba6e4cdbef2e705474d1a124d26a40f56\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"89ba01e718f4b0e60188b8031e9bd1e3cf1d64712b57d397151cd36a5d6214df\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-2-w2-6fa533/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f1edf5f89fd287762fbbefa668581cdc8f1877a3f31497227c537000670166d9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" || auth.identity.selected_subscription_id == \\\"7b2e48c7269b0586\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" || auth.identity.selected_subscription_id == \\\"7b2e48c7269b0586\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"dbf8e642e7e029e70e317d8df7b5d12be0fc1f008d29ff415d7291c09924eecb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cf13f5a3da5f1ddbc441422b55ececcb0ffd227c7be1c942dc1d4c428387bca0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"0aa6387a836e4d80af5fd5a2d66846f1a40192a89e137f80c52334aa6d868a1c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-w2-6fa533/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"afe9746e0af749da011756561a859419e447efc535f5e3f3773b1d18a5b5a9ac\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"7ae7a5b24207da4f6cb3659a8b6639f53e96a876f02aaa1f0a8b92813f856ad7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/premium-w2-6fa533/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"739e19d51d8fbdeccfc8bc7587afd12132239f688ec6cf8d9586f242a71087f7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"5f4124bfb1cf4c49006c1e2d45346f89a11b72e563d9f8e2d4df054bb65c496c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-w2-6fa533/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8309dc44d5088e48040255bf86dbc622de08fc216837cd0027a69bdf179a9d2a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"206d678ecc5400943db26abb21afd48a2ffc6fee651aa73c8301a56858221aa0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/premium-w2-6fa533/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8f577e4cdeda37406cbf43b607fe4ff7a6bd85c0d3b2c53a45b82a9207f437f9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"7cdf48530943053e434f696a48871881d26809d6cd1a88e8b6daa617fd34d36f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-2-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"206e50a9b0e5f83281f994d9f1d85f92406e3544297c47017c081f763b10dd96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" || auth.identity.selected_subscription_id == \\\"7b2e48c7269b0586\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" || auth.identity.selected_subscription_id == \\\"7b2e48c7269b0586\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"1d9b68bda9fa73e5f8e8ac869771d602c5f128903fd22e64db2370f9749a3113\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6ed7710bfd4535612b60aefac40ff2eebbe50fc666cc75f29a23130bdd6ea269\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"1245658c93fce9ced820408e5e090ae4dd51a7c56161a6cfb1ef978beecc3557\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"313f15eb64d50822c9c91871179d7a6ffa3111f658f213fdc0612575f480add7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"eb5df92dd93dfd3d0bc54e95c455fd8d583232e993ed8aed3db80f624312b066\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"62457e23e29ce9b4e8380d685c5e9e84bc5137e91486a6f9c1c9e352ca3a021c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" || auth.identity.selected_subscription_id == \\\"7b2e48c7269b0586\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" || auth.identity.selected_subscription_id == \\\"7b2e48c7269b0586\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"957121ddf9ee4c2793cec71a8576e07ee1925a201f93c8de02b6fce446d010d8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1ce9b189744d237515a1896d038a3437e8e31669b01937d8cf3a067728ee7e82\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"672be8f3fbaf802659dc395e46e1b17c7ab1515e557eab74f4c7d2c055ad4cf7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/premium-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"881b63d46f0e94053b88caefbfd71fdab183199879cb564ccb3671b6189fcc2e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"4e3e10829c680ef4fa33002314a596e964d519ea2f3cd6331d666a22cfb597e5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0947683a63afc3251194a3b586cb934b1350dcaa171c4fd826d6773a00d5cf2a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"88202ce79ddf6dca9b8c8b1fbc0aa013155bc9975075ee9158a09c6708287af4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"66eb2a66302c20c8061f062df1542c7ad1db513c8b1988f81768f7d266f6665c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"64c175753cea5698cd255c8a903061deed215a3afcc403ae39f57d7b0f7600be\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fd7deaf8530c822c1b10ef4c1b0887086bc840af6d5c7a730508ddcb6e179095\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" || auth.identity.selected_subscription_id == \\\"7b2e48c7269b0586\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" || auth.identity.selected_subscription_id == \\\"7b2e48c7269b0586\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"14655ca6105b9121c6e780127a21626d2e779082f0ea2674b0d77647d247a24c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5ea067858e444716d33ddecbe718b086e12804ce72bba0a6f135b64fb1bb1c60\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"c88bc53da3544fc41175edc07ced29960aa58c4f7ebf17609eb30f993b862ccf\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"828fe179b1caaef8c4abb4ba71cbe53ab31fc04108a1194889605dd8100c90f1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"f249401e68d6dcd41e2325910ee9db0254c3afa92a19923e1751980966a4694d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"60ca770315801fd35b67ab23639ba4ac6a344fcf95fe492c267cc87cb90ce14f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" || auth.identity.selected_subscription_id == \\\"7b2e48c7269b0586\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" || auth.identity.selected_subscription_id == \\\"7b2e48c7269b0586\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"d7f0af7e7ca785bc5de89e740ff47459e16eb3ba9360c1eee59d6d8d2f7389bd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6d6f6c08f92b4cefaa6a997643ec612cf9c62df4fa750dd0f5d4c3d50d40d2bb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"daf823a39b0f169fe5f258178380bcf0b3e996152ebcc401fb21de178f041b24\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5cddd3e1918c7df14f710eb09cebc745d043be6f81e6c1e1f2a3803e2f0c6513\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"b1d5e4fa434bbb80c0f5baf3d8ee1797394841413a8f28625f4e0c9d2388764b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1f83c46a7c87c216ad3b7a3697a1ad6c518cb36972a910efbc3c7eed6ab3956a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" || auth.identity.selected_subscription_id == \\\"7b2e48c7269b0586\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" || auth.identity.selected_subscription_id == \\\"7b2e48c7269b0586\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"496ec6213c84428bc1374936695dcb9246c04c80a4460a92e53220e4641a7116\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e701c3e95fd6d7e3e60b9f162039289bbc904c42df899db9436b6ad7538d1ffc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"576f13852617450ef4f108d2d8c65426c74c6f743bd5e3d6530d746e72633fbc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"25cb748ea88f201b192c863c4e2fb40e5931cd9cfed0d04ae104e35dbe48f38b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"c49c039641c1cdbec2a8f5cc805b4b722943e1336d082080571a2f2fcb073186\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ad04b751b35d313ca76c5057f5e800aa0d5504bc27298aa1762dd803d351bff2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"a24ccfd407372af3bd4160c32a086ddd01bc5d92e15a1f783cdc3f7d8f642124\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3ecbc6560d7cb2e5396471349d24b95ff664f3b33dfc188e590c2b772721287c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"2e058e1b6b4635806a5e2b8fb08fed6fd11db7595be6907f89a86777a30aa9b5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f27c742360d050f8cfba473367fd8076f0a6abdf57b30c6116d8b1fa7559bcc0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"b7571ee2e0ac1a2c804f33ccb2108d7694841ff5c0b7595435bea59672db0c41\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"319a8bd03b55a51284dd6790058e026879ed8db3e6d527dedb4a9314473afa5b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" || auth.identity.selected_subscription_id == \\\"7b2e48c7269b0586\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" || auth.identity.selected_subscription_id == \\\"7b2e48c7269b0586\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"ac54aac970a6722b49c3410bffc6b58a3832c579aa7c3629ff80507ab769f2d3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8be72fdf7a1e6b1379ac7dc12f7c40286d882ef14376e9fd3e726b2fb781546c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"ac78bc480a068b655886c2d9dd75e3a680756398111216d2be7e8a3e730e4206\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"23d2f913b5bde1ed64144a38680e6282220982f4f5ea1167fabdda3234dbc67e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"c6c6e62fb02ec82dd2ad63c3690b3887e0701c293e1871ee382d92ea80f88f66\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"51e9e3c7450b52b22ca45c280738926226df3d95852d8df43ff47cf85cca9e5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-6fa533\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-6fa533\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"64fb7512cad2bf5a1c9b6978a7f9de714d5a739282aa9ca951ee3b4f417da286\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"dfa08453b9c8623db01e432dea4f9e09b3d7f80cbbee3a69df753c6d3fbfbded\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-6fa533\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-6fa533\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"af2b1c5e2c0a798508b2ef3249c778b1b43898c8636c878f66d20c220701a6f4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"517c7132d716e14e14b2c9fccd696f86bc7a24a46c391e71d07ac910d0dd1c18\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-6fa533\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-6fa533\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"ee9f66c18cbc8fcbae62d62e57dcbad633d943ff04a829fbc8bb030c121bf426\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b93afde66771848b5188f78e530f2f596324f9fb9f05b2dd8f1cb49489f2bda1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-6fa533\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-6fa533\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"c514ea15546ae0041f8d77a7e65bd51a98d808edee2739e914353f03c270d86d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"de3ca7c8a9dcdebe0c2a67b74b3bc72bdc4a8f34aff1f0c69df675fbb03b1e05\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-6fa533\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-6fa533\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"985f90a1588b57b9e2061e7440127c4729ab98e674bb91d1e90364de9aea35ad\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"edbbdcfc920b88151941be1a4c41ad8be6a38bd6beddae7387db202bc3e9b302\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" || auth.identity.selected_subscription_id == \\\"7b2e48c7269b0586\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" || auth.identity.selected_subscription_id == \\\"7b2e48c7269b0586\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"15153104d9c89c44b59d96d9d8825fe62d21af5bd4db90b6c300fa53823a0ef0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bf3fa706be871596c50143869f253e98ce7aa463d723d2f419d378a041dbfbe5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"4e925c4610a758f575689b807fc7a61cef2c3891e2cf0a1c1074186e65a2e8fd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/premium-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f09ce0bd9bc651317469310c8a604d792e7c7c55751d184a920638cf66ba0dd5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"499fc57e7a454d5bcd94feeb06b43584bb9133eb048e9ee5f20041a16d87ebaa\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bc33498b2dcdc2f8d2612aa17c0e640458a4442c9d7f2ad45303aeb15b5bccb9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"7ad42a3389048956d61fafc75400a2a68540cd2e35da26f1e7b80db45868f7dd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-2-w2-6fa533')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-worker-w2-6fa533"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-worker-w2-6fa533\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:28:40.224Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-worker-w1-5f765a","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T21:22:08Z","generation":7,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"4caf3c5b-8145-48de-a05b-6a1b9a102f00\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:28:19Z"}],"name":"kuadrant-e2e-worker-w1-5f765a","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-worker-w1-5f765a","uid":"4caf3c5b-8145-48de-a05b-6a1b9a102f00"}],"resourceVersion":"37005","uid":"fb3e4914-c809-4feb-81f5-a0a468b56725"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bcf0aab5299349f1dd1df89a10a558ad5617afdfb0f30d972811f3dbb51b1ea5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]}],\"name\":\"f2c753e74bbc5983406d967abd1143e62400e0f08a2e36f6ffa42c06a3a6974c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/simulator-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"db6f9ff18eeb49f1421400a53d101cb100b1a88466190b46fb6dbed22a42e073\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]}],\"name\":\"eedd7a1bac5c7747d7137dccbdafefbc4f76edb1acf806e0399e7d01c0c93443\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/premium-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0623abc228b11818faa4a08b26d906ef498cb9511f2bcee2bcd7c9e8dbb0a23a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__dc807a9d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d8a00acc0d636e51\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-distinct-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__dc807a9d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d8a00acc0d636e51\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-distinct-w1-5f765a\"]}],\"name\":\"0a44edd91442d2ddfe39cb24e50368dfc1e81bad179d3235d38e40f25e9d22ae\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"99ce90aab60d81af668145560f9879cd2b5941652fd3e18c3d45856709a0948e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__0c25be51\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"0eeedb6608ed0210\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-distinct-2-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__0c25be51\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"0eeedb6608ed0210\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-distinct-2-w1-5f765a\"]}],\"name\":\"91d7b5395adff9d28bf7ef05c8e81f9bd73a716e4072d28f8624ff5f9381a8fe\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-2-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bcf0aab5299349f1dd1df89a10a558ad5617afdfb0f30d972811f3dbb51b1ea5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]}],\"name\":\"76a34f19bf7079dd4104caff1731257297b843b61401a91d00b1a27ccab63fd7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/simulator-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"db6f9ff18eeb49f1421400a53d101cb100b1a88466190b46fb6dbed22a42e073\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]}],\"name\":\"263fa7af352a917ec5f565f1287ed3339005bf0c3ba787dcb8a5e539d84cfaff\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/premium-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0623abc228b11818faa4a08b26d906ef498cb9511f2bcee2bcd7c9e8dbb0a23a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__dc807a9d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d8a00acc0d636e51\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-distinct-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__dc807a9d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d8a00acc0d636e51\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-distinct-w1-5f765a\"]}],\"name\":\"e78483f4191a6de2a454384113672ed5dcab6ca23c10f3e5052c523e46b7a77c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"99ce90aab60d81af668145560f9879cd2b5941652fd3e18c3d45856709a0948e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__0c25be51\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"0eeedb6608ed0210\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-distinct-2-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__0c25be51\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"0eeedb6608ed0210\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-distinct-2-w1-5f765a\"]}],\"name\":\"601fd1e14b5e1e1044cd1ad2841f6c4703624cbd2a380dedacb373ba7867c1eb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-2-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bcf0aab5299349f1dd1df89a10a558ad5617afdfb0f30d972811f3dbb51b1ea5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]}],\"name\":\"3451d924df135b44fe4e7857db1417971e78cee0d322dc55f2d9dcfc1a98438c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/simulator-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"db6f9ff18eeb49f1421400a53d101cb100b1a88466190b46fb6dbed22a42e073\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]}],\"name\":\"c12741fd641c86bf88bbd47e58d2e5d62933e3e0f320cf13ec7d52df7a394c29\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/premium-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0623abc228b11818faa4a08b26d906ef498cb9511f2bcee2bcd7c9e8dbb0a23a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__dc807a9d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d8a00acc0d636e51\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-distinct-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__dc807a9d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d8a00acc0d636e51\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-distinct-w1-5f765a\"]}],\"name\":\"7d42ed92cf0df2b010ce6bb7fe8510b6b214aa6493d82bbe3bdd85788b9ced2d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"99ce90aab60d81af668145560f9879cd2b5941652fd3e18c3d45856709a0948e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__0c25be51\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"0eeedb6608ed0210\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-distinct-2-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__0c25be51\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"0eeedb6608ed0210\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-distinct-2-w1-5f765a\"]}],\"name\":\"89e9e9283f23750b835cfc41e1a3e8f29103f8fe9ceff7e9517fedfa07286e72\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-2-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bcf0aab5299349f1dd1df89a10a558ad5617afdfb0f30d972811f3dbb51b1ea5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]}],\"name\":\"70ba0b522bbd69a6ed9f77952d20b92d482b03854cc92dbb7d522bd33335c96d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/simulator-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"db6f9ff18eeb49f1421400a53d101cb100b1a88466190b46fb6dbed22a42e073\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]}],\"name\":\"65d2403634b5ea32b46b6ea0b85de94e33a3af4a2416095b99fbdb18350add91\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/premium-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0623abc228b11818faa4a08b26d906ef498cb9511f2bcee2bcd7c9e8dbb0a23a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__dc807a9d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d8a00acc0d636e51\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-distinct-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__dc807a9d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d8a00acc0d636e51\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-distinct-w1-5f765a\"]}],\"name\":\"f16ad623eef6c3389dd02c8e5699fc3224f733fcfdf7f5e04c94d15bb259d565\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"99ce90aab60d81af668145560f9879cd2b5941652fd3e18c3d45856709a0948e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__0c25be51\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"0eeedb6608ed0210\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-distinct-2-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__0c25be51\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"0eeedb6608ed0210\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-distinct-2-w1-5f765a\"]}],\"name\":\"31f5ec2b96aaa4e6b31984c22b75d9d621a704605d13ed2d59121449937c911d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-2-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bcf0aab5299349f1dd1df89a10a558ad5617afdfb0f30d972811f3dbb51b1ea5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]}],\"name\":\"ba40310e6c4dc6ab4a0b4c712eda89883762afc9beb70d4b7c23b27f69b9ab49\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/simulator-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"db6f9ff18eeb49f1421400a53d101cb100b1a88466190b46fb6dbed22a42e073\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]}],\"name\":\"bd657b2cf110d146eb81bf7b91f3184e0028cf98e5195ef2ddb8f508863741de\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/premium-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0623abc228b11818faa4a08b26d906ef498cb9511f2bcee2bcd7c9e8dbb0a23a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__dc807a9d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d8a00acc0d636e51\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-distinct-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__dc807a9d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d8a00acc0d636e51\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-distinct-w1-5f765a\"]}],\"name\":\"2f0dfd729a81441e924bd38747be17f316e3b9b9e9528ea0a39238207dd25e7f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"99ce90aab60d81af668145560f9879cd2b5941652fd3e18c3d45856709a0948e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__0c25be51\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"0eeedb6608ed0210\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-distinct-2-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__0c25be51\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"0eeedb6608ed0210\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-distinct-2-w1-5f765a\"]}],\"name\":\"d373660753c800ef6dc88aa9dcf376944988375525f3908104ef1f83260983ff\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-2-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bcf0aab5299349f1dd1df89a10a558ad5617afdfb0f30d972811f3dbb51b1ea5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]}],\"name\":\"d637ac7d402bcd26ac6f88370d996d05abc8c7982ed2c2cc4095675044806a8e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/simulator-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bcf0aab5299349f1dd1df89a10a558ad5617afdfb0f30d972811f3dbb51b1ea5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]}],\"name\":\"30abcde41a2149187abd00b7dbf1da4982d5f53b5da1288f5b95a0d579abbd6a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/simulator-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"db6f9ff18eeb49f1421400a53d101cb100b1a88466190b46fb6dbed22a42e073\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]}],\"name\":\"e253a93d7a1e997f4ec04774e63bac26b7573119884a469fa9cadfdd694f2c86\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/premium-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"db6f9ff18eeb49f1421400a53d101cb100b1a88466190b46fb6dbed22a42e073\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]}],\"name\":\"857e58268f515ca3e78ba5dd4b121c1c64a1556ffa6fb72ca451501f13fd956c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/premium-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0623abc228b11818faa4a08b26d906ef498cb9511f2bcee2bcd7c9e8dbb0a23a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__dc807a9d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d8a00acc0d636e51\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-distinct-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__dc807a9d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d8a00acc0d636e51\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-distinct-w1-5f765a\"]}],\"name\":\"d6e34b9866f1888f862664b06edada2fc5b06428a00da8529b16758a3eda81bd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0623abc228b11818faa4a08b26d906ef498cb9511f2bcee2bcd7c9e8dbb0a23a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__dc807a9d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d8a00acc0d636e51\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-distinct-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__dc807a9d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d8a00acc0d636e51\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-distinct-w1-5f765a\"]}],\"name\":\"d8a7afed6f125f1efe48eb9763d5f6da06382ed5c648453e53d16207a819a353\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"99ce90aab60d81af668145560f9879cd2b5941652fd3e18c3d45856709a0948e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__0c25be51\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"0eeedb6608ed0210\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-distinct-2-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__0c25be51\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"0eeedb6608ed0210\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-distinct-2-w1-5f765a\"]}],\"name\":\"4e6de9db11e4f53c670f806b7f8fa9eef7623d7a93fac0088e6bc4808c690024\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-2-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"99ce90aab60d81af668145560f9879cd2b5941652fd3e18c3d45856709a0948e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__0c25be51\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"0eeedb6608ed0210\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-distinct-2-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__0c25be51\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"0eeedb6608ed0210\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-distinct-2-w1-5f765a\"]}],\"name\":\"e4a3e27b6d899463b5db743e92f4f3eea337802f422e60f3725234174543f7ad\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-2-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bcf0aab5299349f1dd1df89a10a558ad5617afdfb0f30d972811f3dbb51b1ea5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]}],\"name\":\"c06ce02686be6c949fde11dd46005249ce969a6a4cd5979e062f2fd0e328306e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/simulator-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"db6f9ff18eeb49f1421400a53d101cb100b1a88466190b46fb6dbed22a42e073\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]}],\"name\":\"a5c2e2f330e8d4b7f1cc2fd43eb290bf161724714abfed900324fd2909e2a064\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/premium-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0623abc228b11818faa4a08b26d906ef498cb9511f2bcee2bcd7c9e8dbb0a23a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__dc807a9d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d8a00acc0d636e51\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-distinct-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__dc807a9d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d8a00acc0d636e51\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-distinct-w1-5f765a\"]}],\"name\":\"f32d2c346b05e35d553dca7fe2805eee4c7886686071be499c78e95d284e8bd5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"99ce90aab60d81af668145560f9879cd2b5941652fd3e18c3d45856709a0948e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__0c25be51\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"0eeedb6608ed0210\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-distinct-2-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__0c25be51\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"0eeedb6608ed0210\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-distinct-2-w1-5f765a\"]}],\"name\":\"6f1d479dd9b2c444c7bbd9d0b29aa4d86c30e494765ff79074f52d3018d29503\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-2-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fa1a008e4957943b0d2d9d600bd19dafc0caa0b522e5c1d1e09ecc5d82a64f4c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-5f765a\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-5f765a\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"b218feb88b60257514445a8b1d44e3ab1edb938de3bc6d6fdb02ef04222c6dcb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8614fe473acb7380c1bbcefbfc7ddc49bdb08a20998450fd852a13de53bb8a12\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__0c25be51\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"0eeedb6608ed0210\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-distinct-2-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__0c25be51\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"0eeedb6608ed0210\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-distinct-2-w1-5f765a\"]}],\"name\":\"5340f589ec7e8ec67c1190312eeca907b744df43dafe4398f0722d074bfb32b9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-2-w1-5f765a/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"58ba249888c7ebfedfcb5aec9df19d4b07d2856710ac2163dcc961a176311fa9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]}],\"name\":\"4d61c78710f351b5667f692e1f8792c5724b52f7fc998511134665312fdd896f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/simulator-w1-5f765a/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9fa5392cc7c0130bb8596420fcb1a79f07b3d804fb9e4de459f680cdcfd5dcfc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__dc807a9d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d8a00acc0d636e51\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-distinct-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__dc807a9d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d8a00acc0d636e51\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-distinct-w1-5f765a\"]}],\"name\":\"b1d7cdd38dbaf49bd08c0343391886f319979629ab66d478079771f78f733a35\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-w1-5f765a/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2aaf9242e876623422852fe471269a2d268f4d784b14c7ab37ec9f34c17f3060\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]}],\"name\":\"f201dec897e559ed36b9a30f0bbf86c43aae129e674ef36595083bda93e4b839\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/premium-w1-5f765a/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"36a5aec7d5b7178c754711c0ad90ec391fbc4764ff98bc952ff9d4d46a3e1fad\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__0c25be51\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"0eeedb6608ed0210\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-distinct-2-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__0c25be51\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"0eeedb6608ed0210\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-distinct-2-w1-5f765a\"]}],\"name\":\"e1ac9296595d90737d084f76147f4acec9440f2802b7b4ad18409fe9de33bb5e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-2-w1-5f765a/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c19827aa458f939a86c4dbefda3dabc4f554898dbb7e2f92b488060e9e90b5cc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]}],\"name\":\"6d546403540eabf244c73a602659986050165bca90bc795de701a61411a1c48e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/simulator-w1-5f765a/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"922492b3fb118d2a03b9019d5fd7a1e7fc6f7f5e4559c5e1a0ef89b6f41e6c00\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__dc807a9d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d8a00acc0d636e51\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-distinct-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__dc807a9d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d8a00acc0d636e51\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-distinct-w1-5f765a\"]}],\"name\":\"5cbb9e2f75cce25ddb3c2b6eb86ac94a59b3619ba9df40d1b5dd3580109ca3cc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-w1-5f765a/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"37f7dad0ca5234ce11642187ba11e681aa288a9b2a62a6d47b06de5fa5c385ed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__0c25be51\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"0eeedb6608ed0210\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-distinct-2-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__0c25be51\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"0eeedb6608ed0210\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-distinct-2-w1-5f765a\"]}],\"name\":\"ec08733aeb0db1141aa8a8a511c7859111cf54e374fddf2e382a4616e38a9f7d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-2-w1-5f765a/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"784ccec783ba11c98817fe5af2849f9f4970be19046e351a067c85add913f548\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]}],\"name\":\"9327d3b7df136b8c0fed4aaa35057ac8d1022305472875ccc8c55a524105fb1a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/simulator-w1-5f765a/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"beb0d5e916dc078abcaba4ea5b4d8012d5c2d8edfd07ca54d585bfe44d7c605a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]}],\"name\":\"8cff0046c214e842687a3a284fe4fabc8a45eb2579168ac47aa1b4908bd95fc4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/premium-w1-5f765a/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"39a9f89f974929e5c36b7ca16af0fe122642ef82605ca091ecae9f1aab1c8c39\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__0c25be51\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"0eeedb6608ed0210\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-distinct-2-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__0c25be51\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"0eeedb6608ed0210\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-distinct-2-w1-5f765a\"]}],\"name\":\"633ba07e8fd8d505f7f6918d4c95117ed7435ee10e97f4b5b67ea8fb88d406a9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-2-w1-5f765a/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5bc63b4c1a02d51f1462172790f7018aec7db9fb8a2a61024ca7c15aac9065b4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]}],\"name\":\"2bdf38e0b22608328672d2ed39e7a6336f89c14fb615a48fda4a36a65c185b32\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/simulator-w1-5f765a/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6ceeddb720a82c7a3a1051f6517a47c73f8528f97b9e67d8dd2f7dd9419967e1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__dc807a9d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d8a00acc0d636e51\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-distinct-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__dc807a9d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d8a00acc0d636e51\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-distinct-w1-5f765a\"]}],\"name\":\"73c4b3ba76c71b5ac2b369625b3de4081ddfaca2a924b7a8741f70090acba47b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-w1-5f765a/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b8fb7aae7cac121f592817a5e9754983e04e46d9e4226183153bf83b778fffdd\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]}],\"name\":\"b288a64704f96ac78878f6909232d8598eef54cca0d7adc2629cac87b6802414\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/premium-w1-5f765a/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8f0923ad4223ef053267784d904817130eaaaa279092e9f9f1500d0325c2e6a7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__dc807a9d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d8a00acc0d636e51\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-distinct-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__dc807a9d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d8a00acc0d636e51\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-distinct-w1-5f765a\"]}],\"name\":\"127ad269f06b6d28319f2bb527c4cb8c00c67080e95ba7a4c5aae51849cf6881\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-w1-5f765a/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9f6fc629fa43de74b0fb261de7e8b46fbdfe4f21235446879cd916210856d6f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]}],\"name\":\"3345e3b0c95bd559e9c6ce41f622270b0d9eed1deb3d862eb2d4fad368905626\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/premium-w1-5f765a/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4afb168c7cbb67555e268bc246b8eeeba53cda69691eb181663c1375ab099775\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__0c25be51\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"0eeedb6608ed0210\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-distinct-2-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__0c25be51\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"0eeedb6608ed0210\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-distinct-2-w1-5f765a\"]}],\"name\":\"c917df68cc69647c025db7eb577471c675040ae5aa7ec4537927ac6f148031ea\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-2-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"719394d8154dd624eedc306180a33baa4128531f223bc2727d0376601dd634f6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]}],\"name\":\"94c5946d9d9c3cc245ba073b8c7a87c64029cba185e4d624d2145ef119722e87\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/simulator-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6cbb9b4408bb48fa5c471c9684ef41f50ebbc4e85135af89ff2781ab48666f2a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__dc807a9d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d8a00acc0d636e51\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-distinct-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__dc807a9d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d8a00acc0d636e51\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-distinct-w1-5f765a\"]}],\"name\":\"7aaa0a43baf33eeaf52534a90f734bbc375ee8f202c1994adc991d076f599c57\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"796ce8085bd3851fe6a6d0c9b4c29504c70e44da1ae3ea663bfc85d308b1e5b1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__0c25be51\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"0eeedb6608ed0210\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-distinct-2-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__0c25be51\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"0eeedb6608ed0210\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-distinct-2-w1-5f765a\"]}],\"name\":\"d7eb7b84f6936309cd84db740a6f755286a5345ec159a7046e2c3f3126780262\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4139e076413d5d9d1fd2b594b83d854cc771dfa28886f3f67439ec043220dd9f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]}],\"name\":\"0b53b3ab98bfc66b662cb3ccde6535694ee9e681e165e011925491f011e74e55\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"505545a95fce131db80f848e9990387e6b3e42a2f7e2375f56bbc07efcac9723\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]}],\"name\":\"3f3727d24e2cdb2256f9ce1aa9d7daf02e123ff83dd7745a54bf0be968b8f9fd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/premium-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bd641664cfab5eecac33b1ff0c46f78597ed896bbc4c7a81487d56141be11715\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__dc807a9d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d8a00acc0d636e51\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-distinct-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__dc807a9d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d8a00acc0d636e51\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-distinct-w1-5f765a\"]}],\"name\":\"c6d9f4f268ffd7b969efc4b42666a18e7b4e74fa0efcee36ff06291b64cdd07f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9112a3b536f3eb5f79a5b52d0ee8a7a26d3700b295f3ce2775128d2841f01ff4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]}],\"name\":\"f08d8256a9bbcb38779e30702529b4c292d4f2775e4ae9817b47fa8337570bcb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ddbb47f4f9dda290c11f442f07feec9b2e64a236ec2c98dd4fb16a3796302ba3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__0c25be51\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"0eeedb6608ed0210\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-distinct-2-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__0c25be51\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"0eeedb6608ed0210\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-distinct-2-w1-5f765a\"]}],\"name\":\"fb5e9f944ff60517f890fed5aa51a590589ee84870b6b00ffb1d187e035ed1c3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0768841c9057075fe648e2fa67028e1fc0bee839efdd3e78e081dac6a9e13397\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]}],\"name\":\"2e7b2a851ead1f1cbcc5f6106eac7e445acafba2c4c4ad4a5a56639d6af03796\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7f1003cf42290c9494548cc907c9d6b31f90160185f5f9a729a625709fd1fb40\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__dc807a9d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d8a00acc0d636e51\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-distinct-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__dc807a9d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d8a00acc0d636e51\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-distinct-w1-5f765a\"]}],\"name\":\"7de1fcf03a98bd9434df66c8e2bbabb8a6758cfd8b4c1bc07707e0cd17f3a70b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b7e1694df51b77341405c6097e6d1487bf70a48e8a95816d2cfc62e5ddd6a999\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__0c25be51\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"0eeedb6608ed0210\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-distinct-2-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__0c25be51\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"0eeedb6608ed0210\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-distinct-2-w1-5f765a\"]}],\"name\":\"e45d437fabc94b7146571bcd5ac6f2fee56e43a9f023c9e1e15d67d077bb0cff\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9178bfcf79bd6f1164069b245bef389ffaa38dddce2763e94a3e39d83454aa7f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]}],\"name\":\"2e3472e08ab25f673a6a47899dd2756fa7246fcafa45a33d1cfbd451f1a6da2b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"106dc24382c96b56f69df1e4bfaa0455678809d57faded1081bc4e26a642d4a0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]}],\"name\":\"922243bc7c6610ec5ba0285d821a4e92cf6386c7e495914f5a3fe8f9160a0647\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4ff864a27b8c6cdd9a746e87a7d53b4055daacec9650360ef6d48d5964395d3f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__0c25be51\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"0eeedb6608ed0210\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-distinct-2-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__0c25be51\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"0eeedb6608ed0210\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-distinct-2-w1-5f765a\"]}],\"name\":\"b6f9cb2cdae82e814be4f1c67b0c2f3da01ef6645a272400a2fe7577eb5815ff\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0b8fd96f5e30886bce6ea837ac57b2f3d77783c525b1de469227d248ca2a1d6e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]}],\"name\":\"9ad77601cac881a53e95a12cc3d1e21e0beee1d4e9757eaa68fbb36f70dbe5e2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"dc6825eadf840da0185447dcfb22803683fc39051aa637aea7a66d081b192bf7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__dc807a9d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d8a00acc0d636e51\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-distinct-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__dc807a9d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d8a00acc0d636e51\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-distinct-w1-5f765a\"]}],\"name\":\"4ed033a41f89a0f23149658aeb2f5cbe79d4d5b179ddf0addaf56898cfb91f45\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e1e7c7c242c339c99da1caa3f217a7bd53ffc78a71bee9a0e898d1f0b8471fb3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]}],\"name\":\"00a6f26194c6932f8037cd0201f950c67a9b8fbee2e5ed3817f9a97812c711c2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b0ee4efc66d9a6e357c482407ac7794ac3e2e51168e28a743b633a36b12f1489\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__dc807a9d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d8a00acc0d636e51\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-distinct-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__dc807a9d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d8a00acc0d636e51\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-distinct-w1-5f765a\"]}],\"name\":\"4f607540ea8ad5f65e31b3b8bf068f37a827d58181018c53d169b4c83e69fc48\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c4c89ab332c30b38dc4f16ef73fecdbd0ef26ff23424b1e8fd0d18c2d45cf73d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]}],\"name\":\"892cea79034a9b0e44e5d14d2ace5c60fa5e183f87a7ffb536724af7425a469d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6ac0410a29c97032cc673c8f56fb055dcd84c1040f73657459b7f1183a6ef131\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__0c25be51\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"0eeedb6608ed0210\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-distinct-2-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__0c25be51\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"0eeedb6608ed0210\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-distinct-2-w1-5f765a\"]}],\"name\":\"777413beddd80a2dbe7efbaba4adc804e5a12db4f911e0e22a0ea59643cf8a40\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9d278f3acef96193a8d6a95bb17fda6beacb6c6949e61147bbb0a9f984d383ca\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]}],\"name\":\"c89ebfbf5d6c50d68e0202a4a7f2450fb6de7656dcb639d8a2d40d475718ebc7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8e06ac6cbf5999144a3b0f3b2584acaac3b4eb8d03d892bc45e03712448c4a9c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__dc807a9d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d8a00acc0d636e51\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-distinct-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__dc807a9d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d8a00acc0d636e51\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-distinct-w1-5f765a\"]}],\"name\":\"e52e079eb305353b58c669f26348af185ff2ff22d378b7c80663f6bbaa04aa50\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f7254b99580aca11d813d05cebe8fd0d083eab4978ed55c24131cbd3917e5e39\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]}],\"name\":\"a5339e879056a8880ff59d0bd2b4a470fa93075d67e5851ae7b49fba2bef41e6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a2866a5a08cd0abaabb645c82aff8b6635fdbd34410a7b092e32a8b164086e19\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-5f765a\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-5f765a\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"cc60bc0276d07b9216150b4bc6b21e75f85bf16c7cf27ea44774f135d5d03080\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b651c6e6a372a592c9723851c4377c52eae8778a18d51a17e65b611b0b04e077\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-5f765a\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-5f765a\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"3c78a568a81450298f63da5aa6923258e0adf684426ab83ceb35e01cf96e31be\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e206eae15f3c87b50ca80d04704d63fdf1ea76a805ec0dff6aaf8552207a1be8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-5f765a\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-5f765a\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"2b06fb39c490ea09b70252ff358244737d19e14a20470f0c43270d8a8d663698\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2ce874ebffdc76810fc3c080f4a7068ce8f4e9a05d63e70150e7fc6ef281b797\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-5f765a\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-5f765a\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"4ea6ce64f8c082ae7ad14a6cda98b463639b3ce9f3c1fb4c0f89d8e025314dd5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a2db302be0c4963be9b2d68075376d29342d2e854fa4746701662a56823b450e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-5f765a\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-5f765a\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"c252574ae7fb8eaff36f49460a23a178a025ecce5b05cd990eb6d87e58fc178a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b6a8f91d1ffdf775c75f2a1c84bb520696572aea4d3ece8ed9123766f347b2eb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]}],\"name\":\"7edb3db3dee9ba3102857080aca6e9bec53bbe738951ad9a83ba0cb19f036f1e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/simulator-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"eadff6644620dd26a92e8dd1076b97db8fef2224eb03b70ce4e7ee1ef8dc0b30\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]}],\"name\":\"41b87dde831c23a98bbe55369e4882c3bfbc1b8dcecce6cd22b590fe3e2fd450\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/premium-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b4056adace047bf2186763869c2f6a0524a9534ef874733d3868dfd41db1a7c9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__dc807a9d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d8a00acc0d636e51\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-distinct-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__dc807a9d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d8a00acc0d636e51\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-distinct-w1-5f765a\"]}],\"name\":\"bc833d07dbe8f000644c82cba26ec9f2ce483a0cd86141971709f215bd14e019\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"98aca426d9ec5ae558219406a36e9375b2e6291ddc5e73bd3960b21edfe258cd\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__0c25be51\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"0eeedb6608ed0210\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-distinct-2-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__0c25be51\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"0eeedb6608ed0210\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-distinct-2-w1-5f765a\"]}],\"name\":\"8e27ae43b5f0896611602b3ee9b020104ca8fa9588c510a3aa8b4c406a47912b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-2-w1-5f765a')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-worker-w1-5f765a"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-worker-w1-5f765a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:28:40.490Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w2-6fa533","namespace":"e2e-models-e2e-worker-w2-6fa533","uid":"2ff73667-c2c3-4579-9503-b6ca098f1021","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w2-6fa533\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:28:40.548Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w2-6fa533","namespace":"e2e-models-e2e-worker-w2-6fa533","uid":"3a128bb2-de88-49aa-ab9e-c8626107a077","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w2-6fa533\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:28:40.606Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w0-0c9014","namespace":"e2e-models-e2e-worker-w0-0c9014","uid":"dcb5a0e4-7049-4ddc-91de-e14d55b09789","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w0-0c9014\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:28:40.724Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w1-5f765a","namespace":"e2e-models-e2e-worker-w1-5f765a","uid":"9c852546-ee7c-4e72-855c-111315f7bf82","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w1-5f765a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:28:40.782Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-simulated-simulated-premium","namespace":"llm","uid":"447993be-3c57-4e68-8ffa-6fc998a39c77","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-simulated-simulated-premium\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:28:40.839Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w4-d6cb38","namespace":"e2e-models-e2e-worker-w4-d6cb38","uid":"0d3ebd35-5005-4ee4-a055-ff95546e3673","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w4-d6cb38\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:28:40.897Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w4-d6cb38","namespace":"e2e-models-e2e-worker-w4-d6cb38","uid":"486176e6-7786-40c4-9ce0-6f4a68b408b2","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w4-d6cb38\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:28:41.014Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w3-f51151","namespace":"e2e-models-e2e-worker-w3-f51151","uid":"c78aa03a-e3ca-4797-8a09-ab0d9cd88148","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w3-f51151\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:28:41.130Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-distinct-w1-5f765a","namespace":"e2e-models-e2e-worker-w1-5f765a","uid":"99bd7ac4-c4c8-4760-9c06-cdc422b9bf4b","error":"tokenratelimitpolicies.kuadrant.io \"maas-trlp-distinct-w1-5f765a\" not found"}
{"level":"error","ts":"2026-11-02T21:28:41.188Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-facebook-opt-125m-simulated","namespace":"llm","uid":"da8edb1a-ed61-454d-939f-fc7cd235d9fb","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-facebook-opt-125m-simulated\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:28:41.245Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-e2e-rt-sw-847782","namespace":"llm","uid":"ac76a284-ab3c-4e2d-94fd-5ea4dec861ab","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-e2e-rt-sw-847782\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:28:41.362Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w1-5f765a","namespace":"e2e-models-e2e-worker-w1-5f765a","uid":"7188eadc-9748-4be8-a5e2-d904cf5b6130","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w1-5f765a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:28:41.420Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w0-0c9014","namespace":"e2e-models-e2e-worker-w0-0c9014","uid":"4f647df6-1d5b-433b-b4fc-1279ff1755f7","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w0-0c9014\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:28:41.477Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-e2e-rt-eq-d2da5a","namespace":"llm","uid":"b2b6010d-4d0e-4c54-98e8-4772fd8d7077","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-e2e-rt-eq-d2da5a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:28:41.536Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w3-f51151","namespace":"e2e-models-e2e-worker-w3-f51151","uid":"e3340067-224a-43ad-8020-ca9e00ead152","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w3-f51151\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:28:41.654Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-distinct-2-w1-5f765a","namespace":"e2e-models-e2e-worker-w1-5f765a","uid":"143b566a-fa64-4d79-ac65-715d12ec67df","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-distinct-2-w1-5f765a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:28:42.155Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"data-science-gateway","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"data-science-gateway\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:28:51.358Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","EnvoyFilter","ConfigMap","Limitador","Gateway"],"eventTypes":{"delete":1,"update":20}}
{"level":"info","ts":"2026-11-02T21:28:51.597Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:28:52.540Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:28:52.650Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:28:52.650Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:28:54.736Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:28:54.738Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:28:54.748Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:28:54.753Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:28:54.757Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:28:54.757Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:28:54.898Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T21:28:57.099Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w2-6fa533","namespace":"e2e-models-e2e-worker-w2-6fa533","uid":"3a128bb2-de88-49aa-ab9e-c8626107a077","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w2-6fa533\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:28:57.234Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:28:57.234Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T21:28:57.768Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-worker-w0-0c9014","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-worker-w0-0c9014\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:28:57.982Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","Gateway","HTTPRoute"],"eventTypes":{"create":1,"delete":1,"update":3}}
{"level":"info","ts":"2026-11-02T21:29:01.033Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:29:01.035Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:29:01.040Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:29:01.040Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:29:01.044Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:29:01.044Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-02T21:29:01.145Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:29:01.146Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T21:29:01.154Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route#v1-chat-completions-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"f333a7db2a4322946ba06e577de4e4465e1174fb5cc0bb60d8d97ffd9018dc4b","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f333a7db2a4322946ba06e577de4e4465e1174fb5cc0bb60d8d97ffd9018dc4b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-d6cb38.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-d6cb38.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"f333a7db2a4322946ba06e577de4e4465e1174fb5cc0bb60d8d97ffd9018dc4b\" already exists"}
{"level":"error","ts":"2026-11-02T21:29:01.223Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"204a90b318233d1075e557d2348b027549cbc82cda4c1d6aea6cfcfa28a96654","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["204a90b318233d1075e557d2348b027549cbc82cda4c1d6aea6cfcfa28a96654"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-d6cb38.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-d6cb38.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"204a90b318233d1075e557d2348b027549cbc82cda4c1d6aea6cfcfa28a96654\" already exists"}
{"level":"error","ts":"2026-11-02T21:29:01.328Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route#v1-model-routing"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"af01177c39cc2acfc81deb8fed1e1062fd6125232da28da32592d4c0fd546c97","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["af01177c39cc2acfc81deb8fed1e1062fd6125232da28da32592d4c0fd546c97"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-d6cb38.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-d6cb38.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"af01177c39cc2acfc81deb8fed1e1062fd6125232da28da32592d4c0fd546c97\" already exists"}
{"level":"error","ts":"2026-11-02T21:29:01.396Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route#v1-completions-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"68beb50e573f7f8f729255a19248728f937beeab700e92bcc9c0a070e602e982","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["68beb50e573f7f8f729255a19248728f937beeab700e92bcc9c0a070e602e982"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-d6cb38.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-d6cb38.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"68beb50e573f7f8f729255a19248728f937beeab700e92bcc9c0a070e602e982\" already exists"}
{"level":"error","ts":"2026-11-02T21:29:01.466Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route#v1-responses-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"af8712f819a09682d066de98c1b93feb5b0f27e478190be446e0c2d881c1e213","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["af8712f819a09682d066de98c1b93feb5b0f27e478190be446e0c2d881c1e213"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-d6cb38.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-d6cb38.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"af8712f819a09682d066de98c1b93feb5b0f27e478190be446e0c2d881c1e213\" already exists"}
{"level":"error","ts":"2026-11-02T21:29:01.541Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route#v1-completions-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"1f3d6ce43ced512267c700bcaefac5fe1e5a0f56279d9c49efc4ca04e0d03518","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["1f3d6ce43ced512267c700bcaefac5fe1e5a0f56279d9c49efc4ca04e0d03518"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-d6cb38.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-d6cb38.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"1f3d6ce43ced512267c700bcaefac5fe1e5a0f56279d9c49efc4ca04e0d03518\" already exists"}
{"level":"error","ts":"2026-11-02T21:29:01.615Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"32a498b3029fba046b39d6c26d52ecb2de8f74b942f2d122b45240b1a839deae","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["32a498b3029fba046b39d6c26d52ecb2de8f74b942f2d122b45240b1a839deae"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-d6cb38.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-d6cb38.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"32a498b3029fba046b39d6c26d52ecb2de8f74b942f2d122b45240b1a839deae\" already exists"}
{"level":"error","ts":"2026-11-02T21:29:01.683Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route#v1-responses-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"99a01d66d9ba32727c09707b61669b110b150d8025da9291ae815b1d8e07454c","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["99a01d66d9ba32727c09707b61669b110b150d8025da9291ae815b1d8e07454c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-d6cb38.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-d6cb38.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"99a01d66d9ba32727c09707b61669b110b150d8025da9291ae815b1d8e07454c\" already exists"}
{"level":"error","ts":"2026-11-02T21:29:01.753Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"6d3e7a9a4b4298310e0bfe2e3cbd62aec91a573c07d02cbee9db82354ce9ae45","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["6d3e7a9a4b4298310e0bfe2e3cbd62aec91a573c07d02cbee9db82354ce9ae45"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-d6cb38.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-d6cb38.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"6d3e7a9a4b4298310e0bfe2e3cbd62aec91a573c07d02cbee9db82354ce9ae45\" already exists"}
{"level":"error","ts":"2026-11-02T21:29:01.855Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-worker-w4-d6cb38","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T21:21:30Z","generation":9,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"36c0d6c0-4ad3-4739-8e18-24485ab1bc48\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:27:59Z"}],"name":"kuadrant-e2e-worker-w4-d6cb38","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-worker-w4-d6cb38","uid":"36c0d6c0-4ad3-4739-8e18-24485ab1bc48"}],"resourceVersion":"36563","uid":"2255fc2d-ab48-428d-86a8-4726b25b244c"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7f9f489fba4cc345dba07951f043d704ea999478c1da34cd23037357dcdf1384\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"f61d2b7d2f64f1d64a2dcee70f47ce24c9c6eb4854589984128561c58f6171ac\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"12f3d170c629c434ef1558f623819a2294b75940427c1164b50933cdad3fb52f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"4d6b2e7d73dcdd0567dbe7811fffb6b677ae17a404dd4e000e5586417b4abff9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"af01177c39cc2acfc81deb8fed1e1062fd6125232da28da32592d4c0fd546c97\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"c66c5829a3315f16b0f26dd5daed466c5b2b261235b86bfb98043e96d7dd9de0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7f9f489fba4cc345dba07951f043d704ea999478c1da34cd23037357dcdf1384\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"5b984da304c827646ff112362de545fa451a799e7f6999eac00f25f038606c2a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"12f3d170c629c434ef1558f623819a2294b75940427c1164b50933cdad3fb52f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"ad40721e9bd95807ea332811f94d79eb07b9dd045127a232886a7924332cbc73\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"af01177c39cc2acfc81deb8fed1e1062fd6125232da28da32592d4c0fd546c97\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"9190216f349b0595dc54d5cad3f429f840bbb0e4a2c199f4f2c79134aeb92beb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7f9f489fba4cc345dba07951f043d704ea999478c1da34cd23037357dcdf1384\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"b91256531abbaaf08ed45e4a93b53e9af9ebb53002123196214bb374517e81f0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"12f3d170c629c434ef1558f623819a2294b75940427c1164b50933cdad3fb52f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"597cf592078ae14c96f33099e96fee363339bedb2f5d430fdd69e28e8be2a8ff\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"af01177c39cc2acfc81deb8fed1e1062fd6125232da28da32592d4c0fd546c97\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"165316669577d87085504ec32756c6d6d67f595b2690025965232ab07a1da412\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7f9f489fba4cc345dba07951f043d704ea999478c1da34cd23037357dcdf1384\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"490344715bd8708a2d31131fc3b4e370beef7eb7d9942ba89fc82080284e6244\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"12f3d170c629c434ef1558f623819a2294b75940427c1164b50933cdad3fb52f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"aeb99e2df9a1951917065c7b887084431b3e62a6f4d47287af43193676a5b8be\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"af01177c39cc2acfc81deb8fed1e1062fd6125232da28da32592d4c0fd546c97\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"76f141d8a065403b5c0a2fc7e2c76ce1301f93b13d91fd2078e5f2b4d2280197\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7f9f489fba4cc345dba07951f043d704ea999478c1da34cd23037357dcdf1384\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"fa28a7ae652b865919d1ff4c61fd33bb8512d3139af38d1ceb9697a99e63cc6b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"12f3d170c629c434ef1558f623819a2294b75940427c1164b50933cdad3fb52f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"601d68ffdf7137fde779cf41214f1c74f63e6b717be0b7aad1eb56041a2d9b76\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"af01177c39cc2acfc81deb8fed1e1062fd6125232da28da32592d4c0fd546c97\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"b7d42066b553c2d03aee2da38514171a14e8ae8d343c0fda8f80d3265343c45c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7f9f489fba4cc345dba07951f043d704ea999478c1da34cd23037357dcdf1384\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"2dea78ba3797dedd7edd7b687182785345cfd95029e2131769c5797e3b752eb5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7f9f489fba4cc345dba07951f043d704ea999478c1da34cd23037357dcdf1384\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"cdb3a0c564011d63952f137daa521c84f02a66f8a75696ef9ac4f1f2cc9ea8c9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"12f3d170c629c434ef1558f623819a2294b75940427c1164b50933cdad3fb52f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"e019089f573a8879defa7fdce139828725d9f042c5a4dc9974b9185a8a382c51\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"12f3d170c629c434ef1558f623819a2294b75940427c1164b50933cdad3fb52f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"6a08c6dd0c7522c09a18466dfa733eb68e8c593cdc8d2890ccff2f5c9064fcc0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"af01177c39cc2acfc81deb8fed1e1062fd6125232da28da32592d4c0fd546c97\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"6f15db2f827c7eda1ecbf154277f01be4351cb08f525fa50ec0da278253b6d6b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"af01177c39cc2acfc81deb8fed1e1062fd6125232da28da32592d4c0fd546c97\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"5a27a9e4c9daab234151b3ade5f24a8f9f235443ec26586cc0a883b4ca237233\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7f9f489fba4cc345dba07951f043d704ea999478c1da34cd23037357dcdf1384\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"31c0c96d54839068517aaeb062676423451143447943cafff7ee595d9fd1feca\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"12f3d170c629c434ef1558f623819a2294b75940427c1164b50933cdad3fb52f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"aebde4a102828558eb0fbde9709268d7adabc75fadf451c730e0573c086e2f07\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"af01177c39cc2acfc81deb8fed1e1062fd6125232da28da32592d4c0fd546c97\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"87ed1d3b3cd1e3027869c6fc197828ccea328c7f84e2acdf7e06e70b8842fdd7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a69bb45bad035c53dd8c7176828b1cc26d0c9d3f775d2059034b1639ca1b49d8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"79db77eb448edf55b65761a293f7f6fc07c9d4365912f7a8595364cdbf33d994\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e5e9b9fa41efe7f56f3ea6e9079d12a9f3e89cd596105815b30b04ba7ba1281b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"9b7cb9a28ed2fc7fdfa23c7d8d869cc573e3e72423805bef3f945a77d2785710\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"32a498b3029fba046b39d6c26d52ecb2de8f74b942f2d122b45240b1a839deae\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"7442c06fdbee3ca35e62201bfc1ded73b46ccce5d6905e07f6a1792cecd8bc10\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-w4-d6cb38/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"dff7a596e1042978304d40238abe84063cc499f4a6a2f9def85e7c84d1df1ebc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"4ebe0e741886c221cfcd8d1126bcb3535dcbe15c7f802a713d3b2ceb8cee37e1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4db1dd6250896b02d5f97b90471902db72d349ea082f211b7b5e4046c827d477\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"9e4cdffa79635674b661188290cd9c853017f5721accaa1f268edc6c6b7f2590\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1f3d6ce43ced512267c700bcaefac5fe1e5a0f56279d9c49efc4ca04e0d03518\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"a9a34f579b60868ec0be5a14bb835a3898e0c43fe25650166ed2178248bbe1f9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-w4-d6cb38/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8ea982efbe7afcd4f8dbaa4e864584b38ec852971d686ed11c87e99f1b9f4f9a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"1ed83021e2408187ee74cd1a66732d37b92c80d46439951ce5e0f654f1542381\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7d8b4229a4e8df0df0b627da5317c526c045e2ab5837161d638a7835193820d5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"36ee8c63f509519eef9ec6e2c257745b647d322586f8289611274ca06f90ec11\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2c4b4abb753457c4ad4bd5815f6ce55723fcfcf44f298a47923e03e51d023a49\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"3ce9856de6f3b95cc2ed4fe4abeef13ecb59b5b1ef0102b858e5d3ec0d8afa89\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"99a01d66d9ba32727c09707b61669b110b150d8025da9291ae815b1d8e07454c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"77ec05cc7c773a3540c71498b5777588286f6a84b1595d80c4f1634ded3def93\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-w4-d6cb38/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7fdbd59414185d321c56439c757d9c725c67465b49a83a52b935fdd9c5f0df82\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"2eb3ad4b5e4be8080b2e0309815371172455a7e5f61cf9c3c595f17e99e6f681\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c806bf2d4d850ded382b88489831427afef078ecb67dd4c920a1355d1453a2f9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"ac190091ad6e540c35613b81dc40071b56f4f92355769f89e35c56f588a5f040\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-w4-d6cb38/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bb82cce53996fd9a50a4f33832b37ff599d227ab91d54895bf0ab989d1eb0b01\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"138b7da9a4ea2091f7b13106ba292672e2ca1d22138b32de717b07cab221eebc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7ebdbd5a6be861834fc366408f369ad8f021dfe8f061cbc93334bc801f3df98f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"be4080fc1058816edd779c6c2b40a1657320a89a6a86b4ff7358026a6adb2e23\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6d3e7a9a4b4298310e0bfe2e3cbd62aec91a573c07d02cbee9db82354ce9ae45\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"8cc4fab950417e53f8887a857eadcd63e5254ca90ce535ac8312884267a353f5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a6e80d640d49da44f2b60f9db62279137aa6839ed5acbca6493b96977b1f3f9b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"b470ad22bfeca185d9d86c6a107cdea6e62f1aaf494ef31244de0d30052bbcfc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b1fdba63ead328fd43c505e06394bc2adb7e5e2dfb0a1e55ef2c41d8f345142f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"30a1d05fede91486be251352bb7291a36ac69d50b6fce18433612afe29f1b4b1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f333a7db2a4322946ba06e577de4e4465e1174fb5cc0bb60d8d97ffd9018dc4b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"ee6bf02baeb9e28323dc2d9fa206cb2ed963925f778322eed091490229b29e9e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f2655bcd7b6a7d3d8a4479c1c943c5f2b4d4fbb7d96408fc7ce07c4e7bd9f30c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"12835533e58f43762872e20b92b523339a9de435dc7d0f689b42133b367fae44\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"309f6b916a61539853033efc6ca2e083c01c99e5b96f857a7c78b89f9816f598\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"788f4c0f9a4e5a97247c2043b8125cf170fe6674c40d873723dc972c4d5d93af\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"68beb50e573f7f8f729255a19248728f937beeab700e92bcc9c0a070e602e982\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"26447c99384ffe81ccfc09fad9c33ffe60c6796933a9e2734b738ff5de8c664b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9a1afd5e20de63bb2c85d93c9c3fd7aae15a0f45cb6e07dc467b8063b97decee\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"4c928eaa593596b5c3719a02958892d193943b2129a32e43035c896d93b232c1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4b5d6544ef7fd39f49a5af0551f4a404b0a5f49df3054a95306b7f797216c599\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"8773bca7122a801a4f199775b03693ad30e316ffebea5bcaf72af079bf14f24d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3474cd3af51b646106406cc4778f6a5608fdc62b1fd92f27ccbcf8ab285bc05c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"f0bc235629f48b82dcaad76bce5cdb80abfa82763d9ad220a11c3e27d70223d5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"af8712f819a09682d066de98c1b93feb5b0f27e478190be446e0c2d881c1e213\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"8ea734d5ea8e3432cc886f3fd011204345c05060f7991aff6617797636b9896a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c34c962f04362894a54cdf652c523865dbd1633f051244729b008181d474e55\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"2c3bfc8693c69427d3231717a8df2d14aba0f1fb87d9fd82bb191f0ebb31c308\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"915885eb7c9a3e141be9223dcd2bf03d4b850977922b9f3ad6f812809cf05a77\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"6816c53aa0b9171acb1b1522501aef6282ab95e3b7509a288af72c749a40063f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e12ef81cd87aec42f5b2528c46a9aeefe6b1bca82398f07b17a52a4bf6e91945\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"bd1615998be1912965bb2d26173bc1bd1e2565f8996f1f21fc476ccff3b1ad05\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a6fa5c95daf46871f07bc4e3ef7985a19659c040a1ef2a7baccccaa90e241705\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"3a34ac7af354fbf7d29872077cc2e557a29218e220d9e4e79e21710f2084e770\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"347ab4a75cfecc2353073cab067f0c183bd7a253c653eba93329ecf6aa4c77b2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"7eac06b7d9983846e2e0314ba9178882139d7919173fba3a84a8b264634346a5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"16cb85f469e7c5716866312b8b4cc95d7bd4782b54923c1571be2b995ef85c30\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"a65b58c28d5a781726a832c59d62e640ea9d347c008d6795a6bc79865414532f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3aa68add648f18fb79f3def0d73f0c2f29d8ab60b1352cf4548a1a038cf3d923\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"fad9cba453f811618739c6f08a8544a889f48ec7511f7d3ccac0f71ba988967b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"099191e40682a5a6b1df435c6dc10936b8b4e31a891f3520e8e9f8418b1acc3e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"adbf9660bf8db4b1489d019993fddbd2863d0cf7c72174df8663c00e565a1e21\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"13694f4cecc05b3e953bb7d1aa68f96fad9b8548456e1357cc504ba9936493bf\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"fd3f6d135cf69e39efa3702af6a7e665f47a40ddb90f71d1f37cad11438027bc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"db8ed9490207e877020d08d86f8a9769046fd69225998abd4e476e93ef7b9431\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"e3ae0784ebe4c51499f320023e5e93f640f2a33ae4fea237cb7e068df1c76739\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"12dec0ddb151cc18ef75cfe2b4260788095e28a391f359fc3f7da7c75381b728\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"8f6398fb66bae44affa747ad532a12445774a5b43ca2c7196a633d5d03da8c80\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"735d43fce555e32c36cd137abc0678ce944fbfe58a677497d16ab8d9ab37074f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"1016de6b3250a59509e3bc1de65ad0a68ae6faf776c4eaa853d86bce7dd96698\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9a442413f7e81c114c48c6bbdd04c0e3809cdcdf4def1f524f6d3adf70468027\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"785762b8cbcc7dd30b578476b081ad2df517e9e450947fa2591a488b59407126\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"204a90b318233d1075e557d2348b027549cbc82cda4c1d6aea6cfcfa28a96654\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"7bb190477ec8b722acf5b940486e283cbb3ed66f8b99945c184f13fdd5e8b25e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-w4-d6cb38')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-worker-w4-d6cb38"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-worker-w4-d6cb38\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:29:01.859Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route#v1-catch-all-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"347ab4a75cfecc2353073cab067f0c183bd7a253c653eba93329ecf6aa4c77b2","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["347ab4a75cfecc2353073cab067f0c183bd7a253c653eba93329ecf6aa4c77b2"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-d6cb38.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-d6cb38.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"347ab4a75cfecc2353073cab067f0c183bd7a253c653eba93329ecf6aa4c77b2\" already exists"}
{"level":"error","ts":"2026-11-02T21:29:01.927Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route#v1-messages-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"915885eb7c9a3e141be9223dcd2bf03d4b850977922b9f3ad6f812809cf05a77","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["915885eb7c9a3e141be9223dcd2bf03d4b850977922b9f3ad6f812809cf05a77"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-d6cb38.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-d6cb38.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"915885eb7c9a3e141be9223dcd2bf03d4b850977922b9f3ad6f812809cf05a77\" already exists"}
{"level":"error","ts":"2026-11-02T21:29:01.994Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route#v1-messages-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"c806bf2d4d850ded382b88489831427afef078ecb67dd4c920a1355d1453a2f9","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["c806bf2d4d850ded382b88489831427afef078ecb67dd4c920a1355d1453a2f9"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-d6cb38.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w4-d6cb38.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"c806bf2d4d850ded382b88489831427afef078ecb67dd4c920a1355d1453a2f9\" already exists"}
{"level":"error","ts":"2026-11-02T21:29:02.015Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-worker-w2-6fa533","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T21:21:58Z","generation":9,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"350cbfc3-ae8f-47d8-bf88-3bc797a06de4\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:28:34Z"}],"name":"kuadrant-e2e-worker-w2-6fa533","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-worker-w2-6fa533","uid":"350cbfc3-ae8f-47d8-bf88-3bc797a06de4"}],"resourceVersion":"37291","uid":"e9c29fe8-1b7a-4730-9bc2-e4f3e80147bd"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2538346ffaabe171687c406d12f294530661f7690a04d14ab2327034447b1886\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" || auth.identity.selected_subscription_id == \\\"a2ee80e8a0948f99\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" || auth.identity.selected_subscription_id == \\\"a2ee80e8a0948f99\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"fc3c7a9daa18c716699d2f1fa233a5848a5d36cd60feee59a35bb57159d77252\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"df8548d2a100989756489c2811783626f3836ef18d08ba8c81bfb6b9e9ef9c28\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"983a86a79f65831a149f35f3c7673bbfb37560154023198d82ebb8965ed48c8e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/premium-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"13cb74b6bdfe9b2af39effc13c9d5ade5172cb10a5930c6aefbe733c0ab0cad4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"462645ad06b45e6f5c9824c64f8ebc4010534cdeadc425c4ab2c9b0594a88a7d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b565990bc269af90f4e0533dedaf97fc37dc70b037af910a7605358eda2713f5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"b369d9c3b4e9e1fbdb75c9e353f7e25f066823d31fb733c322ac2192463d58e1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-2-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2538346ffaabe171687c406d12f294530661f7690a04d14ab2327034447b1886\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" || auth.identity.selected_subscription_id == \\\"a2ee80e8a0948f99\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" || auth.identity.selected_subscription_id == \\\"a2ee80e8a0948f99\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"53b8e179280ac5286bf38489ea72372b11c85a8c387359bf689ebecff1663d36\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"df8548d2a100989756489c2811783626f3836ef18d08ba8c81bfb6b9e9ef9c28\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"c166f75566a6849f94f19ff1eaf52bbfeb65e132db0ce99439215a5fba3cf50f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/premium-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"13cb74b6bdfe9b2af39effc13c9d5ade5172cb10a5930c6aefbe733c0ab0cad4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"2eb901a322f6f85745b1b216f71a9aeaf7eef69af5cc7ad9aead13448f127634\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b565990bc269af90f4e0533dedaf97fc37dc70b037af910a7605358eda2713f5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"fae945183d4744cfc72f99d3814545646a9a87e750465f9b67476229ff21e62f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-2-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2538346ffaabe171687c406d12f294530661f7690a04d14ab2327034447b1886\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" || auth.identity.selected_subscription_id == \\\"a2ee80e8a0948f99\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" || auth.identity.selected_subscription_id == \\\"a2ee80e8a0948f99\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"89b4eca3220447cd92c83c9c71f9e61e645c1f746a07d9b87eac9b2d4af27f2a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"df8548d2a100989756489c2811783626f3836ef18d08ba8c81bfb6b9e9ef9c28\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"82b649105e404b52dbe59777c528effe8ddcaf390c919bc52a045d6654c17d27\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/premium-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"13cb74b6bdfe9b2af39effc13c9d5ade5172cb10a5930c6aefbe733c0ab0cad4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"0491f04b3838b4a997ad42c2f3b87b5bc525f5236ef6a51647a0af61e52bf52d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b565990bc269af90f4e0533dedaf97fc37dc70b037af910a7605358eda2713f5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"e160eef909b8d94a314732c333511d40579117e325a0f92347c702a5ee49c702\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-2-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2538346ffaabe171687c406d12f294530661f7690a04d14ab2327034447b1886\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" || auth.identity.selected_subscription_id == \\\"a2ee80e8a0948f99\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" || auth.identity.selected_subscription_id == \\\"a2ee80e8a0948f99\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"0f54f971c3b78f7352580f77fc5be3e00c2117ef445b417be77bf67ea75539a5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"df8548d2a100989756489c2811783626f3836ef18d08ba8c81bfb6b9e9ef9c28\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"616030c276c95a5326d811265a5516c30019307d032046e4dbf9c60aed89bb9f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/premium-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"13cb74b6bdfe9b2af39effc13c9d5ade5172cb10a5930c6aefbe733c0ab0cad4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"60974e3173a2c5fa225357d66a1c4055fbb2b76b845de70e5504acc58902d471\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b565990bc269af90f4e0533dedaf97fc37dc70b037af910a7605358eda2713f5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"18b6544f1fecef176364e89f35a905f48ff233680f0d7e6adfd1caf2b5f57048\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-2-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2538346ffaabe171687c406d12f294530661f7690a04d14ab2327034447b1886\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" || auth.identity.selected_subscription_id == \\\"a2ee80e8a0948f99\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" || auth.identity.selected_subscription_id == \\\"a2ee80e8a0948f99\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"6982a3a190cf8786b034f1d39a14b07dab2e5311ed66344e600b389726798c72\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"df8548d2a100989756489c2811783626f3836ef18d08ba8c81bfb6b9e9ef9c28\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"d8b01a7d8bf17be310055802641797f595c1e7290b01b91e2b87cf0300418b94\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/premium-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"13cb74b6bdfe9b2af39effc13c9d5ade5172cb10a5930c6aefbe733c0ab0cad4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"28c14a49b36fb1c2749324536c3bd478da8cea176c30e855a8c62d376476a248\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b565990bc269af90f4e0533dedaf97fc37dc70b037af910a7605358eda2713f5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"d42afd956ea2d4dcd0f0aaadc1669934e404dadfe3651ba4498df28db6f58683\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-2-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2538346ffaabe171687c406d12f294530661f7690a04d14ab2327034447b1886\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" || auth.identity.selected_subscription_id == \\\"a2ee80e8a0948f99\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" || auth.identity.selected_subscription_id == \\\"a2ee80e8a0948f99\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"87456404dc6fbf2160a52ba615889680b0c5cf40dc6100bb0e888288606dff25\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2538346ffaabe171687c406d12f294530661f7690a04d14ab2327034447b1886\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" || auth.identity.selected_subscription_id == \\\"a2ee80e8a0948f99\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" || auth.identity.selected_subscription_id == \\\"a2ee80e8a0948f99\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"8b9c2ea6de06bba9ed1ba2a65e99d1500ef45630a372914ecf445da73d74600a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"df8548d2a100989756489c2811783626f3836ef18d08ba8c81bfb6b9e9ef9c28\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"9222b1bebeb91f5bc797ef6f55e59f628b5f90c3da7305c7a50abb490cf18e24\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/premium-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"df8548d2a100989756489c2811783626f3836ef18d08ba8c81bfb6b9e9ef9c28\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"63ba67de9ead24d6aab10a349447139ea4c7227426ee6072b8939e91ccf0ed30\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/premium-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"13cb74b6bdfe9b2af39effc13c9d5ade5172cb10a5930c6aefbe733c0ab0cad4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"b23898184efef7f96fc649e5d2902d9e6f7d32805be8858eb5f57e88696a09d3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"13cb74b6bdfe9b2af39effc13c9d5ade5172cb10a5930c6aefbe733c0ab0cad4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"652be1bab4f56953c3da93778aeff670b21e92a5d993934466d89aaed158b5b6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b565990bc269af90f4e0533dedaf97fc37dc70b037af910a7605358eda2713f5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"e11de01e8f11e362fe12a9bcc574088487751f93b5de75b1bd8c99739acc40b0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-2-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b565990bc269af90f4e0533dedaf97fc37dc70b037af910a7605358eda2713f5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"4672868f1e2492bd2ac79be6374bbac36317364afff96ce0c9c7ac3d568f0b14\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-2-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2538346ffaabe171687c406d12f294530661f7690a04d14ab2327034447b1886\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" || auth.identity.selected_subscription_id == \\\"a2ee80e8a0948f99\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" || auth.identity.selected_subscription_id == \\\"a2ee80e8a0948f99\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"d58c446a6a9364595eaae0256bc0befa6f57ed0387674ac1d6970632cb6b41f0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"df8548d2a100989756489c2811783626f3836ef18d08ba8c81bfb6b9e9ef9c28\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"6e120ade3c6d3506708dea5d54e9bc2fd6306ec4718a0c11f9c0a89c0ea6f1cd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/premium-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"13cb74b6bdfe9b2af39effc13c9d5ade5172cb10a5930c6aefbe733c0ab0cad4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"f9f60e3c0c3c06fefd218a3662bf2dac472c1d5acfd112579332b16c2386f504\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b565990bc269af90f4e0533dedaf97fc37dc70b037af910a7605358eda2713f5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"6f55ce1a1c1254c42ba8a4204eaa5d732a42974a08d182b225b6ac98681f141a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-2-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"79e41416d85afbda9f192c421571f899a58b4937465fe640fd4d17dfb0d8240e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-6fa533\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-6fa533\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"af109b5290beff4991ef93d4a835ce24ed3b0986578fba7947a76ca1a6dd65e2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c17d6c6438d8754832a843b7a082fa7fc719ecd30696a3551f3ca815dd52f28b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"fcc5f235388ea2c13a59ae86bacfc4eb4fab79468e3ee8c91a602bb5eeeec1c9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-2-w2-6fa533/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8abe3e629bd34674437803d6e54a0cb90fe0d0df12d2eac23f0b40d2f4990b37\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" || auth.identity.selected_subscription_id == \\\"a2ee80e8a0948f99\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" || auth.identity.selected_subscription_id == \\\"a2ee80e8a0948f99\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"ccb67df939c7a3278e2bb82db8d5dc418650599ab46b4bd1d8fe07cf9bb459d0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"371e486415502802484cc345e68be13e0a37a1abb38f2f6c8cce9f8e79b8d9c1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"b41e21a5fb7ad8cd75dbaa2def82137084248aef58468ce3d04ebccec2987b3b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-w2-6fa533/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8f50bf1a21545f68eb583e07935b8b0da52bbc4743a8bc67c4d9545b76da56af\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"7206c2870629f698a99d45c9e7140cc1334b531b1ad5a3c88c147fac40e793b2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/premium-w2-6fa533/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d4fbd382871bb4f5406c37842f4848012cdca0b01e2d7698dc28e396dc18659d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"4924ec7c564baa67e51d989aa281cf4421dc82ba2910dd5cbc5e8ec66fd31e46\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-2-w2-6fa533/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"503064d3f84a23711f1dad5e35d11ef1efceaefb2204608d180ef8d886666ffa\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" || auth.identity.selected_subscription_id == \\\"a2ee80e8a0948f99\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" || auth.identity.selected_subscription_id == \\\"a2ee80e8a0948f99\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"1036f7f4f8b7c68faa7a499350cf496a96528b515b125a726c7e904d5297c1e6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e199374b1d053d8a1ea2fb463b47f0da1b100cb9029acd61282384f0bb2553a2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"fc0e1b2816287c18a95319a2d0a9379a9f7bf931fff586f75645e37973bc0009\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-w2-6fa533/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b3a9fbda204f0b6bfe85682d0fee9fd7a9712977e22af554d2d82ba07f1a075a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"e94cca1d60d77f1db698aae8d99dc62d60279b8e5de4556def17f51ea3d8b77b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-2-w2-6fa533/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"41e99bc62a2ac4e8034135f4b655088597f627c66b2efc4627394d148bc2b0ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" || auth.identity.selected_subscription_id == \\\"a2ee80e8a0948f99\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" || auth.identity.selected_subscription_id == \\\"a2ee80e8a0948f99\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"b2fa16adeef96749257d873656ef49327fe454d7ba806ae3a8a73ec44c8a092d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2f2531e01fa8fc0031706fadbba0c1818c30681dcf9d2c65b1c7c23230ea3a32\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"d04838d25723911d554e0017a035ebf67253923630681f27a1c93b44878b1bcc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/premium-w2-6fa533/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7be093b94c77d8e466548a812b2fd67ba6e4cdbef2e705474d1a124d26a40f56\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"89ba01e718f4b0e60188b8031e9bd1e3cf1d64712b57d397151cd36a5d6214df\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-2-w2-6fa533/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f1edf5f89fd287762fbbefa668581cdc8f1877a3f31497227c537000670166d9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" || auth.identity.selected_subscription_id == \\\"a2ee80e8a0948f99\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" || auth.identity.selected_subscription_id == \\\"a2ee80e8a0948f99\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"dbf8e642e7e029e70e317d8df7b5d12be0fc1f008d29ff415d7291c09924eecb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cf13f5a3da5f1ddbc441422b55ececcb0ffd227c7be1c942dc1d4c428387bca0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"0aa6387a836e4d80af5fd5a2d66846f1a40192a89e137f80c52334aa6d868a1c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-w2-6fa533/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"afe9746e0af749da011756561a859419e447efc535f5e3f3773b1d18a5b5a9ac\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"7ae7a5b24207da4f6cb3659a8b6639f53e96a876f02aaa1f0a8b92813f856ad7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/premium-w2-6fa533/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"739e19d51d8fbdeccfc8bc7587afd12132239f688ec6cf8d9586f242a71087f7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"5f4124bfb1cf4c49006c1e2d45346f89a11b72e563d9f8e2d4df054bb65c496c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-w2-6fa533/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8309dc44d5088e48040255bf86dbc622de08fc216837cd0027a69bdf179a9d2a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"206d678ecc5400943db26abb21afd48a2ffc6fee651aa73c8301a56858221aa0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/premium-w2-6fa533/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8f577e4cdeda37406cbf43b607fe4ff7a6bd85c0d3b2c53a45b82a9207f437f9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"7cdf48530943053e434f696a48871881d26809d6cd1a88e8b6daa617fd34d36f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-2-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"206e50a9b0e5f83281f994d9f1d85f92406e3544297c47017c081f763b10dd96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" || auth.identity.selected_subscription_id == \\\"a2ee80e8a0948f99\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" || auth.identity.selected_subscription_id == \\\"a2ee80e8a0948f99\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"1d9b68bda9fa73e5f8e8ac869771d602c5f128903fd22e64db2370f9749a3113\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6ed7710bfd4535612b60aefac40ff2eebbe50fc666cc75f29a23130bdd6ea269\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"1245658c93fce9ced820408e5e090ae4dd51a7c56161a6cfb1ef978beecc3557\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"313f15eb64d50822c9c91871179d7a6ffa3111f658f213fdc0612575f480add7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"eb5df92dd93dfd3d0bc54e95c455fd8d583232e993ed8aed3db80f624312b066\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"62457e23e29ce9b4e8380d685c5e9e84bc5137e91486a6f9c1c9e352ca3a021c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" || auth.identity.selected_subscription_id == \\\"a2ee80e8a0948f99\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" || auth.identity.selected_subscription_id == \\\"a2ee80e8a0948f99\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"957121ddf9ee4c2793cec71a8576e07ee1925a201f93c8de02b6fce446d010d8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1ce9b189744d237515a1896d038a3437e8e31669b01937d8cf3a067728ee7e82\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"672be8f3fbaf802659dc395e46e1b17c7ab1515e557eab74f4c7d2c055ad4cf7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/premium-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"881b63d46f0e94053b88caefbfd71fdab183199879cb564ccb3671b6189fcc2e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"4e3e10829c680ef4fa33002314a596e964d519ea2f3cd6331d666a22cfb597e5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0947683a63afc3251194a3b586cb934b1350dcaa171c4fd826d6773a00d5cf2a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"88202ce79ddf6dca9b8c8b1fbc0aa013155bc9975075ee9158a09c6708287af4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"66eb2a66302c20c8061f062df1542c7ad1db513c8b1988f81768f7d266f6665c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"64c175753cea5698cd255c8a903061deed215a3afcc403ae39f57d7b0f7600be\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fd7deaf8530c822c1b10ef4c1b0887086bc840af6d5c7a730508ddcb6e179095\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" || auth.identity.selected_subscription_id == \\\"a2ee80e8a0948f99\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" || auth.identity.selected_subscription_id == \\\"a2ee80e8a0948f99\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"14655ca6105b9121c6e780127a21626d2e779082f0ea2674b0d77647d247a24c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5ea067858e444716d33ddecbe718b086e12804ce72bba0a6f135b64fb1bb1c60\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"c88bc53da3544fc41175edc07ced29960aa58c4f7ebf17609eb30f993b862ccf\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"828fe179b1caaef8c4abb4ba71cbe53ab31fc04108a1194889605dd8100c90f1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"f249401e68d6dcd41e2325910ee9db0254c3afa92a19923e1751980966a4694d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"60ca770315801fd35b67ab23639ba4ac6a344fcf95fe492c267cc87cb90ce14f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" || auth.identity.selected_subscription_id == \\\"a2ee80e8a0948f99\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" || auth.identity.selected_subscription_id == \\\"a2ee80e8a0948f99\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"d7f0af7e7ca785bc5de89e740ff47459e16eb3ba9360c1eee59d6d8d2f7389bd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6d6f6c08f92b4cefaa6a997643ec612cf9c62df4fa750dd0f5d4c3d50d40d2bb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"daf823a39b0f169fe5f258178380bcf0b3e996152ebcc401fb21de178f041b24\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5cddd3e1918c7df14f710eb09cebc745d043be6f81e6c1e1f2a3803e2f0c6513\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"b1d5e4fa434bbb80c0f5baf3d8ee1797394841413a8f28625f4e0c9d2388764b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1f83c46a7c87c216ad3b7a3697a1ad6c518cb36972a910efbc3c7eed6ab3956a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" || auth.identity.selected_subscription_id == \\\"a2ee80e8a0948f99\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" || auth.identity.selected_subscription_id == \\\"a2ee80e8a0948f99\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"496ec6213c84428bc1374936695dcb9246c04c80a4460a92e53220e4641a7116\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e701c3e95fd6d7e3e60b9f162039289bbc904c42df899db9436b6ad7538d1ffc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"576f13852617450ef4f108d2d8c65426c74c6f743bd5e3d6530d746e72633fbc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"25cb748ea88f201b192c863c4e2fb40e5931cd9cfed0d04ae104e35dbe48f38b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"c49c039641c1cdbec2a8f5cc805b4b722943e1336d082080571a2f2fcb073186\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ad04b751b35d313ca76c5057f5e800aa0d5504bc27298aa1762dd803d351bff2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"a24ccfd407372af3bd4160c32a086ddd01bc5d92e15a1f783cdc3f7d8f642124\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3ecbc6560d7cb2e5396471349d24b95ff664f3b33dfc188e590c2b772721287c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"2e058e1b6b4635806a5e2b8fb08fed6fd11db7595be6907f89a86777a30aa9b5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f27c742360d050f8cfba473367fd8076f0a6abdf57b30c6116d8b1fa7559bcc0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"b7571ee2e0ac1a2c804f33ccb2108d7694841ff5c0b7595435bea59672db0c41\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"319a8bd03b55a51284dd6790058e026879ed8db3e6d527dedb4a9314473afa5b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" || auth.identity.selected_subscription_id == \\\"a2ee80e8a0948f99\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" || auth.identity.selected_subscription_id == \\\"a2ee80e8a0948f99\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"ac54aac970a6722b49c3410bffc6b58a3832c579aa7c3629ff80507ab769f2d3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8be72fdf7a1e6b1379ac7dc12f7c40286d882ef14376e9fd3e726b2fb781546c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"ac78bc480a068b655886c2d9dd75e3a680756398111216d2be7e8a3e730e4206\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"23d2f913b5bde1ed64144a38680e6282220982f4f5ea1167fabdda3234dbc67e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"c6c6e62fb02ec82dd2ad63c3690b3887e0701c293e1871ee382d92ea80f88f66\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"51e9e3c7450b52b22ca45c280738926226df3d95852d8df43ff47cf85cca9e5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-6fa533\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-6fa533\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"64fb7512cad2bf5a1c9b6978a7f9de714d5a739282aa9ca951ee3b4f417da286\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"dfa08453b9c8623db01e432dea4f9e09b3d7f80cbbee3a69df753c6d3fbfbded\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-6fa533\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-6fa533\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"af2b1c5e2c0a798508b2ef3249c778b1b43898c8636c878f66d20c220701a6f4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"517c7132d716e14e14b2c9fccd696f86bc7a24a46c391e71d07ac910d0dd1c18\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-6fa533\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-6fa533\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"ee9f66c18cbc8fcbae62d62e57dcbad633d943ff04a829fbc8bb030c121bf426\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b93afde66771848b5188f78e530f2f596324f9fb9f05b2dd8f1cb49489f2bda1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-6fa533\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-6fa533\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"c514ea15546ae0041f8d77a7e65bd51a98d808edee2739e914353f03c270d86d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"de3ca7c8a9dcdebe0c2a67b74b3bc72bdc4a8f34aff1f0c69df675fbb03b1e05\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-6fa533\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-6fa533\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"985f90a1588b57b9e2061e7440127c4729ab98e674bb91d1e90364de9aea35ad\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"edbbdcfc920b88151941be1a4c41ad8be6a38bd6beddae7387db202bc3e9b302\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" || auth.identity.selected_subscription_id == \\\"a2ee80e8a0948f99\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" || auth.identity.selected_subscription_id == \\\"a2ee80e8a0948f99\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"15153104d9c89c44b59d96d9d8825fe62d21af5bd4db90b6c300fa53823a0ef0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bf3fa706be871596c50143869f253e98ce7aa463d723d2f419d378a041dbfbe5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"4e925c4610a758f575689b807fc7a61cef2c3891e2cf0a1c1074186e65a2e8fd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/premium-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f09ce0bd9bc651317469310c8a604d792e7c7c55751d184a920638cf66ba0dd5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"499fc57e7a454d5bcd94feeb06b43584bb9133eb048e9ee5f20041a16d87ebaa\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bc33498b2dcdc2f8d2612aa17c0e640458a4442c9d7f2ad45303aeb15b5bccb9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"7ad42a3389048956d61fafc75400a2a68540cd2e35da26f1e7b80db45868f7dd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-2-w2-6fa533')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-worker-w2-6fa533"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-worker-w2-6fa533\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:29:02.170Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-worker-w1-5f765a","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T21:22:08Z","generation":8,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"4caf3c5b-8145-48de-a05b-6a1b9a102f00\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:28:34Z"}],"name":"kuadrant-e2e-worker-w1-5f765a","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-worker-w1-5f765a","uid":"4caf3c5b-8145-48de-a05b-6a1b9a102f00"}],"resourceVersion":"37295","uid":"fb3e4914-c809-4feb-81f5-a0a468b56725"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bcf0aab5299349f1dd1df89a10a558ad5617afdfb0f30d972811f3dbb51b1ea5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"7a50b7a26e741c88\\\" || auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"7a50b7a26e741c88\\\" || auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]}],\"name\":\"f2c753e74bbc5983406d967abd1143e62400e0f08a2e36f6ffa42c06a3a6974c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/simulator-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"db6f9ff18eeb49f1421400a53d101cb100b1a88466190b46fb6dbed22a42e073\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]}],\"name\":\"eedd7a1bac5c7747d7137dccbdafefbc4f76edb1acf806e0399e7d01c0c93443\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/premium-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0623abc228b11818faa4a08b26d906ef498cb9511f2bcee2bcd7c9e8dbb0a23a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"0a44edd91442d2ddfe39cb24e50368dfc1e81bad179d3235d38e40f25e9d22ae\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"99ce90aab60d81af668145560f9879cd2b5941652fd3e18c3d45856709a0948e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"91d7b5395adff9d28bf7ef05c8e81f9bd73a716e4072d28f8624ff5f9381a8fe\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-2-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bcf0aab5299349f1dd1df89a10a558ad5617afdfb0f30d972811f3dbb51b1ea5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"7a50b7a26e741c88\\\" || auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"7a50b7a26e741c88\\\" || auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]}],\"name\":\"76a34f19bf7079dd4104caff1731257297b843b61401a91d00b1a27ccab63fd7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/simulator-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"db6f9ff18eeb49f1421400a53d101cb100b1a88466190b46fb6dbed22a42e073\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]}],\"name\":\"263fa7af352a917ec5f565f1287ed3339005bf0c3ba787dcb8a5e539d84cfaff\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/premium-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0623abc228b11818faa4a08b26d906ef498cb9511f2bcee2bcd7c9e8dbb0a23a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"e78483f4191a6de2a454384113672ed5dcab6ca23c10f3e5052c523e46b7a77c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"99ce90aab60d81af668145560f9879cd2b5941652fd3e18c3d45856709a0948e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"601fd1e14b5e1e1044cd1ad2841f6c4703624cbd2a380dedacb373ba7867c1eb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-2-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bcf0aab5299349f1dd1df89a10a558ad5617afdfb0f30d972811f3dbb51b1ea5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"7a50b7a26e741c88\\\" || auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"7a50b7a26e741c88\\\" || auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]}],\"name\":\"3451d924df135b44fe4e7857db1417971e78cee0d322dc55f2d9dcfc1a98438c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/simulator-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"db6f9ff18eeb49f1421400a53d101cb100b1a88466190b46fb6dbed22a42e073\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]}],\"name\":\"c12741fd641c86bf88bbd47e58d2e5d62933e3e0f320cf13ec7d52df7a394c29\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/premium-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0623abc228b11818faa4a08b26d906ef498cb9511f2bcee2bcd7c9e8dbb0a23a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"7d42ed92cf0df2b010ce6bb7fe8510b6b214aa6493d82bbe3bdd85788b9ced2d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"99ce90aab60d81af668145560f9879cd2b5941652fd3e18c3d45856709a0948e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"89e9e9283f23750b835cfc41e1a3e8f29103f8fe9ceff7e9517fedfa07286e72\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-2-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bcf0aab5299349f1dd1df89a10a558ad5617afdfb0f30d972811f3dbb51b1ea5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"7a50b7a26e741c88\\\" || auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"7a50b7a26e741c88\\\" || auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]}],\"name\":\"70ba0b522bbd69a6ed9f77952d20b92d482b03854cc92dbb7d522bd33335c96d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/simulator-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"db6f9ff18eeb49f1421400a53d101cb100b1a88466190b46fb6dbed22a42e073\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]}],\"name\":\"65d2403634b5ea32b46b6ea0b85de94e33a3af4a2416095b99fbdb18350add91\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/premium-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0623abc228b11818faa4a08b26d906ef498cb9511f2bcee2bcd7c9e8dbb0a23a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"f16ad623eef6c3389dd02c8e5699fc3224f733fcfdf7f5e04c94d15bb259d565\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"99ce90aab60d81af668145560f9879cd2b5941652fd3e18c3d45856709a0948e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"31f5ec2b96aaa4e6b31984c22b75d9d621a704605d13ed2d59121449937c911d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-2-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bcf0aab5299349f1dd1df89a10a558ad5617afdfb0f30d972811f3dbb51b1ea5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"7a50b7a26e741c88\\\" || auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"7a50b7a26e741c88\\\" || auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]}],\"name\":\"ba40310e6c4dc6ab4a0b4c712eda89883762afc9beb70d4b7c23b27f69b9ab49\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/simulator-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"db6f9ff18eeb49f1421400a53d101cb100b1a88466190b46fb6dbed22a42e073\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]}],\"name\":\"bd657b2cf110d146eb81bf7b91f3184e0028cf98e5195ef2ddb8f508863741de\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/premium-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0623abc228b11818faa4a08b26d906ef498cb9511f2bcee2bcd7c9e8dbb0a23a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"2f0dfd729a81441e924bd38747be17f316e3b9b9e9528ea0a39238207dd25e7f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"99ce90aab60d81af668145560f9879cd2b5941652fd3e18c3d45856709a0948e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"d373660753c800ef6dc88aa9dcf376944988375525f3908104ef1f83260983ff\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-2-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bcf0aab5299349f1dd1df89a10a558ad5617afdfb0f30d972811f3dbb51b1ea5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"7a50b7a26e741c88\\\" || auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"7a50b7a26e741c88\\\" || auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]}],\"name\":\"d637ac7d402bcd26ac6f88370d996d05abc8c7982ed2c2cc4095675044806a8e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/simulator-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bcf0aab5299349f1dd1df89a10a558ad5617afdfb0f30d972811f3dbb51b1ea5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"7a50b7a26e741c88\\\" || auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"7a50b7a26e741c88\\\" || auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]}],\"name\":\"30abcde41a2149187abd00b7dbf1da4982d5f53b5da1288f5b95a0d579abbd6a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/simulator-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"db6f9ff18eeb49f1421400a53d101cb100b1a88466190b46fb6dbed22a42e073\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]}],\"name\":\"e253a93d7a1e997f4ec04774e63bac26b7573119884a469fa9cadfdd694f2c86\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/premium-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"db6f9ff18eeb49f1421400a53d101cb100b1a88466190b46fb6dbed22a42e073\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]}],\"name\":\"857e58268f515ca3e78ba5dd4b121c1c64a1556ffa6fb72ca451501f13fd956c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/premium-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0623abc228b11818faa4a08b26d906ef498cb9511f2bcee2bcd7c9e8dbb0a23a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"d6e34b9866f1888f862664b06edada2fc5b06428a00da8529b16758a3eda81bd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0623abc228b11818faa4a08b26d906ef498cb9511f2bcee2bcd7c9e8dbb0a23a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"d8a7afed6f125f1efe48eb9763d5f6da06382ed5c648453e53d16207a819a353\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"99ce90aab60d81af668145560f9879cd2b5941652fd3e18c3d45856709a0948e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"4e6de9db11e4f53c670f806b7f8fa9eef7623d7a93fac0088e6bc4808c690024\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-2-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"99ce90aab60d81af668145560f9879cd2b5941652fd3e18c3d45856709a0948e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"e4a3e27b6d899463b5db743e92f4f3eea337802f422e60f3725234174543f7ad\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-2-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bcf0aab5299349f1dd1df89a10a558ad5617afdfb0f30d972811f3dbb51b1ea5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"7a50b7a26e741c88\\\" || auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"7a50b7a26e741c88\\\" || auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]}],\"name\":\"c06ce02686be6c949fde11dd46005249ce969a6a4cd5979e062f2fd0e328306e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/simulator-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"db6f9ff18eeb49f1421400a53d101cb100b1a88466190b46fb6dbed22a42e073\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]}],\"name\":\"a5c2e2f330e8d4b7f1cc2fd43eb290bf161724714abfed900324fd2909e2a064\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/premium-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0623abc228b11818faa4a08b26d906ef498cb9511f2bcee2bcd7c9e8dbb0a23a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"f32d2c346b05e35d553dca7fe2805eee4c7886686071be499c78e95d284e8bd5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"99ce90aab60d81af668145560f9879cd2b5941652fd3e18c3d45856709a0948e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"6f1d479dd9b2c444c7bbd9d0b29aa4d86c30e494765ff79074f52d3018d29503\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-2-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fa1a008e4957943b0d2d9d600bd19dafc0caa0b522e5c1d1e09ecc5d82a64f4c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-5f765a\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-5f765a\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"b218feb88b60257514445a8b1d44e3ab1edb938de3bc6d6fdb02ef04222c6dcb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8614fe473acb7380c1bbcefbfc7ddc49bdb08a20998450fd852a13de53bb8a12\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"5340f589ec7e8ec67c1190312eeca907b744df43dafe4398f0722d074bfb32b9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-2-w1-5f765a/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"58ba249888c7ebfedfcb5aec9df19d4b07d2856710ac2163dcc961a176311fa9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"7a50b7a26e741c88\\\" || auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"7a50b7a26e741c88\\\" || auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]}],\"name\":\"4d61c78710f351b5667f692e1f8792c5724b52f7fc998511134665312fdd896f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/simulator-w1-5f765a/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9fa5392cc7c0130bb8596420fcb1a79f07b3d804fb9e4de459f680cdcfd5dcfc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"b1d7cdd38dbaf49bd08c0343391886f319979629ab66d478079771f78f733a35\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-w1-5f765a/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2aaf9242e876623422852fe471269a2d268f4d784b14c7ab37ec9f34c17f3060\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]}],\"name\":\"f201dec897e559ed36b9a30f0bbf86c43aae129e674ef36595083bda93e4b839\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/premium-w1-5f765a/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"36a5aec7d5b7178c754711c0ad90ec391fbc4764ff98bc952ff9d4d46a3e1fad\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"e1ac9296595d90737d084f76147f4acec9440f2802b7b4ad18409fe9de33bb5e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-2-w1-5f765a/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c19827aa458f939a86c4dbefda3dabc4f554898dbb7e2f92b488060e9e90b5cc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"7a50b7a26e741c88\\\" || auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"7a50b7a26e741c88\\\" || auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]}],\"name\":\"6d546403540eabf244c73a602659986050165bca90bc795de701a61411a1c48e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/simulator-w1-5f765a/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"922492b3fb118d2a03b9019d5fd7a1e7fc6f7f5e4559c5e1a0ef89b6f41e6c00\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"5cbb9e2f75cce25ddb3c2b6eb86ac94a59b3619ba9df40d1b5dd3580109ca3cc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-w1-5f765a/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"37f7dad0ca5234ce11642187ba11e681aa288a9b2a62a6d47b06de5fa5c385ed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"ec08733aeb0db1141aa8a8a511c7859111cf54e374fddf2e382a4616e38a9f7d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-2-w1-5f765a/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"784ccec783ba11c98817fe5af2849f9f4970be19046e351a067c85add913f548\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"7a50b7a26e741c88\\\" || auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"7a50b7a26e741c88\\\" || auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]}],\"name\":\"9327d3b7df136b8c0fed4aaa35057ac8d1022305472875ccc8c55a524105fb1a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/simulator-w1-5f765a/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"beb0d5e916dc078abcaba4ea5b4d8012d5c2d8edfd07ca54d585bfe44d7c605a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]}],\"name\":\"8cff0046c214e842687a3a284fe4fabc8a45eb2579168ac47aa1b4908bd95fc4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/premium-w1-5f765a/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"39a9f89f974929e5c36b7ca16af0fe122642ef82605ca091ecae9f1aab1c8c39\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"633ba07e8fd8d505f7f6918d4c95117ed7435ee10e97f4b5b67ea8fb88d406a9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-2-w1-5f765a/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5bc63b4c1a02d51f1462172790f7018aec7db9fb8a2a61024ca7c15aac9065b4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"7a50b7a26e741c88\\\" || auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"7a50b7a26e741c88\\\" || auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]}],\"name\":\"2bdf38e0b22608328672d2ed39e7a6336f89c14fb615a48fda4a36a65c185b32\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/simulator-w1-5f765a/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6ceeddb720a82c7a3a1051f6517a47c73f8528f97b9e67d8dd2f7dd9419967e1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"73c4b3ba76c71b5ac2b369625b3de4081ddfaca2a924b7a8741f70090acba47b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-w1-5f765a/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b8fb7aae7cac121f592817a5e9754983e04e46d9e4226183153bf83b778fffdd\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]}],\"name\":\"b288a64704f96ac78878f6909232d8598eef54cca0d7adc2629cac87b6802414\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/premium-w1-5f765a/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8f0923ad4223ef053267784d904817130eaaaa279092e9f9f1500d0325c2e6a7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"127ad269f06b6d28319f2bb527c4cb8c00c67080e95ba7a4c5aae51849cf6881\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-w1-5f765a/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9f6fc629fa43de74b0fb261de7e8b46fbdfe4f21235446879cd916210856d6f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]}],\"name\":\"3345e3b0c95bd559e9c6ce41f622270b0d9eed1deb3d862eb2d4fad368905626\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/premium-w1-5f765a/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4afb168c7cbb67555e268bc246b8eeeba53cda69691eb181663c1375ab099775\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"c917df68cc69647c025db7eb577471c675040ae5aa7ec4537927ac6f148031ea\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-2-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"719394d8154dd624eedc306180a33baa4128531f223bc2727d0376601dd634f6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"7a50b7a26e741c88\\\" || auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"7a50b7a26e741c88\\\" || auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]}],\"name\":\"94c5946d9d9c3cc245ba073b8c7a87c64029cba185e4d624d2145ef119722e87\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/simulator-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6cbb9b4408bb48fa5c471c9684ef41f50ebbc4e85135af89ff2781ab48666f2a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"7aaa0a43baf33eeaf52534a90f734bbc375ee8f202c1994adc991d076f599c57\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"796ce8085bd3851fe6a6d0c9b4c29504c70e44da1ae3ea663bfc85d308b1e5b1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"d7eb7b84f6936309cd84db740a6f755286a5345ec159a7046e2c3f3126780262\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4139e076413d5d9d1fd2b594b83d854cc771dfa28886f3f67439ec043220dd9f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"7a50b7a26e741c88\\\" || auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"7a50b7a26e741c88\\\" || auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]}],\"name\":\"0b53b3ab98bfc66b662cb3ccde6535694ee9e681e165e011925491f011e74e55\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"505545a95fce131db80f848e9990387e6b3e42a2f7e2375f56bbc07efcac9723\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]}],\"name\":\"3f3727d24e2cdb2256f9ce1aa9d7daf02e123ff83dd7745a54bf0be968b8f9fd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/premium-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bd641664cfab5eecac33b1ff0c46f78597ed896bbc4c7a81487d56141be11715\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"c6d9f4f268ffd7b969efc4b42666a18e7b4e74fa0efcee36ff06291b64cdd07f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9112a3b536f3eb5f79a5b52d0ee8a7a26d3700b295f3ce2775128d2841f01ff4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]}],\"name\":\"f08d8256a9bbcb38779e30702529b4c292d4f2775e4ae9817b47fa8337570bcb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ddbb47f4f9dda290c11f442f07feec9b2e64a236ec2c98dd4fb16a3796302ba3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"fb5e9f944ff60517f890fed5aa51a590589ee84870b6b00ffb1d187e035ed1c3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0768841c9057075fe648e2fa67028e1fc0bee839efdd3e78e081dac6a9e13397\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"7a50b7a26e741c88\\\" || auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"7a50b7a26e741c88\\\" || auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]}],\"name\":\"2e7b2a851ead1f1cbcc5f6106eac7e445acafba2c4c4ad4a5a56639d6af03796\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7f1003cf42290c9494548cc907c9d6b31f90160185f5f9a729a625709fd1fb40\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"7de1fcf03a98bd9434df66c8e2bbabb8a6758cfd8b4c1bc07707e0cd17f3a70b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b7e1694df51b77341405c6097e6d1487bf70a48e8a95816d2cfc62e5ddd6a999\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"e45d437fabc94b7146571bcd5ac6f2fee56e43a9f023c9e1e15d67d077bb0cff\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9178bfcf79bd6f1164069b245bef389ffaa38dddce2763e94a3e39d83454aa7f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"7a50b7a26e741c88\\\" || auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"7a50b7a26e741c88\\\" || auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]}],\"name\":\"2e3472e08ab25f673a6a47899dd2756fa7246fcafa45a33d1cfbd451f1a6da2b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"106dc24382c96b56f69df1e4bfaa0455678809d57faded1081bc4e26a642d4a0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]}],\"name\":\"922243bc7c6610ec5ba0285d821a4e92cf6386c7e495914f5a3fe8f9160a0647\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4ff864a27b8c6cdd9a746e87a7d53b4055daacec9650360ef6d48d5964395d3f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"b6f9cb2cdae82e814be4f1c67b0c2f3da01ef6645a272400a2fe7577eb5815ff\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0b8fd96f5e30886bce6ea837ac57b2f3d77783c525b1de469227d248ca2a1d6e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"7a50b7a26e741c88\\\" || auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"7a50b7a26e741c88\\\" || auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]}],\"name\":\"9ad77601cac881a53e95a12cc3d1e21e0beee1d4e9757eaa68fbb36f70dbe5e2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"dc6825eadf840da0185447dcfb22803683fc39051aa637aea7a66d081b192bf7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"4ed033a41f89a0f23149658aeb2f5cbe79d4d5b179ddf0addaf56898cfb91f45\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e1e7c7c242c339c99da1caa3f217a7bd53ffc78a71bee9a0e898d1f0b8471fb3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]}],\"name\":\"00a6f26194c6932f8037cd0201f950c67a9b8fbee2e5ed3817f9a97812c711c2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b0ee4efc66d9a6e357c482407ac7794ac3e2e51168e28a743b633a36b12f1489\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"4f607540ea8ad5f65e31b3b8bf068f37a827d58181018c53d169b4c83e69fc48\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c4c89ab332c30b38dc4f16ef73fecdbd0ef26ff23424b1e8fd0d18c2d45cf73d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]}],\"name\":\"892cea79034a9b0e44e5d14d2ace5c60fa5e183f87a7ffb536724af7425a469d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6ac0410a29c97032cc673c8f56fb055dcd84c1040f73657459b7f1183a6ef131\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"777413beddd80a2dbe7efbaba4adc804e5a12db4f911e0e22a0ea59643cf8a40\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9d278f3acef96193a8d6a95bb17fda6beacb6c6949e61147bbb0a9f984d383ca\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"7a50b7a26e741c88\\\" || auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"7a50b7a26e741c88\\\" || auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]}],\"name\":\"c89ebfbf5d6c50d68e0202a4a7f2450fb6de7656dcb639d8a2d40d475718ebc7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8e06ac6cbf5999144a3b0f3b2584acaac3b4eb8d03d892bc45e03712448c4a9c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"e52e079eb305353b58c669f26348af185ff2ff22d378b7c80663f6bbaa04aa50\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f7254b99580aca11d813d05cebe8fd0d083eab4978ed55c24131cbd3917e5e39\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]}],\"name\":\"a5339e879056a8880ff59d0bd2b4a470fa93075d67e5851ae7b49fba2bef41e6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a2866a5a08cd0abaabb645c82aff8b6635fdbd34410a7b092e32a8b164086e19\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-5f765a\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-5f765a\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"cc60bc0276d07b9216150b4bc6b21e75f85bf16c7cf27ea44774f135d5d03080\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b651c6e6a372a592c9723851c4377c52eae8778a18d51a17e65b611b0b04e077\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-5f765a\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-5f765a\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"3c78a568a81450298f63da5aa6923258e0adf684426ab83ceb35e01cf96e31be\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e206eae15f3c87b50ca80d04704d63fdf1ea76a805ec0dff6aaf8552207a1be8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-5f765a\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-5f765a\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"2b06fb39c490ea09b70252ff358244737d19e14a20470f0c43270d8a8d663698\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2ce874ebffdc76810fc3c080f4a7068ce8f4e9a05d63e70150e7fc6ef281b797\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-5f765a\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-5f765a\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"4ea6ce64f8c082ae7ad14a6cda98b463639b3ce9f3c1fb4c0f89d8e025314dd5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a2db302be0c4963be9b2d68075376d29342d2e854fa4746701662a56823b450e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-5f765a\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-5f765a\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"c252574ae7fb8eaff36f49460a23a178a025ecce5b05cd990eb6d87e58fc178a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b6a8f91d1ffdf775c75f2a1c84bb520696572aea4d3ece8ed9123766f347b2eb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"7a50b7a26e741c88\\\" || auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"7a50b7a26e741c88\\\" || auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]}],\"name\":\"7edb3db3dee9ba3102857080aca6e9bec53bbe738951ad9a83ba0cb19f036f1e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/simulator-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"eadff6644620dd26a92e8dd1076b97db8fef2224eb03b70ce4e7ee1ef8dc0b30\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]}],\"name\":\"41b87dde831c23a98bbe55369e4882c3bfbc1b8dcecce6cd22b590fe3e2fd450\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/premium-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b4056adace047bf2186763869c2f6a0524a9534ef874733d3868dfd41db1a7c9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"bc833d07dbe8f000644c82cba26ec9f2ce483a0cd86141971709f215bd14e019\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"98aca426d9ec5ae558219406a36e9375b2e6291ddc5e73bd3960b21edfe258cd\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"8e27ae43b5f0896611602b3ee9b020104ca8fa9588c510a3aa8b4c406a47912b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-2-w1-5f765a')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-worker-w1-5f765a"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-worker-w1-5f765a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:29:02.229Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w0-0c9014","namespace":"e2e-models-e2e-worker-w0-0c9014","uid":"dcb5a0e4-7049-4ddc-91de-e14d55b09789","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w0-0c9014\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:29:02.287Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-e2e-rt-sw-847782","namespace":"llm","uid":"ac76a284-ab3c-4e2d-94fd-5ea4dec861ab","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-e2e-rt-sw-847782\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:29:02.346Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w3-f51151","namespace":"e2e-models-e2e-worker-w3-f51151","uid":"c78aa03a-e3ca-4797-8a09-ab0d9cd88148","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w3-f51151\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:29:02.403Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w4-d6cb38","namespace":"e2e-models-e2e-worker-w4-d6cb38","uid":"486176e6-7786-40c4-9ce0-6f4a68b408b2","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w4-d6cb38\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:29:02.443Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-worker-w4-d6cb38-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-worker-w4-d6cb38-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:29:02.461Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w4-d6cb38","namespace":"e2e-models-e2e-worker-w4-d6cb38","uid":"0d3ebd35-5005-4ee4-a055-ff95546e3673","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w4-d6cb38\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:29:02.519Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-simulated-simulated-premium","namespace":"llm","uid":"447993be-3c57-4e68-8ffa-6fc998a39c77","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-simulated-simulated-premium\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:29:02.636Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-e2e-rt-eq-d2da5a","namespace":"llm","uid":"b2b6010d-4d0e-4c54-98e8-4772fd8d7077","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-e2e-rt-eq-d2da5a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:29:02.694Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w2-6fa533","namespace":"e2e-models-e2e-worker-w2-6fa533","uid":"2ff73667-c2c3-4579-9503-b6ca098f1021","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w2-6fa533\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:29:02.930Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w0-0c9014","namespace":"e2e-models-e2e-worker-w0-0c9014","uid":"4f647df6-1d5b-433b-b4fc-1279ff1755f7","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w0-0c9014\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:29:02.988Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w1-5f765a","namespace":"e2e-models-e2e-worker-w1-5f765a","uid":"7188eadc-9748-4be8-a5e2-d904cf5b6130","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w1-5f765a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:29:03.105Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-facebook-opt-125m-simulated","namespace":"llm","uid":"da8edb1a-ed61-454d-939f-fc7cd235d9fb","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-facebook-opt-125m-simulated\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:29:03.163Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w1-5f765a","namespace":"e2e-models-e2e-worker-w1-5f765a","uid":"9c852546-ee7c-4e72-855c-111315f7bf82","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w1-5f765a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:29:03.221Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w2-6fa533","namespace":"e2e-models-e2e-worker-w2-6fa533","uid":"3a128bb2-de88-49aa-ab9e-c8626107a077","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w2-6fa533\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:29:03.343Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w3-f51151","namespace":"e2e-models-e2e-worker-w3-f51151","uid":"e3340067-224a-43ad-8020-ca9e00ead152","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w3-f51151\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:29:03.343Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:29:03.343Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T21:29:03.414Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"distinct-w1-5f765a-kserve-route","namespace":"e2e-models-e2e-worker-w1-5f765a","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"distinct-w1-5f765a-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:29:03.560Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"distinct-2-w1-5f765a-kserve-route","namespace":"e2e-models-e2e-worker-w1-5f765a","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"distinct-2-w1-5f765a-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:29:03.629Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"distinct-w4-d6cb38-kserve-route","namespace":"e2e-models-e2e-worker-w4-d6cb38","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"distinct-w4-d6cb38-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:29:03.645Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-worker-w0-0c9014","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-worker-w0-0c9014\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:29:09.633Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","TokenRateLimitPolicy","HTTPRoute","AuthPolicy","ConfigMap","EnvoyFilter","Gateway","Limitador"],"eventTypes":{"create":15,"update":24}}
{"level":"info","ts":"2026-11-02T21:29:09.919Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:29:11.565Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:29:11.667Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:29:11.667Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:29:14.277Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:29:14.282Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:29:14.284Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:29:14.284Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:29:14.291Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:29:14.327Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-11-02T21:29:14.393Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:29:14.393Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T21:29:15.703Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w2-6fa533","namespace":"e2e-models-e2e-worker-w2-6fa533","uid":"3a128bb2-de88-49aa-ab9e-c8626107a077","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w2-6fa533\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:29:16.573Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-distinct-w1-5f765a","namespace":"e2e-models-e2e-worker-w1-5f765a","uid":"5005782d-fbc4-43d7-97f9-147eaba8d673","error":"tokenratelimitpolicies.kuadrant.io \"maas-trlp-distinct-w1-5f765a\" not found"}
{"level":"info","ts":"2026-11-02T21:29:17.087Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:29:17.100Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T21:29:17.227Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"data-science-gateway","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"data-science-gateway\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:29:26.347Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","TokenRateLimitPolicy","HTTPRoute","AuthPolicy","EnvoyFilter","ConfigMap","Limitador","Gateway"],"eventTypes":{"create":12,"delete":1,"update":14}}
{"level":"info","ts":"2026-11-02T21:29:26.483Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:29:27.331Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:29:27.454Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:29:27.454Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:29:29.969Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:29:29.975Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:29:29.976Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:29:29.976Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:29:29.969Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:29:29.990Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:29:30.082Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T21:29:31.460Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-distinct-2-w1-5f765a","namespace":"e2e-models-e2e-worker-w1-5f765a","uid":"edd2d53d-48c1-4c12-afc2-a1cbebfe773e","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-distinct-2-w1-5f765a\": StorageError: invalid object, Code: 4, Key: /kubernetes.io/kuadrant.io/tokenratelimitpolicies/e2e-models-e2e-worker-w1-5f765a/maas-trlp-distinct-2-w1-5f765a, ResourceVersion: 0, AdditionalErrorMsg: Precondition failed: UID in precondition: edd2d53d-48c1-4c12-afc2-a1cbebfe773e, UID in object meta: d874e5bc-086e-49b7-8479-63c6ff45b7cd"}
{"level":"info","ts":"2026-11-02T21:29:32.664Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:29:32.664Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T21:29:32.906Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"data-science-gateway","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"data-science-gateway\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:29:33.150Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-worker-w4-d6cb38","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-worker-w4-d6cb38\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:29:33.409Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy"],"eventTypes":{"update":2}}
{"level":"info","ts":"2026-11-02T21:29:36.423Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:29:36.432Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:29:36.432Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:29:36.443Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"error","ts":"2026-11-02T21:29:36.501Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:29:36.501Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T21:29:37.198Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-worker-w0-0c9014","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T21:21:39Z","generation":6,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"ddb57683-c2b1-4246-8c87-c1833e256a52\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:29:15Z"}],"name":"kuadrant-e2e-worker-w0-0c9014","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-worker-w0-0c9014","uid":"ddb57683-c2b1-4246-8c87-c1833e256a52"}],"resourceVersion":"38484","uid":"3a59a593-1a36-4e21-9529-ff8f3620d431"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"86115b8156c50eab2036378ac37ec53b33537f0eef44a4aa5d81752c24254c82\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" || auth.identity.selected_subscription_id == \\\"9d79ede0654301ee\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" || auth.identity.selected_subscription_id == \\\"9d79ede0654301ee\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"c69d9902b654dc255ef5aa6007c01753aa727fc097ae6b83d952cc0cf913761b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bdc9387e460a2dc1a85bc42d8ce6440788e8331159ace91b443c9628ef7c1fed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"2f68643a3c63d5b17fdfef48d85bd91a0973501f0d563a896e4b380a0b00d185\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e1cab00a309f6035001c6bed21b280b9cd6d81b83072c8f351fbe860f69886ad\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"d886729ca10572769b8b41e68ee56fb12942ea073f0b48ede22b1cc50bfcc40f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fe65e47ea66e64f823a934786806a737bfe3ca692bad4019774d91daeb2348d1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"e10af8f1a2640cf1de04932f79e79764db98097340db6ec566b3ab0af709d0d8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"86115b8156c50eab2036378ac37ec53b33537f0eef44a4aa5d81752c24254c82\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" || auth.identity.selected_subscription_id == \\\"9d79ede0654301ee\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" || auth.identity.selected_subscription_id == \\\"9d79ede0654301ee\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"34720a2e4d6ed7817a277e99c8b6c63bea050141799be3b70b3690e8575a06a6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bdc9387e460a2dc1a85bc42d8ce6440788e8331159ace91b443c9628ef7c1fed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"3a712e9256a22351eb20be5c7695beb1ebb8fb8ce2b2061a380c7829f310a235\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e1cab00a309f6035001c6bed21b280b9cd6d81b83072c8f351fbe860f69886ad\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"24d4dc5eb03a2701700ed1da77fab5dada30f4d5f19acc2aeb784ab7c2913842\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fe65e47ea66e64f823a934786806a737bfe3ca692bad4019774d91daeb2348d1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"95b56d1eb3f5f986a8dcd4728f616565f9664996c1a434f44f7b87c3972457ca\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"86115b8156c50eab2036378ac37ec53b33537f0eef44a4aa5d81752c24254c82\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" || auth.identity.selected_subscription_id == \\\"9d79ede0654301ee\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" || auth.identity.selected_subscription_id == \\\"9d79ede0654301ee\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"f831f6710914a69194c3f7c48e2651f7e183a1e62afcb27c73307245ab045f93\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bdc9387e460a2dc1a85bc42d8ce6440788e8331159ace91b443c9628ef7c1fed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"ad3a2d8079306ff1eeb9734837c5b71f0724eb8028848f90dbf05b80557a363c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e1cab00a309f6035001c6bed21b280b9cd6d81b83072c8f351fbe860f69886ad\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"44114992b7dce232405acd1cfada4b72839265de04c15b8c8b12cba013144276\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fe65e47ea66e64f823a934786806a737bfe3ca692bad4019774d91daeb2348d1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"a594b6f1c0a2b22e4714c27e98575eda080192ee3760bdfca9b4ad6aa516eee0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"86115b8156c50eab2036378ac37ec53b33537f0eef44a4aa5d81752c24254c82\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" || auth.identity.selected_subscription_id == \\\"9d79ede0654301ee\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" || auth.identity.selected_subscription_id == \\\"9d79ede0654301ee\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"de21a6b7dab6f53ab9e521b41625d35020e107d76ddb50e2958e0e2a412d9e40\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bdc9387e460a2dc1a85bc42d8ce6440788e8331159ace91b443c9628ef7c1fed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"9d9413f8be4dfb8834299266127fb239516760f378a7601605194b5533f62a28\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e1cab00a309f6035001c6bed21b280b9cd6d81b83072c8f351fbe860f69886ad\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"b608ac3153414f90d7bc1d459d441fc96968144e3d07d2286f28927e15b1e621\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fe65e47ea66e64f823a934786806a737bfe3ca692bad4019774d91daeb2348d1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"31897c718cc142df0d5d16918dfaf37807fffedaa54950878ada2e28c78ed1ea\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"86115b8156c50eab2036378ac37ec53b33537f0eef44a4aa5d81752c24254c82\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" || auth.identity.selected_subscription_id == \\\"9d79ede0654301ee\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" || auth.identity.selected_subscription_id == \\\"9d79ede0654301ee\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"0f90af4971cd47ea5ddd60d45eba18a900b5cf23592a3f0ecd9d46778e3738e0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bdc9387e460a2dc1a85bc42d8ce6440788e8331159ace91b443c9628ef7c1fed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"93ac09aaab9c4f036a2bdd254b8b96a4151063abefd4189c40778e53ebecdc09\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e1cab00a309f6035001c6bed21b280b9cd6d81b83072c8f351fbe860f69886ad\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"8791484f6beb20141c5c557cf7cec8b4649b67a98f43b54539a6ee6a88bceb5f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fe65e47ea66e64f823a934786806a737bfe3ca692bad4019774d91daeb2348d1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"5009bcd6ede0ee206f1c68b91ea406216f5da58a2b1c5f056ba6778c5f13d641\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"86115b8156c50eab2036378ac37ec53b33537f0eef44a4aa5d81752c24254c82\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" || auth.identity.selected_subscription_id == \\\"9d79ede0654301ee\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" || auth.identity.selected_subscription_id == \\\"9d79ede0654301ee\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"140e618f0bcaa91b635c87d4f29e5f8813bf0436d1f6e9b36373faecbdec61eb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"86115b8156c50eab2036378ac37ec53b33537f0eef44a4aa5d81752c24254c82\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" || auth.identity.selected_subscription_id == \\\"9d79ede0654301ee\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" || auth.identity.selected_subscription_id == \\\"9d79ede0654301ee\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"6acbaeb49e85ee3cb000f040214618990342fd0a59de5b2c5a1f90647758a246\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bdc9387e460a2dc1a85bc42d8ce6440788e8331159ace91b443c9628ef7c1fed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"5b6e6a7f7dc5f0d34eb857ca49303262b3c223fe67458805f41c060248c5dbfe\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bdc9387e460a2dc1a85bc42d8ce6440788e8331159ace91b443c9628ef7c1fed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"2127668fa8fef2292ac1484bc4a37390a4f7d56256dc3e5dbee6c3e5a11a9b76\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e1cab00a309f6035001c6bed21b280b9cd6d81b83072c8f351fbe860f69886ad\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"0aa314d93ee3acda2c2d9263c7d5271f8931007a465cca802fa4f97f82de8fea\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e1cab00a309f6035001c6bed21b280b9cd6d81b83072c8f351fbe860f69886ad\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"cb70a8e00aa575e704bd5c438dfcc5d7f8961efe6033fd93fae3fc6eca018120\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fe65e47ea66e64f823a934786806a737bfe3ca692bad4019774d91daeb2348d1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"1acbce7018705c04168bda5187e037e60c0fe47f186f10f96e84266e33b5b034\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fe65e47ea66e64f823a934786806a737bfe3ca692bad4019774d91daeb2348d1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"52baf0b74be4e68628b5b4ef71a9d95dad1cf739658ce467c9b24c3165eac562\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"86115b8156c50eab2036378ac37ec53b33537f0eef44a4aa5d81752c24254c82\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" || auth.identity.selected_subscription_id == \\\"9d79ede0654301ee\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" || auth.identity.selected_subscription_id == \\\"9d79ede0654301ee\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"a9b1a49056b3283c82e0d4f88ad61bed5b6f4b736a70f1bb2ef4ba19a80a05e0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bdc9387e460a2dc1a85bc42d8ce6440788e8331159ace91b443c9628ef7c1fed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"30c85ca7419d0f9a695b73530b16cb571b50e9dde62c1210e8c4fe44c14e4def\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e1cab00a309f6035001c6bed21b280b9cd6d81b83072c8f351fbe860f69886ad\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"5a52f00c07e5813093290d1bee011f0120610619cb82666a79b0139919644d6e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fe65e47ea66e64f823a934786806a737bfe3ca692bad4019774d91daeb2348d1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"309ad48f4f9314f702e5565256eb6d81567787f6737820f7ffb21a6d85a92b93\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"00c4d48b9f06a2f5dbb9cbe22ae3dcc9e10401b038e62058849dcebe2769e4f1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-0c9014\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-0c9014\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"02e0339b7fefd72794f04b407e26149d4822a36b0c408bf1129e0f7ccdc0cfdb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"884ebceaf8f5da21059151f97834277770ed77023feb57f83fc8c75e495f8d1c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"bb55cf856b87c0953ba4478213144ef02787b3cbbf80cc32e530521407ee40b0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7da280ddad70ebcc1b84b8a595244d0682cd0302755439371683331c4562cfe5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" || auth.identity.selected_subscription_id == \\\"9d79ede0654301ee\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" || auth.identity.selected_subscription_id == \\\"9d79ede0654301ee\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"23b1ef8cd3219264f8227915650891004d0dbf97a799031e0e6e6967fcd5f1c8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fe169ab2014a705a54df2fda4ec719f7132fd6bba54202f7531ce8df8da2bdf6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"5f4fc30622e992160dd04a2ed38f7e44c1794374d6682ae9f1f7ca01be3ee831\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8cb0b0d9cbe25e4182aea7d2ed6f3ca636a7d0c9be364f722b182dde26da45e1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"ca6fe2da7884bdf4da7e4fad467882fb9f7b1a542ef29da25c93b58c0a2facf5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5f8a52baf63f9e4c9ea31b6e22c9076262e33bc06968bbcb213439af05ae3a21\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"4e45e802c43f08adeba0b390be3827705a757991fe469c439db480762890906f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9a7eea6dc0fbfacc7f1b1980a90d1b04de88692dd5758d6a6457477b77a64673\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" || auth.identity.selected_subscription_id == \\\"9d79ede0654301ee\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" || auth.identity.selected_subscription_id == \\\"9d79ede0654301ee\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"0657b3667bafd18f07dc410bc515b76f51256e8c487baf4fe36409a313e6191e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ece9796b491eeaad9788ab6c426bb54d8cbb85433a9010ef2c4d3f579cca0db0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"5b95fd1a3cba680d3078cbfcc3ed349106804d68df9ff279d7829f1ce54c9fcb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3d645f3ac772a0cc5a9a71b4e6a542a2b2ab9962190903cb5d89d3e8e45b7f9d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"d61768c90b21a96135005ba91b0f0abbf7ffc2bd4f372c506a740a4d2280118a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bcf1ddf402fe28df1f45e616a2e2380b51177c45a7f8dcdd03bc2aa6b5814d26\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" || auth.identity.selected_subscription_id == \\\"9d79ede0654301ee\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" || auth.identity.selected_subscription_id == \\\"9d79ede0654301ee\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"0d7aee7ae66dd59feb746b56375d3063a0a395dd032211e5f6fd8a79acc4c534\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4cc208f8f31098b1cdf91b5776a85b52bae0339e659b20995e8ad11208703993\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"d480cd881add8aa6a454eefd0ff4a4f1883e0f31dd0af2c4fc8d49930dfd988a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"096fbc9d544918ac5b9d60464268ef3b1f03546e96ed130c743da74445576f52\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"862991ab77df3e7a553882c71a94c90c8006da4badbb5d62b2523a0c2ae8397b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"228ec96802a09009d984b3728e4e96175fefb32ba2e3b918071e85b3f8ec79d0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" || auth.identity.selected_subscription_id == \\\"9d79ede0654301ee\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" || auth.identity.selected_subscription_id == \\\"9d79ede0654301ee\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"1174da5781e0d01a3f99ec7d577f0c792e9d2f3d97450b0297d625c782aae7c6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6d14c0784badaddad1e95c3697462cedd1c5a5cf32d3a98f16155abc0721429e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"c6601f905085efd63830b0439c759fd2e17f4b3a0625b37e6ca853dfb418a3fe\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"669fd13dfb6f84f6e255bbee071a63253e1d5bd80a372cb6a445299b3c53a1a6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"aae79ba1b6eabe4b8be62d566c21c48755697af6a5a955ca0108115f218409f6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b0bfe3b1d3a080ff25e482046cf0d1df0ca30a090ef9f8424787467410af7627\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"cfedc7f35c0353d53fec0474975ad5e05c19ec8b2ac4718a77f59ccd7fb1233c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b0476fc7cd4ea3306c893f375fa8b815ad5c84676dd8000109732b76fc6c9e7d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"2fc0502446287f4669be2a416f781c0acba21256ff9eb15861862053f18d0e29\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4dcc64ddad4ef375730fe33c8b8925944bf0c1750f66d8a3347219a51dd190d3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"fe7515ad4af2d0fbe432bcf9bb564a76c332dd67819f108c4e0ccd547ada4eb1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a24eea90cd520665ff61391c71ddaf8965158b1b42c4e6f9fe99dd03dfa7c401\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" || auth.identity.selected_subscription_id == \\\"9d79ede0654301ee\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" || auth.identity.selected_subscription_id == \\\"9d79ede0654301ee\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"2036d4e41537afdd08f850cbe0bbe0d23c83b572c0c1f917f2cd718904dfce6d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1cd65b24c576b1e8f7a954fffca2225dfb109bf5a068107003d4f72206723e55\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"909bedc4bbf04ca094fb3d369cf7cb3b15d83ab3e98ef27c04ee79b787659c95\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"be088898c71049f4ea232cae6dd479dfab1a9947fba6b17e7353ce14e639507c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"cfc0c9b5c46987f78f689a5a334275694f4c03653d50c2fbe6e969e238c7f8cb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"03e9bc99c98697160f9a6db2252bc0ba9e88e4ed113a3d5d851256f6cee3dcab\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" || auth.identity.selected_subscription_id == \\\"9d79ede0654301ee\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" || auth.identity.selected_subscription_id == \\\"9d79ede0654301ee\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"642d89c776f69505ff2a885b3a3e0374200ad36c578ca4799ed899b1dc0cf546\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0e0bbf1b6879cb3f68f7ea7f2afda47c74a88c5d3cb97fdf3e110cdc54718649\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"f05bad08945108f9026112e207cee46af50e92faf4445f0e991b27b9412c4c58\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ad6b1369f6065e5d01605f83113ef1c7c93ed4b3fa8d01ad81d870c4a418f675\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"9eb0cbcb37fa43674c71b90f27589d7260b93ced662c1ceb0efe4cb1f91dab4c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4b932ff2b149c42a260b63c5bdd2b0515a398d1964de7381e0735756ee620b8e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"6fbda76757cae53d56b898432e232fb51847f0a1452503c1d53bf530847020ed\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a8ba5320fff14c281f32c2b0a9e757f0e205aace00c294b0d13fa46185724d35\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"8d788326bd35d2b328ba885da80b8eac2f0f1f55930d0bd275aa0c5fd637e227\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0ad1aa31e975e4b569a9617aed9c37982646578e71674b0d96896f60dc232a90\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" || auth.identity.selected_subscription_id == \\\"9d79ede0654301ee\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" || auth.identity.selected_subscription_id == \\\"9d79ede0654301ee\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"c8ee3691fdd0cb6a376274ca4ee98e52cb5718f985d4f539fb764ae6116296f6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0be4b31b8961f89b18ef02b2a56a0b76e7cb0d94a4440a467414ac2d9a504010\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"235df022eefeafa48d660af3720c4cb0c0fec34ddef36d3c467db88f9a57b07f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"69645d92530f5991fb0c1154aa418715dafc9eb9b4b827c33aa742687b00c4fc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"b449a8480f629d5de320a05efeec5a558221dbb03b4dac7572367202e5ec4e3a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"96d049688a520cd26e12f2232f544b815eac1611ab00713e2f641e57b40e5f84\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" || auth.identity.selected_subscription_id == \\\"9d79ede0654301ee\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" || auth.identity.selected_subscription_id == \\\"9d79ede0654301ee\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"bc1544ecfcc1a9c24b532fcd9001124011a4a99e354877a6f611310592c512dc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fbfa7264341556b62c34307c6c836c7e015aeca2df10913c89f8c2d9d38fd28d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"787567c7ebc18db7ec0598b9dbf1466caebf9a1d07f97cfb4afbc3f8bc3fd0e4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"03938d68f68953b697b7b9ec3a9bb3205251dab0d8c28c8488a51872990c74d6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"0d7a95a011dd25d93bb4476331e0b43d38df072b07b758073c5e89ae27e7c6e3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea4599ace477623ac871dedf5650245e6a589cd60cb7c50944431b6bd5453ebc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" || auth.identity.selected_subscription_id == \\\"9d79ede0654301ee\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" || auth.identity.selected_subscription_id == \\\"9d79ede0654301ee\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"06aff6eabb02cda098099e156015c1b3f2389b929e7df774b34188d1589de73e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"463f896d9e9b5a3f2518e764053718a018fbe93828587f90cc4250e5a67a2236\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"88eb8224ce85abcb39e51aee14e03c01d32d86bc4f686e66279e969a1413d263\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d2e0eee1c8e9f13da0b4cd4af8a834f482ac80e1620cc44747922a7c61d6a51b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"203a868aa43281568c0e425caebe830e36d9bb16cabaf6e7dd92722711d4e496\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0dcf2663d1fa4c3fb5056f3703d9d1a316345e3f4ea0e2503f77738258a9e6a2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"c4e555c424bbb24fa529375505443d3163dbb2379b150d3ae00c6689e4123fae\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"29a6e78291fb6eb1600fcc523c35316897713ec3a1f3092074998de0701a2bff\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"220018b07e05f37b279946d5b903a8c5295a21774b20d317b40db4ae44ab089f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea78fba3abdfbae2cfbad8389b4c97d45d924dfb8eebd29422ca7a2b62f9564f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"86fdf51aa1b29a978535560d7a45ad778e5802bfe467d27e1295c743248d1507\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"dcddce6770eda2db3f8f60d8b51b5ed927194e11c56d328f35000b6f5e92dbdf\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" || auth.identity.selected_subscription_id == \\\"9d79ede0654301ee\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" || auth.identity.selected_subscription_id == \\\"9d79ede0654301ee\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"df9a2fd989201e2d0ef8377583b501f9afac6836df894071bbae9e6b6b2598f4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b8e8a49e358e54b12e2aba59e563ba17bcf32315bebde13a721f3b7ebfae18ba\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"742ed2fd7d94f5d252aeaa965657e054bac8691ea31b81375ab8a5488c2f2888\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"327ad026e5a9c61ed15c52c9e2fb0c219e4d9a636a17ed736f525f2b42ebfd6d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"8b45807e9f971b175f77e49aa0f5e281c0245f33f6942f95c36aedfd7d419199\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"59093ab44195ceb3a72fd7400b422644d3d7c840cd3e838bafbbcf827cbcc073\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-0c9014\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-0c9014\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"bde801ad48bcba39a3cf88516077f8fad94dd2ce0692d0f274ab650cb9cc6614\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fbf5e5a312486cd624620a8628b976f89d3b75ffa1d3e47224c08e003294432f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-0c9014\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-0c9014\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"047906c5f7db776a9bd905e481a3347b0c84bd6edf626dc5626ed91115c7408a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cbaea0f78f7b655ed1c234a9fbf7020e12e29bee546d39c314b814aa1692620f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-0c9014\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-0c9014\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"1e414f5eaffdbc43cdaeda8552267e2b46abc1a6b41adfdb24735f3843a9c51f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2ab986aa56245948b966f417e9db684ac2bae70862e05b68a996c57de4d7c4c9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-0c9014\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-0c9014\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"3f61be5c1cb2e788fb6ec123b23519795a5d4fa05fbf9eb842b61931843e1834\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"83f9aef31a325eccb5ee1ca5935289e892a53f7f9d05ac2a6d2b8a973624d6db\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-0c9014\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-0c9014\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"ead8e640f12ec2a2a5b9632dbacd377499d067469c52a5e5c7791f29393639d3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"93867ab0bab47561de7ff57c3a2f54a4e134cfb5a3ee35d78ee703589d669077\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" || auth.identity.selected_subscription_id == \\\"9d79ede0654301ee\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" || auth.identity.selected_subscription_id == \\\"9d79ede0654301ee\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"760f6f0b0f0dfc05ff96616a7ebd6878ae6a8e384823348a74bc46e7ee6e70ab\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"06c24ca69f585351676e3a47fdf7a96df9b9a8fe85641e1c3348c8cfdfe446cb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"2089b2caaee71efefb7e26192d15a3376881340fd07cbc304d192587b50b0c07\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f713c09235fdc689702761ce6f8fb3c2c03ea75f66382e5121160a24cf7aee9d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"78522ace7509d509793c07978801f1f4bab7d64f1ad59df33af972c953cd6851\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6b6f55f762b51c1f46156308a7f509359377c543fd3789f104b3416ff46e3216\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"06aab5232bb89b6e09b9780286eb3fceeee4557f3ea4efd5ede8278ad6c21170\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-worker-w0-0c9014"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-worker-w0-0c9014\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:29:37.354Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-worker-w1-5f765a","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T21:22:08Z","generation":10,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"4caf3c5b-8145-48de-a05b-6a1b9a102f00\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:29:15Z"}],"name":"kuadrant-e2e-worker-w1-5f765a","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-worker-w1-5f765a","uid":"4caf3c5b-8145-48de-a05b-6a1b9a102f00"}],"resourceVersion":"38459","uid":"fb3e4914-c809-4feb-81f5-a0a468b56725"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bcf0aab5299349f1dd1df89a10a558ad5617afdfb0f30d972811f3dbb51b1ea5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]}],\"name\":\"f2c753e74bbc5983406d967abd1143e62400e0f08a2e36f6ffa42c06a3a6974c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/simulator-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"db6f9ff18eeb49f1421400a53d101cb100b1a88466190b46fb6dbed22a42e073\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]}],\"name\":\"eedd7a1bac5c7747d7137dccbdafefbc4f76edb1acf806e0399e7d01c0c93443\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/premium-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0623abc228b11818faa4a08b26d906ef498cb9511f2bcee2bcd7c9e8dbb0a23a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"0a44edd91442d2ddfe39cb24e50368dfc1e81bad179d3235d38e40f25e9d22ae\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"99ce90aab60d81af668145560f9879cd2b5941652fd3e18c3d45856709a0948e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__0c25be51\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"64462ca9eb2f562e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-distinct-2-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__0c25be51\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"64462ca9eb2f562e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-distinct-2-w1-5f765a\"]}],\"name\":\"91d7b5395adff9d28bf7ef05c8e81f9bd73a716e4072d28f8624ff5f9381a8fe\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-2-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bcf0aab5299349f1dd1df89a10a558ad5617afdfb0f30d972811f3dbb51b1ea5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]}],\"name\":\"76a34f19bf7079dd4104caff1731257297b843b61401a91d00b1a27ccab63fd7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/simulator-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"db6f9ff18eeb49f1421400a53d101cb100b1a88466190b46fb6dbed22a42e073\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]}],\"name\":\"263fa7af352a917ec5f565f1287ed3339005bf0c3ba787dcb8a5e539d84cfaff\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/premium-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0623abc228b11818faa4a08b26d906ef498cb9511f2bcee2bcd7c9e8dbb0a23a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"e78483f4191a6de2a454384113672ed5dcab6ca23c10f3e5052c523e46b7a77c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"99ce90aab60d81af668145560f9879cd2b5941652fd3e18c3d45856709a0948e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__0c25be51\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"64462ca9eb2f562e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-distinct-2-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__0c25be51\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"64462ca9eb2f562e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-distinct-2-w1-5f765a\"]}],\"name\":\"601fd1e14b5e1e1044cd1ad2841f6c4703624cbd2a380dedacb373ba7867c1eb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-2-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bcf0aab5299349f1dd1df89a10a558ad5617afdfb0f30d972811f3dbb51b1ea5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]}],\"name\":\"3451d924df135b44fe4e7857db1417971e78cee0d322dc55f2d9dcfc1a98438c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/simulator-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"db6f9ff18eeb49f1421400a53d101cb100b1a88466190b46fb6dbed22a42e073\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]}],\"name\":\"c12741fd641c86bf88bbd47e58d2e5d62933e3e0f320cf13ec7d52df7a394c29\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/premium-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0623abc228b11818faa4a08b26d906ef498cb9511f2bcee2bcd7c9e8dbb0a23a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"7d42ed92cf0df2b010ce6bb7fe8510b6b214aa6493d82bbe3bdd85788b9ced2d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"99ce90aab60d81af668145560f9879cd2b5941652fd3e18c3d45856709a0948e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__0c25be51\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"64462ca9eb2f562e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-distinct-2-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__0c25be51\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"64462ca9eb2f562e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-distinct-2-w1-5f765a\"]}],\"name\":\"89e9e9283f23750b835cfc41e1a3e8f29103f8fe9ceff7e9517fedfa07286e72\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-2-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bcf0aab5299349f1dd1df89a10a558ad5617afdfb0f30d972811f3dbb51b1ea5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]}],\"name\":\"70ba0b522bbd69a6ed9f77952d20b92d482b03854cc92dbb7d522bd33335c96d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/simulator-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"db6f9ff18eeb49f1421400a53d101cb100b1a88466190b46fb6dbed22a42e073\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]}],\"name\":\"65d2403634b5ea32b46b6ea0b85de94e33a3af4a2416095b99fbdb18350add91\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/premium-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0623abc228b11818faa4a08b26d906ef498cb9511f2bcee2bcd7c9e8dbb0a23a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"f16ad623eef6c3389dd02c8e5699fc3224f733fcfdf7f5e04c94d15bb259d565\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"99ce90aab60d81af668145560f9879cd2b5941652fd3e18c3d45856709a0948e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__0c25be51\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"64462ca9eb2f562e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-distinct-2-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__0c25be51\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"64462ca9eb2f562e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-distinct-2-w1-5f765a\"]}],\"name\":\"31f5ec2b96aaa4e6b31984c22b75d9d621a704605d13ed2d59121449937c911d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-2-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bcf0aab5299349f1dd1df89a10a558ad5617afdfb0f30d972811f3dbb51b1ea5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]}],\"name\":\"ba40310e6c4dc6ab4a0b4c712eda89883762afc9beb70d4b7c23b27f69b9ab49\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/simulator-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"db6f9ff18eeb49f1421400a53d101cb100b1a88466190b46fb6dbed22a42e073\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]}],\"name\":\"bd657b2cf110d146eb81bf7b91f3184e0028cf98e5195ef2ddb8f508863741de\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/premium-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0623abc228b11818faa4a08b26d906ef498cb9511f2bcee2bcd7c9e8dbb0a23a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"2f0dfd729a81441e924bd38747be17f316e3b9b9e9528ea0a39238207dd25e7f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"99ce90aab60d81af668145560f9879cd2b5941652fd3e18c3d45856709a0948e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__0c25be51\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"64462ca9eb2f562e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-distinct-2-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__0c25be51\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"64462ca9eb2f562e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-distinct-2-w1-5f765a\"]}],\"name\":\"d373660753c800ef6dc88aa9dcf376944988375525f3908104ef1f83260983ff\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-2-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bcf0aab5299349f1dd1df89a10a558ad5617afdfb0f30d972811f3dbb51b1ea5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]}],\"name\":\"d637ac7d402bcd26ac6f88370d996d05abc8c7982ed2c2cc4095675044806a8e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/simulator-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bcf0aab5299349f1dd1df89a10a558ad5617afdfb0f30d972811f3dbb51b1ea5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]}],\"name\":\"30abcde41a2149187abd00b7dbf1da4982d5f53b5da1288f5b95a0d579abbd6a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/simulator-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"db6f9ff18eeb49f1421400a53d101cb100b1a88466190b46fb6dbed22a42e073\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]}],\"name\":\"e253a93d7a1e997f4ec04774e63bac26b7573119884a469fa9cadfdd694f2c86\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/premium-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"db6f9ff18eeb49f1421400a53d101cb100b1a88466190b46fb6dbed22a42e073\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]}],\"name\":\"857e58268f515ca3e78ba5dd4b121c1c64a1556ffa6fb72ca451501f13fd956c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/premium-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0623abc228b11818faa4a08b26d906ef498cb9511f2bcee2bcd7c9e8dbb0a23a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"d6e34b9866f1888f862664b06edada2fc5b06428a00da8529b16758a3eda81bd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0623abc228b11818faa4a08b26d906ef498cb9511f2bcee2bcd7c9e8dbb0a23a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"d8a7afed6f125f1efe48eb9763d5f6da06382ed5c648453e53d16207a819a353\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"99ce90aab60d81af668145560f9879cd2b5941652fd3e18c3d45856709a0948e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__0c25be51\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"64462ca9eb2f562e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-distinct-2-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__0c25be51\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"64462ca9eb2f562e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-distinct-2-w1-5f765a\"]}],\"name\":\"4e6de9db11e4f53c670f806b7f8fa9eef7623d7a93fac0088e6bc4808c690024\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-2-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"99ce90aab60d81af668145560f9879cd2b5941652fd3e18c3d45856709a0948e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__0c25be51\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"64462ca9eb2f562e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-distinct-2-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__0c25be51\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"64462ca9eb2f562e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-distinct-2-w1-5f765a\"]}],\"name\":\"e4a3e27b6d899463b5db743e92f4f3eea337802f422e60f3725234174543f7ad\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-2-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bcf0aab5299349f1dd1df89a10a558ad5617afdfb0f30d972811f3dbb51b1ea5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]}],\"name\":\"c06ce02686be6c949fde11dd46005249ce969a6a4cd5979e062f2fd0e328306e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/simulator-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"db6f9ff18eeb49f1421400a53d101cb100b1a88466190b46fb6dbed22a42e073\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]}],\"name\":\"a5c2e2f330e8d4b7f1cc2fd43eb290bf161724714abfed900324fd2909e2a064\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/premium-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0623abc228b11818faa4a08b26d906ef498cb9511f2bcee2bcd7c9e8dbb0a23a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"f32d2c346b05e35d553dca7fe2805eee4c7886686071be499c78e95d284e8bd5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"99ce90aab60d81af668145560f9879cd2b5941652fd3e18c3d45856709a0948e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__0c25be51\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"64462ca9eb2f562e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-distinct-2-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__0c25be51\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"64462ca9eb2f562e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-distinct-2-w1-5f765a\"]}],\"name\":\"6f1d479dd9b2c444c7bbd9d0b29aa4d86c30e494765ff79074f52d3018d29503\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-2-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fa1a008e4957943b0d2d9d600bd19dafc0caa0b522e5c1d1e09ecc5d82a64f4c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-5f765a\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-5f765a\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"b218feb88b60257514445a8b1d44e3ab1edb938de3bc6d6fdb02ef04222c6dcb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8614fe473acb7380c1bbcefbfc7ddc49bdb08a20998450fd852a13de53bb8a12\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__0c25be51\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"64462ca9eb2f562e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-distinct-2-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__0c25be51\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"64462ca9eb2f562e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-distinct-2-w1-5f765a\"]}],\"name\":\"5340f589ec7e8ec67c1190312eeca907b744df43dafe4398f0722d074bfb32b9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-2-w1-5f765a/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"58ba249888c7ebfedfcb5aec9df19d4b07d2856710ac2163dcc961a176311fa9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]}],\"name\":\"4d61c78710f351b5667f692e1f8792c5724b52f7fc998511134665312fdd896f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/simulator-w1-5f765a/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9fa5392cc7c0130bb8596420fcb1a79f07b3d804fb9e4de459f680cdcfd5dcfc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"b1d7cdd38dbaf49bd08c0343391886f319979629ab66d478079771f78f733a35\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-w1-5f765a/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2aaf9242e876623422852fe471269a2d268f4d784b14c7ab37ec9f34c17f3060\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]}],\"name\":\"f201dec897e559ed36b9a30f0bbf86c43aae129e674ef36595083bda93e4b839\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/premium-w1-5f765a/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"36a5aec7d5b7178c754711c0ad90ec391fbc4764ff98bc952ff9d4d46a3e1fad\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__0c25be51\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"64462ca9eb2f562e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-distinct-2-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__0c25be51\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"64462ca9eb2f562e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-distinct-2-w1-5f765a\"]}],\"name\":\"e1ac9296595d90737d084f76147f4acec9440f2802b7b4ad18409fe9de33bb5e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-2-w1-5f765a/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c19827aa458f939a86c4dbefda3dabc4f554898dbb7e2f92b488060e9e90b5cc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]}],\"name\":\"6d546403540eabf244c73a602659986050165bca90bc795de701a61411a1c48e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/simulator-w1-5f765a/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"922492b3fb118d2a03b9019d5fd7a1e7fc6f7f5e4559c5e1a0ef89b6f41e6c00\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"5cbb9e2f75cce25ddb3c2b6eb86ac94a59b3619ba9df40d1b5dd3580109ca3cc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-w1-5f765a/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"37f7dad0ca5234ce11642187ba11e681aa288a9b2a62a6d47b06de5fa5c385ed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__0c25be51\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"64462ca9eb2f562e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-distinct-2-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__0c25be51\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"64462ca9eb2f562e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-distinct-2-w1-5f765a\"]}],\"name\":\"ec08733aeb0db1141aa8a8a511c7859111cf54e374fddf2e382a4616e38a9f7d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-2-w1-5f765a/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"784ccec783ba11c98817fe5af2849f9f4970be19046e351a067c85add913f548\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]}],\"name\":\"9327d3b7df136b8c0fed4aaa35057ac8d1022305472875ccc8c55a524105fb1a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/simulator-w1-5f765a/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"beb0d5e916dc078abcaba4ea5b4d8012d5c2d8edfd07ca54d585bfe44d7c605a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]}],\"name\":\"8cff0046c214e842687a3a284fe4fabc8a45eb2579168ac47aa1b4908bd95fc4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/premium-w1-5f765a/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"39a9f89f974929e5c36b7ca16af0fe122642ef82605ca091ecae9f1aab1c8c39\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__0c25be51\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"64462ca9eb2f562e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-distinct-2-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__0c25be51\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"64462ca9eb2f562e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-distinct-2-w1-5f765a\"]}],\"name\":\"633ba07e8fd8d505f7f6918d4c95117ed7435ee10e97f4b5b67ea8fb88d406a9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-2-w1-5f765a/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5bc63b4c1a02d51f1462172790f7018aec7db9fb8a2a61024ca7c15aac9065b4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]}],\"name\":\"2bdf38e0b22608328672d2ed39e7a6336f89c14fb615a48fda4a36a65c185b32\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/simulator-w1-5f765a/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6ceeddb720a82c7a3a1051f6517a47c73f8528f97b9e67d8dd2f7dd9419967e1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"73c4b3ba76c71b5ac2b369625b3de4081ddfaca2a924b7a8741f70090acba47b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-w1-5f765a/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b8fb7aae7cac121f592817a5e9754983e04e46d9e4226183153bf83b778fffdd\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]}],\"name\":\"b288a64704f96ac78878f6909232d8598eef54cca0d7adc2629cac87b6802414\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/premium-w1-5f765a/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8f0923ad4223ef053267784d904817130eaaaa279092e9f9f1500d0325c2e6a7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"127ad269f06b6d28319f2bb527c4cb8c00c67080e95ba7a4c5aae51849cf6881\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-w1-5f765a/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9f6fc629fa43de74b0fb261de7e8b46fbdfe4f21235446879cd916210856d6f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]}],\"name\":\"3345e3b0c95bd559e9c6ce41f622270b0d9eed1deb3d862eb2d4fad368905626\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/premium-w1-5f765a/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4afb168c7cbb67555e268bc246b8eeeba53cda69691eb181663c1375ab099775\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__0c25be51\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"64462ca9eb2f562e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-distinct-2-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__0c25be51\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"64462ca9eb2f562e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-distinct-2-w1-5f765a\"]}],\"name\":\"c917df68cc69647c025db7eb577471c675040ae5aa7ec4537927ac6f148031ea\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-2-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"719394d8154dd624eedc306180a33baa4128531f223bc2727d0376601dd634f6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]}],\"name\":\"94c5946d9d9c3cc245ba073b8c7a87c64029cba185e4d624d2145ef119722e87\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/simulator-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6cbb9b4408bb48fa5c471c9684ef41f50ebbc4e85135af89ff2781ab48666f2a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"7aaa0a43baf33eeaf52534a90f734bbc375ee8f202c1994adc991d076f599c57\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"796ce8085bd3851fe6a6d0c9b4c29504c70e44da1ae3ea663bfc85d308b1e5b1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__0c25be51\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"64462ca9eb2f562e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-distinct-2-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__0c25be51\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"64462ca9eb2f562e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-distinct-2-w1-5f765a\"]}],\"name\":\"d7eb7b84f6936309cd84db740a6f755286a5345ec159a7046e2c3f3126780262\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4139e076413d5d9d1fd2b594b83d854cc771dfa28886f3f67439ec043220dd9f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]}],\"name\":\"0b53b3ab98bfc66b662cb3ccde6535694ee9e681e165e011925491f011e74e55\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"505545a95fce131db80f848e9990387e6b3e42a2f7e2375f56bbc07efcac9723\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]}],\"name\":\"3f3727d24e2cdb2256f9ce1aa9d7daf02e123ff83dd7745a54bf0be968b8f9fd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/premium-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bd641664cfab5eecac33b1ff0c46f78597ed896bbc4c7a81487d56141be11715\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"c6d9f4f268ffd7b969efc4b42666a18e7b4e74fa0efcee36ff06291b64cdd07f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9112a3b536f3eb5f79a5b52d0ee8a7a26d3700b295f3ce2775128d2841f01ff4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]}],\"name\":\"f08d8256a9bbcb38779e30702529b4c292d4f2775e4ae9817b47fa8337570bcb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ddbb47f4f9dda290c11f442f07feec9b2e64a236ec2c98dd4fb16a3796302ba3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__0c25be51\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"64462ca9eb2f562e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-distinct-2-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__0c25be51\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"64462ca9eb2f562e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-distinct-2-w1-5f765a\"]}],\"name\":\"fb5e9f944ff60517f890fed5aa51a590589ee84870b6b00ffb1d187e035ed1c3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0768841c9057075fe648e2fa67028e1fc0bee839efdd3e78e081dac6a9e13397\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]}],\"name\":\"2e7b2a851ead1f1cbcc5f6106eac7e445acafba2c4c4ad4a5a56639d6af03796\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7f1003cf42290c9494548cc907c9d6b31f90160185f5f9a729a625709fd1fb40\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"7de1fcf03a98bd9434df66c8e2bbabb8a6758cfd8b4c1bc07707e0cd17f3a70b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b7e1694df51b77341405c6097e6d1487bf70a48e8a95816d2cfc62e5ddd6a999\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__0c25be51\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"64462ca9eb2f562e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-distinct-2-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__0c25be51\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"64462ca9eb2f562e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-distinct-2-w1-5f765a\"]}],\"name\":\"e45d437fabc94b7146571bcd5ac6f2fee56e43a9f023c9e1e15d67d077bb0cff\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9178bfcf79bd6f1164069b245bef389ffaa38dddce2763e94a3e39d83454aa7f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]}],\"name\":\"2e3472e08ab25f673a6a47899dd2756fa7246fcafa45a33d1cfbd451f1a6da2b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"106dc24382c96b56f69df1e4bfaa0455678809d57faded1081bc4e26a642d4a0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]}],\"name\":\"922243bc7c6610ec5ba0285d821a4e92cf6386c7e495914f5a3fe8f9160a0647\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4ff864a27b8c6cdd9a746e87a7d53b4055daacec9650360ef6d48d5964395d3f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__0c25be51\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"64462ca9eb2f562e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-distinct-2-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__0c25be51\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"64462ca9eb2f562e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-distinct-2-w1-5f765a\"]}],\"name\":\"b6f9cb2cdae82e814be4f1c67b0c2f3da01ef6645a272400a2fe7577eb5815ff\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0b8fd96f5e30886bce6ea837ac57b2f3d77783c525b1de469227d248ca2a1d6e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]}],\"name\":\"9ad77601cac881a53e95a12cc3d1e21e0beee1d4e9757eaa68fbb36f70dbe5e2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"dc6825eadf840da0185447dcfb22803683fc39051aa637aea7a66d081b192bf7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"4ed033a41f89a0f23149658aeb2f5cbe79d4d5b179ddf0addaf56898cfb91f45\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e1e7c7c242c339c99da1caa3f217a7bd53ffc78a71bee9a0e898d1f0b8471fb3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]}],\"name\":\"00a6f26194c6932f8037cd0201f950c67a9b8fbee2e5ed3817f9a97812c711c2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b0ee4efc66d9a6e357c482407ac7794ac3e2e51168e28a743b633a36b12f1489\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"4f607540ea8ad5f65e31b3b8bf068f37a827d58181018c53d169b4c83e69fc48\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c4c89ab332c30b38dc4f16ef73fecdbd0ef26ff23424b1e8fd0d18c2d45cf73d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]}],\"name\":\"892cea79034a9b0e44e5d14d2ace5c60fa5e183f87a7ffb536724af7425a469d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6ac0410a29c97032cc673c8f56fb055dcd84c1040f73657459b7f1183a6ef131\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__0c25be51\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"64462ca9eb2f562e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-distinct-2-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__0c25be51\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"64462ca9eb2f562e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-distinct-2-w1-5f765a\"]}],\"name\":\"777413beddd80a2dbe7efbaba4adc804e5a12db4f911e0e22a0ea59643cf8a40\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9d278f3acef96193a8d6a95bb17fda6beacb6c6949e61147bbb0a9f984d383ca\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]}],\"name\":\"c89ebfbf5d6c50d68e0202a4a7f2450fb6de7656dcb639d8a2d40d475718ebc7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8e06ac6cbf5999144a3b0f3b2584acaac3b4eb8d03d892bc45e03712448c4a9c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"e52e079eb305353b58c669f26348af185ff2ff22d378b7c80663f6bbaa04aa50\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f7254b99580aca11d813d05cebe8fd0d083eab4978ed55c24131cbd3917e5e39\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]}],\"name\":\"a5339e879056a8880ff59d0bd2b4a470fa93075d67e5851ae7b49fba2bef41e6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a2866a5a08cd0abaabb645c82aff8b6635fdbd34410a7b092e32a8b164086e19\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-5f765a\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-5f765a\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"cc60bc0276d07b9216150b4bc6b21e75f85bf16c7cf27ea44774f135d5d03080\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b651c6e6a372a592c9723851c4377c52eae8778a18d51a17e65b611b0b04e077\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-5f765a\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-5f765a\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"3c78a568a81450298f63da5aa6923258e0adf684426ab83ceb35e01cf96e31be\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e206eae15f3c87b50ca80d04704d63fdf1ea76a805ec0dff6aaf8552207a1be8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-5f765a\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-5f765a\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"2b06fb39c490ea09b70252ff358244737d19e14a20470f0c43270d8a8d663698\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2ce874ebffdc76810fc3c080f4a7068ce8f4e9a05d63e70150e7fc6ef281b797\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-5f765a\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-5f765a\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"4ea6ce64f8c082ae7ad14a6cda98b463639b3ce9f3c1fb4c0f89d8e025314dd5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a2db302be0c4963be9b2d68075376d29342d2e854fa4746701662a56823b450e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-5f765a\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-5f765a\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"c252574ae7fb8eaff36f49460a23a178a025ecce5b05cd990eb6d87e58fc178a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b6a8f91d1ffdf775c75f2a1c84bb520696572aea4d3ece8ed9123766f347b2eb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]}],\"name\":\"7edb3db3dee9ba3102857080aca6e9bec53bbe738951ad9a83ba0cb19f036f1e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/simulator-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"eadff6644620dd26a92e8dd1076b97db8fef2224eb03b70ce4e7ee1ef8dc0b30\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]}],\"name\":\"41b87dde831c23a98bbe55369e4882c3bfbc1b8dcecce6cd22b590fe3e2fd450\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/premium-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b4056adace047bf2186763869c2f6a0524a9534ef874733d3868dfd41db1a7c9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"bc833d07dbe8f000644c82cba26ec9f2ce483a0cd86141971709f215bd14e019\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"98aca426d9ec5ae558219406a36e9375b2e6291ddc5e73bd3960b21edfe258cd\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__0c25be51\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"64462ca9eb2f562e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-distinct-2-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__0c25be51\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"64462ca9eb2f562e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-distinct-2-w1-5f765a\"]}],\"name\":\"8e27ae43b5f0896611602b3ee9b020104ca8fa9588c510a3aa8b4c406a47912b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-2-w1-5f765a')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-worker-w1-5f765a"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-worker-w1-5f765a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:29:37.509Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-worker-w2-6fa533","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T21:21:58Z","generation":11,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"350cbfc3-ae8f-47d8-bf88-3bc797a06de4\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:29:14Z"}],"name":"kuadrant-e2e-worker-w2-6fa533","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-worker-w2-6fa533","uid":"350cbfc3-ae8f-47d8-bf88-3bc797a06de4"}],"resourceVersion":"38450","uid":"e9c29fe8-1b7a-4730-9bc2-e4f3e80147bd"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2538346ffaabe171687c406d12f294530661f7690a04d14ab2327034447b1886\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"fc3c7a9daa18c716699d2f1fa233a5848a5d36cd60feee59a35bb57159d77252\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"df8548d2a100989756489c2811783626f3836ef18d08ba8c81bfb6b9e9ef9c28\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"983a86a79f65831a149f35f3c7673bbfb37560154023198d82ebb8965ed48c8e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/premium-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"13cb74b6bdfe9b2af39effc13c9d5ade5172cb10a5930c6aefbe733c0ab0cad4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"462645ad06b45e6f5c9824c64f8ebc4010534cdeadc425c4ab2c9b0594a88a7d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b565990bc269af90f4e0533dedaf97fc37dc70b037af910a7605358eda2713f5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"b369d9c3b4e9e1fbdb75c9e353f7e25f066823d31fb733c322ac2192463d58e1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-2-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2538346ffaabe171687c406d12f294530661f7690a04d14ab2327034447b1886\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"53b8e179280ac5286bf38489ea72372b11c85a8c387359bf689ebecff1663d36\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"df8548d2a100989756489c2811783626f3836ef18d08ba8c81bfb6b9e9ef9c28\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"c166f75566a6849f94f19ff1eaf52bbfeb65e132db0ce99439215a5fba3cf50f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/premium-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"13cb74b6bdfe9b2af39effc13c9d5ade5172cb10a5930c6aefbe733c0ab0cad4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"2eb901a322f6f85745b1b216f71a9aeaf7eef69af5cc7ad9aead13448f127634\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b565990bc269af90f4e0533dedaf97fc37dc70b037af910a7605358eda2713f5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"fae945183d4744cfc72f99d3814545646a9a87e750465f9b67476229ff21e62f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-2-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2538346ffaabe171687c406d12f294530661f7690a04d14ab2327034447b1886\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"89b4eca3220447cd92c83c9c71f9e61e645c1f746a07d9b87eac9b2d4af27f2a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"df8548d2a100989756489c2811783626f3836ef18d08ba8c81bfb6b9e9ef9c28\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"82b649105e404b52dbe59777c528effe8ddcaf390c919bc52a045d6654c17d27\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/premium-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"13cb74b6bdfe9b2af39effc13c9d5ade5172cb10a5930c6aefbe733c0ab0cad4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"0491f04b3838b4a997ad42c2f3b87b5bc525f5236ef6a51647a0af61e52bf52d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b565990bc269af90f4e0533dedaf97fc37dc70b037af910a7605358eda2713f5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"e160eef909b8d94a314732c333511d40579117e325a0f92347c702a5ee49c702\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-2-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2538346ffaabe171687c406d12f294530661f7690a04d14ab2327034447b1886\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"0f54f971c3b78f7352580f77fc5be3e00c2117ef445b417be77bf67ea75539a5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"df8548d2a100989756489c2811783626f3836ef18d08ba8c81bfb6b9e9ef9c28\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"616030c276c95a5326d811265a5516c30019307d032046e4dbf9c60aed89bb9f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/premium-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"13cb74b6bdfe9b2af39effc13c9d5ade5172cb10a5930c6aefbe733c0ab0cad4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"60974e3173a2c5fa225357d66a1c4055fbb2b76b845de70e5504acc58902d471\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b565990bc269af90f4e0533dedaf97fc37dc70b037af910a7605358eda2713f5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"18b6544f1fecef176364e89f35a905f48ff233680f0d7e6adfd1caf2b5f57048\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-2-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2538346ffaabe171687c406d12f294530661f7690a04d14ab2327034447b1886\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"6982a3a190cf8786b034f1d39a14b07dab2e5311ed66344e600b389726798c72\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"df8548d2a100989756489c2811783626f3836ef18d08ba8c81bfb6b9e9ef9c28\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"d8b01a7d8bf17be310055802641797f595c1e7290b01b91e2b87cf0300418b94\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/premium-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"13cb74b6bdfe9b2af39effc13c9d5ade5172cb10a5930c6aefbe733c0ab0cad4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"28c14a49b36fb1c2749324536c3bd478da8cea176c30e855a8c62d376476a248\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b565990bc269af90f4e0533dedaf97fc37dc70b037af910a7605358eda2713f5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"d42afd956ea2d4dcd0f0aaadc1669934e404dadfe3651ba4498df28db6f58683\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-2-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2538346ffaabe171687c406d12f294530661f7690a04d14ab2327034447b1886\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"87456404dc6fbf2160a52ba615889680b0c5cf40dc6100bb0e888288606dff25\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2538346ffaabe171687c406d12f294530661f7690a04d14ab2327034447b1886\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"8b9c2ea6de06bba9ed1ba2a65e99d1500ef45630a372914ecf445da73d74600a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"df8548d2a100989756489c2811783626f3836ef18d08ba8c81bfb6b9e9ef9c28\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"9222b1bebeb91f5bc797ef6f55e59f628b5f90c3da7305c7a50abb490cf18e24\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/premium-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"df8548d2a100989756489c2811783626f3836ef18d08ba8c81bfb6b9e9ef9c28\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"63ba67de9ead24d6aab10a349447139ea4c7227426ee6072b8939e91ccf0ed30\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/premium-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"13cb74b6bdfe9b2af39effc13c9d5ade5172cb10a5930c6aefbe733c0ab0cad4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"b23898184efef7f96fc649e5d2902d9e6f7d32805be8858eb5f57e88696a09d3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"13cb74b6bdfe9b2af39effc13c9d5ade5172cb10a5930c6aefbe733c0ab0cad4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"652be1bab4f56953c3da93778aeff670b21e92a5d993934466d89aaed158b5b6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b565990bc269af90f4e0533dedaf97fc37dc70b037af910a7605358eda2713f5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"e11de01e8f11e362fe12a9bcc574088487751f93b5de75b1bd8c99739acc40b0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-2-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b565990bc269af90f4e0533dedaf97fc37dc70b037af910a7605358eda2713f5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"4672868f1e2492bd2ac79be6374bbac36317364afff96ce0c9c7ac3d568f0b14\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-2-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2538346ffaabe171687c406d12f294530661f7690a04d14ab2327034447b1886\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"d58c446a6a9364595eaae0256bc0befa6f57ed0387674ac1d6970632cb6b41f0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"df8548d2a100989756489c2811783626f3836ef18d08ba8c81bfb6b9e9ef9c28\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"6e120ade3c6d3506708dea5d54e9bc2fd6306ec4718a0c11f9c0a89c0ea6f1cd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/premium-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"13cb74b6bdfe9b2af39effc13c9d5ade5172cb10a5930c6aefbe733c0ab0cad4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"f9f60e3c0c3c06fefd218a3662bf2dac472c1d5acfd112579332b16c2386f504\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b565990bc269af90f4e0533dedaf97fc37dc70b037af910a7605358eda2713f5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"6f55ce1a1c1254c42ba8a4204eaa5d732a42974a08d182b225b6ac98681f141a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-2-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"79e41416d85afbda9f192c421571f899a58b4937465fe640fd4d17dfb0d8240e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-6fa533\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-6fa533\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"af109b5290beff4991ef93d4a835ce24ed3b0986578fba7947a76ca1a6dd65e2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c17d6c6438d8754832a843b7a082fa7fc719ecd30696a3551f3ca815dd52f28b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"fcc5f235388ea2c13a59ae86bacfc4eb4fab79468e3ee8c91a602bb5eeeec1c9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-2-w2-6fa533/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8abe3e629bd34674437803d6e54a0cb90fe0d0df12d2eac23f0b40d2f4990b37\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"ccb67df939c7a3278e2bb82db8d5dc418650599ab46b4bd1d8fe07cf9bb459d0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"371e486415502802484cc345e68be13e0a37a1abb38f2f6c8cce9f8e79b8d9c1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"b41e21a5fb7ad8cd75dbaa2def82137084248aef58468ce3d04ebccec2987b3b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-w2-6fa533/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8f50bf1a21545f68eb583e07935b8b0da52bbc4743a8bc67c4d9545b76da56af\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"7206c2870629f698a99d45c9e7140cc1334b531b1ad5a3c88c147fac40e793b2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/premium-w2-6fa533/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d4fbd382871bb4f5406c37842f4848012cdca0b01e2d7698dc28e396dc18659d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"4924ec7c564baa67e51d989aa281cf4421dc82ba2910dd5cbc5e8ec66fd31e46\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-2-w2-6fa533/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"503064d3f84a23711f1dad5e35d11ef1efceaefb2204608d180ef8d886666ffa\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"1036f7f4f8b7c68faa7a499350cf496a96528b515b125a726c7e904d5297c1e6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e199374b1d053d8a1ea2fb463b47f0da1b100cb9029acd61282384f0bb2553a2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"fc0e1b2816287c18a95319a2d0a9379a9f7bf931fff586f75645e37973bc0009\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-w2-6fa533/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b3a9fbda204f0b6bfe85682d0fee9fd7a9712977e22af554d2d82ba07f1a075a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"e94cca1d60d77f1db698aae8d99dc62d60279b8e5de4556def17f51ea3d8b77b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-2-w2-6fa533/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"41e99bc62a2ac4e8034135f4b655088597f627c66b2efc4627394d148bc2b0ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"b2fa16adeef96749257d873656ef49327fe454d7ba806ae3a8a73ec44c8a092d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2f2531e01fa8fc0031706fadbba0c1818c30681dcf9d2c65b1c7c23230ea3a32\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"d04838d25723911d554e0017a035ebf67253923630681f27a1c93b44878b1bcc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/premium-w2-6fa533/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7be093b94c77d8e466548a812b2fd67ba6e4cdbef2e705474d1a124d26a40f56\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"89ba01e718f4b0e60188b8031e9bd1e3cf1d64712b57d397151cd36a5d6214df\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-2-w2-6fa533/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f1edf5f89fd287762fbbefa668581cdc8f1877a3f31497227c537000670166d9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"dbf8e642e7e029e70e317d8df7b5d12be0fc1f008d29ff415d7291c09924eecb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cf13f5a3da5f1ddbc441422b55ececcb0ffd227c7be1c942dc1d4c428387bca0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"0aa6387a836e4d80af5fd5a2d66846f1a40192a89e137f80c52334aa6d868a1c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-w2-6fa533/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"afe9746e0af749da011756561a859419e447efc535f5e3f3773b1d18a5b5a9ac\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"7ae7a5b24207da4f6cb3659a8b6639f53e96a876f02aaa1f0a8b92813f856ad7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/premium-w2-6fa533/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"739e19d51d8fbdeccfc8bc7587afd12132239f688ec6cf8d9586f242a71087f7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"5f4124bfb1cf4c49006c1e2d45346f89a11b72e563d9f8e2d4df054bb65c496c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-w2-6fa533/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8309dc44d5088e48040255bf86dbc622de08fc216837cd0027a69bdf179a9d2a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"206d678ecc5400943db26abb21afd48a2ffc6fee651aa73c8301a56858221aa0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/premium-w2-6fa533/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8f577e4cdeda37406cbf43b607fe4ff7a6bd85c0d3b2c53a45b82a9207f437f9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"7cdf48530943053e434f696a48871881d26809d6cd1a88e8b6daa617fd34d36f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-2-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"206e50a9b0e5f83281f994d9f1d85f92406e3544297c47017c081f763b10dd96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"1d9b68bda9fa73e5f8e8ac869771d602c5f128903fd22e64db2370f9749a3113\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6ed7710bfd4535612b60aefac40ff2eebbe50fc666cc75f29a23130bdd6ea269\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"1245658c93fce9ced820408e5e090ae4dd51a7c56161a6cfb1ef978beecc3557\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"313f15eb64d50822c9c91871179d7a6ffa3111f658f213fdc0612575f480add7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"eb5df92dd93dfd3d0bc54e95c455fd8d583232e993ed8aed3db80f624312b066\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"62457e23e29ce9b4e8380d685c5e9e84bc5137e91486a6f9c1c9e352ca3a021c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"957121ddf9ee4c2793cec71a8576e07ee1925a201f93c8de02b6fce446d010d8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1ce9b189744d237515a1896d038a3437e8e31669b01937d8cf3a067728ee7e82\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"672be8f3fbaf802659dc395e46e1b17c7ab1515e557eab74f4c7d2c055ad4cf7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/premium-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"881b63d46f0e94053b88caefbfd71fdab183199879cb564ccb3671b6189fcc2e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"4e3e10829c680ef4fa33002314a596e964d519ea2f3cd6331d666a22cfb597e5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0947683a63afc3251194a3b586cb934b1350dcaa171c4fd826d6773a00d5cf2a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"88202ce79ddf6dca9b8c8b1fbc0aa013155bc9975075ee9158a09c6708287af4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"66eb2a66302c20c8061f062df1542c7ad1db513c8b1988f81768f7d266f6665c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"64c175753cea5698cd255c8a903061deed215a3afcc403ae39f57d7b0f7600be\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fd7deaf8530c822c1b10ef4c1b0887086bc840af6d5c7a730508ddcb6e179095\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"14655ca6105b9121c6e780127a21626d2e779082f0ea2674b0d77647d247a24c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5ea067858e444716d33ddecbe718b086e12804ce72bba0a6f135b64fb1bb1c60\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"c88bc53da3544fc41175edc07ced29960aa58c4f7ebf17609eb30f993b862ccf\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"828fe179b1caaef8c4abb4ba71cbe53ab31fc04108a1194889605dd8100c90f1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"f249401e68d6dcd41e2325910ee9db0254c3afa92a19923e1751980966a4694d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"60ca770315801fd35b67ab23639ba4ac6a344fcf95fe492c267cc87cb90ce14f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"d7f0af7e7ca785bc5de89e740ff47459e16eb3ba9360c1eee59d6d8d2f7389bd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6d6f6c08f92b4cefaa6a997643ec612cf9c62df4fa750dd0f5d4c3d50d40d2bb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"daf823a39b0f169fe5f258178380bcf0b3e996152ebcc401fb21de178f041b24\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5cddd3e1918c7df14f710eb09cebc745d043be6f81e6c1e1f2a3803e2f0c6513\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"b1d5e4fa434bbb80c0f5baf3d8ee1797394841413a8f28625f4e0c9d2388764b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1f83c46a7c87c216ad3b7a3697a1ad6c518cb36972a910efbc3c7eed6ab3956a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"496ec6213c84428bc1374936695dcb9246c04c80a4460a92e53220e4641a7116\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e701c3e95fd6d7e3e60b9f162039289bbc904c42df899db9436b6ad7538d1ffc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"576f13852617450ef4f108d2d8c65426c74c6f743bd5e3d6530d746e72633fbc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"25cb748ea88f201b192c863c4e2fb40e5931cd9cfed0d04ae104e35dbe48f38b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"c49c039641c1cdbec2a8f5cc805b4b722943e1336d082080571a2f2fcb073186\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ad04b751b35d313ca76c5057f5e800aa0d5504bc27298aa1762dd803d351bff2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"a24ccfd407372af3bd4160c32a086ddd01bc5d92e15a1f783cdc3f7d8f642124\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3ecbc6560d7cb2e5396471349d24b95ff664f3b33dfc188e590c2b772721287c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"2e058e1b6b4635806a5e2b8fb08fed6fd11db7595be6907f89a86777a30aa9b5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f27c742360d050f8cfba473367fd8076f0a6abdf57b30c6116d8b1fa7559bcc0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"b7571ee2e0ac1a2c804f33ccb2108d7694841ff5c0b7595435bea59672db0c41\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"319a8bd03b55a51284dd6790058e026879ed8db3e6d527dedb4a9314473afa5b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"ac54aac970a6722b49c3410bffc6b58a3832c579aa7c3629ff80507ab769f2d3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8be72fdf7a1e6b1379ac7dc12f7c40286d882ef14376e9fd3e726b2fb781546c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"ac78bc480a068b655886c2d9dd75e3a680756398111216d2be7e8a3e730e4206\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"23d2f913b5bde1ed64144a38680e6282220982f4f5ea1167fabdda3234dbc67e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"c6c6e62fb02ec82dd2ad63c3690b3887e0701c293e1871ee382d92ea80f88f66\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"51e9e3c7450b52b22ca45c280738926226df3d95852d8df43ff47cf85cca9e5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-6fa533\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-6fa533\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"64fb7512cad2bf5a1c9b6978a7f9de714d5a739282aa9ca951ee3b4f417da286\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"dfa08453b9c8623db01e432dea4f9e09b3d7f80cbbee3a69df753c6d3fbfbded\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-6fa533\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-6fa533\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"af2b1c5e2c0a798508b2ef3249c778b1b43898c8636c878f66d20c220701a6f4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"517c7132d716e14e14b2c9fccd696f86bc7a24a46c391e71d07ac910d0dd1c18\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-6fa533\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-6fa533\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"ee9f66c18cbc8fcbae62d62e57dcbad633d943ff04a829fbc8bb030c121bf426\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b93afde66771848b5188f78e530f2f596324f9fb9f05b2dd8f1cb49489f2bda1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-6fa533\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-6fa533\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"c514ea15546ae0041f8d77a7e65bd51a98d808edee2739e914353f03c270d86d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"de3ca7c8a9dcdebe0c2a67b74b3bc72bdc4a8f34aff1f0c69df675fbb03b1e05\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-6fa533\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-6fa533\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"985f90a1588b57b9e2061e7440127c4729ab98e674bb91d1e90364de9aea35ad\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"edbbdcfc920b88151941be1a4c41ad8be6a38bd6beddae7387db202bc3e9b302\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"15153104d9c89c44b59d96d9d8825fe62d21af5bd4db90b6c300fa53823a0ef0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bf3fa706be871596c50143869f253e98ce7aa463d723d2f419d378a041dbfbe5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"4e925c4610a758f575689b807fc7a61cef2c3891e2cf0a1c1074186e65a2e8fd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/premium-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f09ce0bd9bc651317469310c8a604d792e7c7c55751d184a920638cf66ba0dd5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"499fc57e7a454d5bcd94feeb06b43584bb9133eb048e9ee5f20041a16d87ebaa\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bc33498b2dcdc2f8d2612aa17c0e640458a4442c9d7f2ad45303aeb15b5bccb9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"7ad42a3389048956d61fafc75400a2a68540cd2e35da26f1e7b80db45868f7dd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-2-w2-6fa533')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-worker-w2-6fa533"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-worker-w2-6fa533\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:29:37.865Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w0-0c9014","namespace":"e2e-models-e2e-worker-w0-0c9014","uid":"4f647df6-1d5b-433b-b4fc-1279ff1755f7","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w0-0c9014\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:29:38.101Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w2-6fa533","namespace":"e2e-models-e2e-worker-w2-6fa533","uid":"3a128bb2-de88-49aa-ab9e-c8626107a077","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w2-6fa533\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:29:38.456Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-distinct-2-w1-5f765a","namespace":"e2e-models-e2e-worker-w1-5f765a","uid":"edd2d53d-48c1-4c12-afc2-a1cbebfe773e","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-distinct-2-w1-5f765a\": StorageError: invalid object, Code: 4, Key: /kubernetes.io/kuadrant.io/tokenratelimitpolicies/e2e-models-e2e-worker-w1-5f765a/maas-trlp-distinct-2-w1-5f765a, ResourceVersion: 0, AdditionalErrorMsg: Precondition failed: UID in precondition: edd2d53d-48c1-4c12-afc2-a1cbebfe773e, UID in object meta: d874e5bc-086e-49b7-8479-63c6ff45b7cd"}
{"level":"error","ts":"2026-11-02T21:29:38.829Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"distinct-w1-5f765a-kserve-route","namespace":"e2e-models-e2e-worker-w1-5f765a","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"distinct-w1-5f765a-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:29:39.143Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"data-science-gateway","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"data-science-gateway\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:29:39.203Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-worker-w4-d6cb38","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-worker-w4-d6cb38\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:29:49.165Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["EnvoyFilter","ConfigMap","TokenRateLimitPolicy","Gateway","AuthPolicy","Limitador","HTTPRoute"],"eventTypes":{"create":5,"delete":1,"update":11}}
{"level":"info","ts":"2026-11-02T21:29:49.404Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:29:50.947Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:29:51.024Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:29:51.024Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:29:53.172Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:29:53.176Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:29:53.232Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:29:53.236Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:29:53.236Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:29:53.237Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"error","ts":"2026-11-02T21:29:53.348Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:29:53.348Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T21:29:54.649Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-distinct-w2-6fa533","namespace":"e2e-models-e2e-worker-w2-6fa533","uid":"63e7ecd2-1e5f-443e-8faa-52695d3c0588","error":"tokenratelimitpolicies.kuadrant.io \"maas-trlp-distinct-w2-6fa533\" not found"}
{"level":"error","ts":"2026-11-02T21:29:55.604Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w0-0c9014","namespace":"e2e-models-e2e-worker-w0-0c9014","uid":"4f647df6-1d5b-433b-b4fc-1279ff1755f7","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w0-0c9014\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:29:55.665Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-distinct-2-w1-5f765a","namespace":"e2e-models-e2e-worker-w1-5f765a","uid":"d874e5bc-086e-49b7-8479-63c6ff45b7cd","error":"tokenratelimitpolicies.kuadrant.io \"maas-trlp-distinct-2-w1-5f765a\" not found"}
{"level":"info","ts":"2026-11-02T21:29:55.998Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:29:55.999Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:29:57.264Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy"],"eventTypes":{"delete":1}}
{"level":"info","ts":"2026-11-02T21:30:00.851Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:30:00.857Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:30:00.858Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:30:00.858Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-02T21:30:00.934Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:30:00.934Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T21:30:01.629Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-worker-w1-5f765a","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T21:22:08Z","generation":11,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"4caf3c5b-8145-48de-a05b-6a1b9a102f00\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:29:30Z"}],"name":"kuadrant-e2e-worker-w1-5f765a","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-worker-w1-5f765a","uid":"4caf3c5b-8145-48de-a05b-6a1b9a102f00"}],"resourceVersion":"38927","uid":"fb3e4914-c809-4feb-81f5-a0a468b56725"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bcf0aab5299349f1dd1df89a10a558ad5617afdfb0f30d972811f3dbb51b1ea5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]}],\"name\":\"f2c753e74bbc5983406d967abd1143e62400e0f08a2e36f6ffa42c06a3a6974c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/simulator-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"db6f9ff18eeb49f1421400a53d101cb100b1a88466190b46fb6dbed22a42e073\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]}],\"name\":\"eedd7a1bac5c7747d7137dccbdafefbc4f76edb1acf806e0399e7d01c0c93443\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/premium-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0623abc228b11818faa4a08b26d906ef498cb9511f2bcee2bcd7c9e8dbb0a23a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"0a44edd91442d2ddfe39cb24e50368dfc1e81bad179d3235d38e40f25e9d22ae\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"99ce90aab60d81af668145560f9879cd2b5941652fd3e18c3d45856709a0948e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"91d7b5395adff9d28bf7ef05c8e81f9bd73a716e4072d28f8624ff5f9381a8fe\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-2-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bcf0aab5299349f1dd1df89a10a558ad5617afdfb0f30d972811f3dbb51b1ea5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]}],\"name\":\"76a34f19bf7079dd4104caff1731257297b843b61401a91d00b1a27ccab63fd7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/simulator-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"db6f9ff18eeb49f1421400a53d101cb100b1a88466190b46fb6dbed22a42e073\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]}],\"name\":\"263fa7af352a917ec5f565f1287ed3339005bf0c3ba787dcb8a5e539d84cfaff\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/premium-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0623abc228b11818faa4a08b26d906ef498cb9511f2bcee2bcd7c9e8dbb0a23a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"e78483f4191a6de2a454384113672ed5dcab6ca23c10f3e5052c523e46b7a77c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"99ce90aab60d81af668145560f9879cd2b5941652fd3e18c3d45856709a0948e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"601fd1e14b5e1e1044cd1ad2841f6c4703624cbd2a380dedacb373ba7867c1eb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-2-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bcf0aab5299349f1dd1df89a10a558ad5617afdfb0f30d972811f3dbb51b1ea5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]}],\"name\":\"3451d924df135b44fe4e7857db1417971e78cee0d322dc55f2d9dcfc1a98438c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/simulator-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"db6f9ff18eeb49f1421400a53d101cb100b1a88466190b46fb6dbed22a42e073\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]}],\"name\":\"c12741fd641c86bf88bbd47e58d2e5d62933e3e0f320cf13ec7d52df7a394c29\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/premium-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0623abc228b11818faa4a08b26d906ef498cb9511f2bcee2bcd7c9e8dbb0a23a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"7d42ed92cf0df2b010ce6bb7fe8510b6b214aa6493d82bbe3bdd85788b9ced2d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"99ce90aab60d81af668145560f9879cd2b5941652fd3e18c3d45856709a0948e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"89e9e9283f23750b835cfc41e1a3e8f29103f8fe9ceff7e9517fedfa07286e72\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-2-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bcf0aab5299349f1dd1df89a10a558ad5617afdfb0f30d972811f3dbb51b1ea5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]}],\"name\":\"70ba0b522bbd69a6ed9f77952d20b92d482b03854cc92dbb7d522bd33335c96d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/simulator-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"db6f9ff18eeb49f1421400a53d101cb100b1a88466190b46fb6dbed22a42e073\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]}],\"name\":\"65d2403634b5ea32b46b6ea0b85de94e33a3af4a2416095b99fbdb18350add91\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/premium-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0623abc228b11818faa4a08b26d906ef498cb9511f2bcee2bcd7c9e8dbb0a23a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"f16ad623eef6c3389dd02c8e5699fc3224f733fcfdf7f5e04c94d15bb259d565\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"99ce90aab60d81af668145560f9879cd2b5941652fd3e18c3d45856709a0948e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"31f5ec2b96aaa4e6b31984c22b75d9d621a704605d13ed2d59121449937c911d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-2-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bcf0aab5299349f1dd1df89a10a558ad5617afdfb0f30d972811f3dbb51b1ea5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]}],\"name\":\"ba40310e6c4dc6ab4a0b4c712eda89883762afc9beb70d4b7c23b27f69b9ab49\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/simulator-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"db6f9ff18eeb49f1421400a53d101cb100b1a88466190b46fb6dbed22a42e073\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]}],\"name\":\"bd657b2cf110d146eb81bf7b91f3184e0028cf98e5195ef2ddb8f508863741de\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/premium-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0623abc228b11818faa4a08b26d906ef498cb9511f2bcee2bcd7c9e8dbb0a23a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"2f0dfd729a81441e924bd38747be17f316e3b9b9e9528ea0a39238207dd25e7f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"99ce90aab60d81af668145560f9879cd2b5941652fd3e18c3d45856709a0948e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"d373660753c800ef6dc88aa9dcf376944988375525f3908104ef1f83260983ff\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-2-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bcf0aab5299349f1dd1df89a10a558ad5617afdfb0f30d972811f3dbb51b1ea5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]}],\"name\":\"d637ac7d402bcd26ac6f88370d996d05abc8c7982ed2c2cc4095675044806a8e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/simulator-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bcf0aab5299349f1dd1df89a10a558ad5617afdfb0f30d972811f3dbb51b1ea5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]}],\"name\":\"30abcde41a2149187abd00b7dbf1da4982d5f53b5da1288f5b95a0d579abbd6a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/simulator-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"db6f9ff18eeb49f1421400a53d101cb100b1a88466190b46fb6dbed22a42e073\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]}],\"name\":\"e253a93d7a1e997f4ec04774e63bac26b7573119884a469fa9cadfdd694f2c86\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/premium-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"db6f9ff18eeb49f1421400a53d101cb100b1a88466190b46fb6dbed22a42e073\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]}],\"name\":\"857e58268f515ca3e78ba5dd4b121c1c64a1556ffa6fb72ca451501f13fd956c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/premium-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0623abc228b11818faa4a08b26d906ef498cb9511f2bcee2bcd7c9e8dbb0a23a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"d6e34b9866f1888f862664b06edada2fc5b06428a00da8529b16758a3eda81bd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0623abc228b11818faa4a08b26d906ef498cb9511f2bcee2bcd7c9e8dbb0a23a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"d8a7afed6f125f1efe48eb9763d5f6da06382ed5c648453e53d16207a819a353\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"99ce90aab60d81af668145560f9879cd2b5941652fd3e18c3d45856709a0948e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"4e6de9db11e4f53c670f806b7f8fa9eef7623d7a93fac0088e6bc4808c690024\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-2-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"99ce90aab60d81af668145560f9879cd2b5941652fd3e18c3d45856709a0948e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"e4a3e27b6d899463b5db743e92f4f3eea337802f422e60f3725234174543f7ad\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-2-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bcf0aab5299349f1dd1df89a10a558ad5617afdfb0f30d972811f3dbb51b1ea5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]}],\"name\":\"c06ce02686be6c949fde11dd46005249ce969a6a4cd5979e062f2fd0e328306e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/simulator-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"db6f9ff18eeb49f1421400a53d101cb100b1a88466190b46fb6dbed22a42e073\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]}],\"name\":\"a5c2e2f330e8d4b7f1cc2fd43eb290bf161724714abfed900324fd2909e2a064\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/premium-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0623abc228b11818faa4a08b26d906ef498cb9511f2bcee2bcd7c9e8dbb0a23a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"f32d2c346b05e35d553dca7fe2805eee4c7886686071be499c78e95d284e8bd5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"99ce90aab60d81af668145560f9879cd2b5941652fd3e18c3d45856709a0948e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"6f1d479dd9b2c444c7bbd9d0b29aa4d86c30e494765ff79074f52d3018d29503\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-2-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fa1a008e4957943b0d2d9d600bd19dafc0caa0b522e5c1d1e09ecc5d82a64f4c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-5f765a\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-5f765a\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"b218feb88b60257514445a8b1d44e3ab1edb938de3bc6d6fdb02ef04222c6dcb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8614fe473acb7380c1bbcefbfc7ddc49bdb08a20998450fd852a13de53bb8a12\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"5340f589ec7e8ec67c1190312eeca907b744df43dafe4398f0722d074bfb32b9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-2-w1-5f765a/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"58ba249888c7ebfedfcb5aec9df19d4b07d2856710ac2163dcc961a176311fa9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]}],\"name\":\"4d61c78710f351b5667f692e1f8792c5724b52f7fc998511134665312fdd896f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/simulator-w1-5f765a/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9fa5392cc7c0130bb8596420fcb1a79f07b3d804fb9e4de459f680cdcfd5dcfc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"b1d7cdd38dbaf49bd08c0343391886f319979629ab66d478079771f78f733a35\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-w1-5f765a/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2aaf9242e876623422852fe471269a2d268f4d784b14c7ab37ec9f34c17f3060\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]}],\"name\":\"f201dec897e559ed36b9a30f0bbf86c43aae129e674ef36595083bda93e4b839\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/premium-w1-5f765a/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"36a5aec7d5b7178c754711c0ad90ec391fbc4764ff98bc952ff9d4d46a3e1fad\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"e1ac9296595d90737d084f76147f4acec9440f2802b7b4ad18409fe9de33bb5e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-2-w1-5f765a/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c19827aa458f939a86c4dbefda3dabc4f554898dbb7e2f92b488060e9e90b5cc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]}],\"name\":\"6d546403540eabf244c73a602659986050165bca90bc795de701a61411a1c48e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/simulator-w1-5f765a/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"922492b3fb118d2a03b9019d5fd7a1e7fc6f7f5e4559c5e1a0ef89b6f41e6c00\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"5cbb9e2f75cce25ddb3c2b6eb86ac94a59b3619ba9df40d1b5dd3580109ca3cc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-w1-5f765a/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"37f7dad0ca5234ce11642187ba11e681aa288a9b2a62a6d47b06de5fa5c385ed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"ec08733aeb0db1141aa8a8a511c7859111cf54e374fddf2e382a4616e38a9f7d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-2-w1-5f765a/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"784ccec783ba11c98817fe5af2849f9f4970be19046e351a067c85add913f548\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]}],\"name\":\"9327d3b7df136b8c0fed4aaa35057ac8d1022305472875ccc8c55a524105fb1a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/simulator-w1-5f765a/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"beb0d5e916dc078abcaba4ea5b4d8012d5c2d8edfd07ca54d585bfe44d7c605a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]}],\"name\":\"8cff0046c214e842687a3a284fe4fabc8a45eb2579168ac47aa1b4908bd95fc4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/premium-w1-5f765a/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"39a9f89f974929e5c36b7ca16af0fe122642ef82605ca091ecae9f1aab1c8c39\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"633ba07e8fd8d505f7f6918d4c95117ed7435ee10e97f4b5b67ea8fb88d406a9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-2-w1-5f765a/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5bc63b4c1a02d51f1462172790f7018aec7db9fb8a2a61024ca7c15aac9065b4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]}],\"name\":\"2bdf38e0b22608328672d2ed39e7a6336f89c14fb615a48fda4a36a65c185b32\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/simulator-w1-5f765a/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6ceeddb720a82c7a3a1051f6517a47c73f8528f97b9e67d8dd2f7dd9419967e1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"73c4b3ba76c71b5ac2b369625b3de4081ddfaca2a924b7a8741f70090acba47b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-w1-5f765a/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b8fb7aae7cac121f592817a5e9754983e04e46d9e4226183153bf83b778fffdd\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]}],\"name\":\"b288a64704f96ac78878f6909232d8598eef54cca0d7adc2629cac87b6802414\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/premium-w1-5f765a/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8f0923ad4223ef053267784d904817130eaaaa279092e9f9f1500d0325c2e6a7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"127ad269f06b6d28319f2bb527c4cb8c00c67080e95ba7a4c5aae51849cf6881\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-w1-5f765a/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9f6fc629fa43de74b0fb261de7e8b46fbdfe4f21235446879cd916210856d6f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]}],\"name\":\"3345e3b0c95bd559e9c6ce41f622270b0d9eed1deb3d862eb2d4fad368905626\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/premium-w1-5f765a/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4afb168c7cbb67555e268bc246b8eeeba53cda69691eb181663c1375ab099775\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"c917df68cc69647c025db7eb577471c675040ae5aa7ec4537927ac6f148031ea\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-2-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"719394d8154dd624eedc306180a33baa4128531f223bc2727d0376601dd634f6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]}],\"name\":\"94c5946d9d9c3cc245ba073b8c7a87c64029cba185e4d624d2145ef119722e87\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/simulator-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6cbb9b4408bb48fa5c471c9684ef41f50ebbc4e85135af89ff2781ab48666f2a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"7aaa0a43baf33eeaf52534a90f734bbc375ee8f202c1994adc991d076f599c57\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"796ce8085bd3851fe6a6d0c9b4c29504c70e44da1ae3ea663bfc85d308b1e5b1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"d7eb7b84f6936309cd84db740a6f755286a5345ec159a7046e2c3f3126780262\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4139e076413d5d9d1fd2b594b83d854cc771dfa28886f3f67439ec043220dd9f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]}],\"name\":\"0b53b3ab98bfc66b662cb3ccde6535694ee9e681e165e011925491f011e74e55\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"505545a95fce131db80f848e9990387e6b3e42a2f7e2375f56bbc07efcac9723\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]}],\"name\":\"3f3727d24e2cdb2256f9ce1aa9d7daf02e123ff83dd7745a54bf0be968b8f9fd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/premium-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bd641664cfab5eecac33b1ff0c46f78597ed896bbc4c7a81487d56141be11715\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"c6d9f4f268ffd7b969efc4b42666a18e7b4e74fa0efcee36ff06291b64cdd07f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9112a3b536f3eb5f79a5b52d0ee8a7a26d3700b295f3ce2775128d2841f01ff4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]}],\"name\":\"f08d8256a9bbcb38779e30702529b4c292d4f2775e4ae9817b47fa8337570bcb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ddbb47f4f9dda290c11f442f07feec9b2e64a236ec2c98dd4fb16a3796302ba3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"fb5e9f944ff60517f890fed5aa51a590589ee84870b6b00ffb1d187e035ed1c3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0768841c9057075fe648e2fa67028e1fc0bee839efdd3e78e081dac6a9e13397\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]}],\"name\":\"2e7b2a851ead1f1cbcc5f6106eac7e445acafba2c4c4ad4a5a56639d6af03796\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7f1003cf42290c9494548cc907c9d6b31f90160185f5f9a729a625709fd1fb40\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"7de1fcf03a98bd9434df66c8e2bbabb8a6758cfd8b4c1bc07707e0cd17f3a70b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b7e1694df51b77341405c6097e6d1487bf70a48e8a95816d2cfc62e5ddd6a999\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"e45d437fabc94b7146571bcd5ac6f2fee56e43a9f023c9e1e15d67d077bb0cff\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9178bfcf79bd6f1164069b245bef389ffaa38dddce2763e94a3e39d83454aa7f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]}],\"name\":\"2e3472e08ab25f673a6a47899dd2756fa7246fcafa45a33d1cfbd451f1a6da2b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"106dc24382c96b56f69df1e4bfaa0455678809d57faded1081bc4e26a642d4a0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]}],\"name\":\"922243bc7c6610ec5ba0285d821a4e92cf6386c7e495914f5a3fe8f9160a0647\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4ff864a27b8c6cdd9a746e87a7d53b4055daacec9650360ef6d48d5964395d3f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"b6f9cb2cdae82e814be4f1c67b0c2f3da01ef6645a272400a2fe7577eb5815ff\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0b8fd96f5e30886bce6ea837ac57b2f3d77783c525b1de469227d248ca2a1d6e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]}],\"name\":\"9ad77601cac881a53e95a12cc3d1e21e0beee1d4e9757eaa68fbb36f70dbe5e2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"dc6825eadf840da0185447dcfb22803683fc39051aa637aea7a66d081b192bf7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"4ed033a41f89a0f23149658aeb2f5cbe79d4d5b179ddf0addaf56898cfb91f45\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e1e7c7c242c339c99da1caa3f217a7bd53ffc78a71bee9a0e898d1f0b8471fb3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]}],\"name\":\"00a6f26194c6932f8037cd0201f950c67a9b8fbee2e5ed3817f9a97812c711c2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b0ee4efc66d9a6e357c482407ac7794ac3e2e51168e28a743b633a36b12f1489\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"4f607540ea8ad5f65e31b3b8bf068f37a827d58181018c53d169b4c83e69fc48\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c4c89ab332c30b38dc4f16ef73fecdbd0ef26ff23424b1e8fd0d18c2d45cf73d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]}],\"name\":\"892cea79034a9b0e44e5d14d2ace5c60fa5e183f87a7ffb536724af7425a469d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6ac0410a29c97032cc673c8f56fb055dcd84c1040f73657459b7f1183a6ef131\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"777413beddd80a2dbe7efbaba4adc804e5a12db4f911e0e22a0ea59643cf8a40\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9d278f3acef96193a8d6a95bb17fda6beacb6c6949e61147bbb0a9f984d383ca\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]}],\"name\":\"c89ebfbf5d6c50d68e0202a4a7f2450fb6de7656dcb639d8a2d40d475718ebc7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8e06ac6cbf5999144a3b0f3b2584acaac3b4eb8d03d892bc45e03712448c4a9c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"e52e079eb305353b58c669f26348af185ff2ff22d378b7c80663f6bbaa04aa50\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f7254b99580aca11d813d05cebe8fd0d083eab4978ed55c24131cbd3917e5e39\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]}],\"name\":\"a5339e879056a8880ff59d0bd2b4a470fa93075d67e5851ae7b49fba2bef41e6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a2866a5a08cd0abaabb645c82aff8b6635fdbd34410a7b092e32a8b164086e19\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-5f765a\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-5f765a\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"cc60bc0276d07b9216150b4bc6b21e75f85bf16c7cf27ea44774f135d5d03080\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b651c6e6a372a592c9723851c4377c52eae8778a18d51a17e65b611b0b04e077\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-5f765a\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-5f765a\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"3c78a568a81450298f63da5aa6923258e0adf684426ab83ceb35e01cf96e31be\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e206eae15f3c87b50ca80d04704d63fdf1ea76a805ec0dff6aaf8552207a1be8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-5f765a\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-5f765a\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"2b06fb39c490ea09b70252ff358244737d19e14a20470f0c43270d8a8d663698\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2ce874ebffdc76810fc3c080f4a7068ce8f4e9a05d63e70150e7fc6ef281b797\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-5f765a\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-5f765a\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"4ea6ce64f8c082ae7ad14a6cda98b463639b3ce9f3c1fb4c0f89d8e025314dd5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a2db302be0c4963be9b2d68075376d29342d2e854fa4746701662a56823b450e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-5f765a\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-5f765a\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"c252574ae7fb8eaff36f49460a23a178a025ecce5b05cd990eb6d87e58fc178a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b6a8f91d1ffdf775c75f2a1c84bb520696572aea4d3ece8ed9123766f347b2eb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]}],\"name\":\"7edb3db3dee9ba3102857080aca6e9bec53bbe738951ad9a83ba0cb19f036f1e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/simulator-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"eadff6644620dd26a92e8dd1076b97db8fef2224eb03b70ce4e7ee1ef8dc0b30\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]}],\"name\":\"41b87dde831c23a98bbe55369e4882c3bfbc1b8dcecce6cd22b590fe3e2fd450\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/premium-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b4056adace047bf2186763869c2f6a0524a9534ef874733d3868dfd41db1a7c9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"bc833d07dbe8f000644c82cba26ec9f2ce483a0cd86141971709f215bd14e019\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"98aca426d9ec5ae558219406a36e9375b2e6291ddc5e73bd3960b21edfe258cd\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"8e27ae43b5f0896611602b3ee9b020104ca8fa9588c510a3aa8b4c406a47912b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-2-w1-5f765a')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-worker-w1-5f765a"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-worker-w1-5f765a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:30:01.953Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-worker-w4-d6cb38","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T21:21:30Z","generation":10,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"36c0d6c0-4ad3-4739-8e18-24485ab1bc48\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:28:55Z"}],"name":"kuadrant-e2e-worker-w4-d6cb38","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-worker-w4-d6cb38","uid":"36c0d6c0-4ad3-4739-8e18-24485ab1bc48"}],"resourceVersion":"37845","uid":"2255fc2d-ab48-428d-86a8-4726b25b244c"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7f9f489fba4cc345dba07951f043d704ea999478c1da34cd23037357dcdf1384\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"f61d2b7d2f64f1d64a2dcee70f47ce24c9c6eb4854589984128561c58f6171ac\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"12f3d170c629c434ef1558f623819a2294b75940427c1164b50933cdad3fb52f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"4d6b2e7d73dcdd0567dbe7811fffb6b677ae17a404dd4e000e5586417b4abff9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"af01177c39cc2acfc81deb8fed1e1062fd6125232da28da32592d4c0fd546c97\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"c66c5829a3315f16b0f26dd5daed466c5b2b261235b86bfb98043e96d7dd9de0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"16e9561ee4c6deff2fa31e8a5aec69ff1b5c963a2bd79d3413890752338a808c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"85bbc444688b414fd85af5d3f6532006d93d40793700cdf48cc119eb12135602\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-2-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7f9f489fba4cc345dba07951f043d704ea999478c1da34cd23037357dcdf1384\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"5b984da304c827646ff112362de545fa451a799e7f6999eac00f25f038606c2a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"12f3d170c629c434ef1558f623819a2294b75940427c1164b50933cdad3fb52f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"ad40721e9bd95807ea332811f94d79eb07b9dd045127a232886a7924332cbc73\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"af01177c39cc2acfc81deb8fed1e1062fd6125232da28da32592d4c0fd546c97\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"9190216f349b0595dc54d5cad3f429f840bbb0e4a2c199f4f2c79134aeb92beb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"16e9561ee4c6deff2fa31e8a5aec69ff1b5c963a2bd79d3413890752338a808c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"4447ac687428f773a4b67c9b5c06c6a0359aeee3ba2dd093ddd5af4018b5d896\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-2-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7f9f489fba4cc345dba07951f043d704ea999478c1da34cd23037357dcdf1384\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"b91256531abbaaf08ed45e4a93b53e9af9ebb53002123196214bb374517e81f0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"12f3d170c629c434ef1558f623819a2294b75940427c1164b50933cdad3fb52f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"597cf592078ae14c96f33099e96fee363339bedb2f5d430fdd69e28e8be2a8ff\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"af01177c39cc2acfc81deb8fed1e1062fd6125232da28da32592d4c0fd546c97\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"165316669577d87085504ec32756c6d6d67f595b2690025965232ab07a1da412\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"16e9561ee4c6deff2fa31e8a5aec69ff1b5c963a2bd79d3413890752338a808c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"b868f10bd5b40e8919994fca53311146eef16ba432d05144082d631a9418e83a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-2-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7f9f489fba4cc345dba07951f043d704ea999478c1da34cd23037357dcdf1384\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"490344715bd8708a2d31131fc3b4e370beef7eb7d9942ba89fc82080284e6244\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"12f3d170c629c434ef1558f623819a2294b75940427c1164b50933cdad3fb52f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"aeb99e2df9a1951917065c7b887084431b3e62a6f4d47287af43193676a5b8be\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"af01177c39cc2acfc81deb8fed1e1062fd6125232da28da32592d4c0fd546c97\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"76f141d8a065403b5c0a2fc7e2c76ce1301f93b13d91fd2078e5f2b4d2280197\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"16e9561ee4c6deff2fa31e8a5aec69ff1b5c963a2bd79d3413890752338a808c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"fb58ee2926965a2dcd5e496ba51d76076fbac1dbb0faeb6aaa8849736beb98ec\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-2-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7f9f489fba4cc345dba07951f043d704ea999478c1da34cd23037357dcdf1384\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"fa28a7ae652b865919d1ff4c61fd33bb8512d3139af38d1ceb9697a99e63cc6b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"12f3d170c629c434ef1558f623819a2294b75940427c1164b50933cdad3fb52f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"601d68ffdf7137fde779cf41214f1c74f63e6b717be0b7aad1eb56041a2d9b76\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"af01177c39cc2acfc81deb8fed1e1062fd6125232da28da32592d4c0fd546c97\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"b7d42066b553c2d03aee2da38514171a14e8ae8d343c0fda8f80d3265343c45c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"16e9561ee4c6deff2fa31e8a5aec69ff1b5c963a2bd79d3413890752338a808c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"157f8deef4224451e2a5d831c8369a39aa3b418062c8767a9f84de3947b7356c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-2-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7f9f489fba4cc345dba07951f043d704ea999478c1da34cd23037357dcdf1384\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"2dea78ba3797dedd7edd7b687182785345cfd95029e2131769c5797e3b752eb5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7f9f489fba4cc345dba07951f043d704ea999478c1da34cd23037357dcdf1384\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"cdb3a0c564011d63952f137daa521c84f02a66f8a75696ef9ac4f1f2cc9ea8c9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"12f3d170c629c434ef1558f623819a2294b75940427c1164b50933cdad3fb52f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"e019089f573a8879defa7fdce139828725d9f042c5a4dc9974b9185a8a382c51\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"12f3d170c629c434ef1558f623819a2294b75940427c1164b50933cdad3fb52f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"6a08c6dd0c7522c09a18466dfa733eb68e8c593cdc8d2890ccff2f5c9064fcc0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"af01177c39cc2acfc81deb8fed1e1062fd6125232da28da32592d4c0fd546c97\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"6f15db2f827c7eda1ecbf154277f01be4351cb08f525fa50ec0da278253b6d6b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"af01177c39cc2acfc81deb8fed1e1062fd6125232da28da32592d4c0fd546c97\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"5a27a9e4c9daab234151b3ade5f24a8f9f235443ec26586cc0a883b4ca237233\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"16e9561ee4c6deff2fa31e8a5aec69ff1b5c963a2bd79d3413890752338a808c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"1589c12ca11e6544f2b7072121804f185e5630b2cdcfa71c0561af4619194727\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-2-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"16e9561ee4c6deff2fa31e8a5aec69ff1b5c963a2bd79d3413890752338a808c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"1faaf26cba48036c2d95bf76257bcd6baf769ac5e6eed0a8964eec058af259eb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-2-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7f9f489fba4cc345dba07951f043d704ea999478c1da34cd23037357dcdf1384\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"31c0c96d54839068517aaeb062676423451143447943cafff7ee595d9fd1feca\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"12f3d170c629c434ef1558f623819a2294b75940427c1164b50933cdad3fb52f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"aebde4a102828558eb0fbde9709268d7adabc75fadf451c730e0573c086e2f07\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"af01177c39cc2acfc81deb8fed1e1062fd6125232da28da32592d4c0fd546c97\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"87ed1d3b3cd1e3027869c6fc197828ccea328c7f84e2acdf7e06e70b8842fdd7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"16e9561ee4c6deff2fa31e8a5aec69ff1b5c963a2bd79d3413890752338a808c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"d90c0faa5819af99665a29bf35d18a090fc213efb27bcb06e9cc9c8a2be3094c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-2-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a69bb45bad035c53dd8c7176828b1cc26d0c9d3f775d2059034b1639ca1b49d8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"79db77eb448edf55b65761a293f7f6fc07c9d4365912f7a8595364cdbf33d994\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"94dcd05ea37e3629c540245bc47fd87fca3f73a8e2994ead89bda609cefca74a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"f682bdd564171974ac50af1b79bec8319fb070d4f9ff054872e07f0bb5970828\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-2-w4-d6cb38/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e5e9b9fa41efe7f56f3ea6e9079d12a9f3e89cd596105815b30b04ba7ba1281b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"9b7cb9a28ed2fc7fdfa23c7d8d869cc573e3e72423805bef3f945a77d2785710\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"32a498b3029fba046b39d6c26d52ecb2de8f74b942f2d122b45240b1a839deae\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"7442c06fdbee3ca35e62201bfc1ded73b46ccce5d6905e07f6a1792cecd8bc10\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-w4-d6cb38/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"dff7a596e1042978304d40238abe84063cc499f4a6a2f9def85e7c84d1df1ebc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"4ebe0e741886c221cfcd8d1126bcb3535dcbe15c7f802a713d3b2ceb8cee37e1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ad3bad78fb2ca1b68182c777555c2a07f35742a0dc28e73d65c173489bf20bfe\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"adeaca08e9f8fd42fe69e77eee49140cfd5715eac018c5601b0d3378d917d2ce\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-2-w4-d6cb38/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4db1dd6250896b02d5f97b90471902db72d349ea082f211b7b5e4046c827d477\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"9e4cdffa79635674b661188290cd9c853017f5721accaa1f268edc6c6b7f2590\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1f3d6ce43ced512267c700bcaefac5fe1e5a0f56279d9c49efc4ca04e0d03518\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"a9a34f579b60868ec0be5a14bb835a3898e0c43fe25650166ed2178248bbe1f9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-w4-d6cb38/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c7906cc8021baa6797dfa1978c7ce78b494865d95b66f59ca1cd380376b5fba9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"6ae22229709f702a5686121e25321b1ca57a9a38cb7380c3cbc347a36b32a2f4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-2-w4-d6cb38/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8ea982efbe7afcd4f8dbaa4e864584b38ec852971d686ed11c87e99f1b9f4f9a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"1ed83021e2408187ee74cd1a66732d37b92c80d46439951ce5e0f654f1542381\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7d8b4229a4e8df0df0b627da5317c526c045e2ab5837161d638a7835193820d5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"36ee8c63f509519eef9ec6e2c257745b647d322586f8289611274ca06f90ec11\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"33871c6a0ae4feae1469b537cc1ea6bbbd60286eed4edf3f6b041e5ca65d4b23\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"44c4b2971f379de31e5b1b9aa432f9a0e14ca85e20312f6967c9581de8fe5e23\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-2-w4-d6cb38/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2c4b4abb753457c4ad4bd5815f6ce55723fcfcf44f298a47923e03e51d023a49\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"3ce9856de6f3b95cc2ed4fe4abeef13ecb59b5b1ef0102b858e5d3ec0d8afa89\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"99a01d66d9ba32727c09707b61669b110b150d8025da9291ae815b1d8e07454c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"77ec05cc7c773a3540c71498b5777588286f6a84b1595d80c4f1634ded3def93\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-w4-d6cb38/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7fdbd59414185d321c56439c757d9c725c67465b49a83a52b935fdd9c5f0df82\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"2eb3ad4b5e4be8080b2e0309815371172455a7e5f61cf9c3c595f17e99e6f681\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c806bf2d4d850ded382b88489831427afef078ecb67dd4c920a1355d1453a2f9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"ac190091ad6e540c35613b81dc40071b56f4f92355769f89e35c56f588a5f040\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-w4-d6cb38/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bb82cce53996fd9a50a4f33832b37ff599d227ab91d54895bf0ab989d1eb0b01\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"138b7da9a4ea2091f7b13106ba292672e2ca1d22138b32de717b07cab221eebc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9ba6421c13373b029e319749dfcc66205cba71509d9781aae6bc20029ca16a7b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"64d8cc6534e1f2b54595d10cceba7274e4820b1bc4cc4a0f7fffbb2bb61304a9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-2-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7ebdbd5a6be861834fc366408f369ad8f021dfe8f061cbc93334bc801f3df98f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"be4080fc1058816edd779c6c2b40a1657320a89a6a86b4ff7358026a6adb2e23\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6d3e7a9a4b4298310e0bfe2e3cbd62aec91a573c07d02cbee9db82354ce9ae45\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"8cc4fab950417e53f8887a857eadcd63e5254ca90ce535ac8312884267a353f5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b69fcfecbff8a7db20373884ddd2ca22e39f7a814dfc0946441bf6dc7f369a4d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"b2ed152f8ee7914ee5d821eac3bce97f229c18d303b8bf53e7c6d08dbd946a69\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a6e80d640d49da44f2b60f9db62279137aa6839ed5acbca6493b96977b1f3f9b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"b470ad22bfeca185d9d86c6a107cdea6e62f1aaf494ef31244de0d30052bbcfc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b1fdba63ead328fd43c505e06394bc2adb7e5e2dfb0a1e55ef2c41d8f345142f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"30a1d05fede91486be251352bb7291a36ac69d50b6fce18433612afe29f1b4b1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f333a7db2a4322946ba06e577de4e4465e1174fb5cc0bb60d8d97ffd9018dc4b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"ee6bf02baeb9e28323dc2d9fa206cb2ed963925f778322eed091490229b29e9e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f2655bcd7b6a7d3d8a4479c1c943c5f2b4d4fbb7d96408fc7ce07c4e7bd9f30c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"12835533e58f43762872e20b92b523339a9de435dc7d0f689b42133b367fae44\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e99af4c913dc9844409b7c31f2f26b7f80984fdcc4a30c1de535a7a3435d0ae8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"c9d5a4401f4154088ac8ced8673158a379ae2073a1dce32a0504c995271c0e88\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"309f6b916a61539853033efc6ca2e083c01c99e5b96f857a7c78b89f9816f598\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"788f4c0f9a4e5a97247c2043b8125cf170fe6674c40d873723dc972c4d5d93af\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"68beb50e573f7f8f729255a19248728f937beeab700e92bcc9c0a070e602e982\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"26447c99384ffe81ccfc09fad9c33ffe60c6796933a9e2734b738ff5de8c664b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6060eef24f1f9e109ceaa90837578da0e77128864be44cea71a6e4d056f6aed1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"075d582681ff3e0d68d4a835d43bc72dd6bc492d9a3ca8b6dd3ef470e6b6946d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9a1afd5e20de63bb2c85d93c9c3fd7aae15a0f45cb6e07dc467b8063b97decee\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"4c928eaa593596b5c3719a02958892d193943b2129a32e43035c896d93b232c1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4b5d6544ef7fd39f49a5af0551f4a404b0a5f49df3054a95306b7f797216c599\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"8773bca7122a801a4f199775b03693ad30e316ffebea5bcaf72af079bf14f24d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c5c4680765cefb123f1033aa2b612856432a81adb7bccb16df753674ddd4a42e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"cb4b2a4191c8a55c17ce5101bc78ca33035bffe16815d6ab6f63b4fa3147b68a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3474cd3af51b646106406cc4778f6a5608fdc62b1fd92f27ccbcf8ab285bc05c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"f0bc235629f48b82dcaad76bce5cdb80abfa82763d9ad220a11c3e27d70223d5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"af8712f819a09682d066de98c1b93feb5b0f27e478190be446e0c2d881c1e213\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"8ea734d5ea8e3432cc886f3fd011204345c05060f7991aff6617797636b9896a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c34c962f04362894a54cdf652c523865dbd1633f051244729b008181d474e55\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"2c3bfc8693c69427d3231717a8df2d14aba0f1fb87d9fd82bb191f0ebb31c308\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"915885eb7c9a3e141be9223dcd2bf03d4b850977922b9f3ad6f812809cf05a77\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"6816c53aa0b9171acb1b1522501aef6282ab95e3b7509a288af72c749a40063f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e12ef81cd87aec42f5b2528c46a9aeefe6b1bca82398f07b17a52a4bf6e91945\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"bd1615998be1912965bb2d26173bc1bd1e2565f8996f1f21fc476ccff3b1ad05\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a2f26131fa92b8ff5a24a34c4f1276e2ebde9d4239d1c79890c5f312ae6d007d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"199ebbeac914dfbab35c15e934f10f9f3b2214a0617964999f2157bf0c31b763\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a6fa5c95daf46871f07bc4e3ef7985a19659c040a1ef2a7baccccaa90e241705\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"3a34ac7af354fbf7d29872077cc2e557a29218e220d9e4e79e21710f2084e770\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"347ab4a75cfecc2353073cab067f0c183bd7a253c653eba93329ecf6aa4c77b2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"7eac06b7d9983846e2e0314ba9178882139d7919173fba3a84a8b264634346a5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"16cb85f469e7c5716866312b8b4cc95d7bd4782b54923c1571be2b995ef85c30\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"a65b58c28d5a781726a832c59d62e640ea9d347c008d6795a6bc79865414532f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3aa68add648f18fb79f3def0d73f0c2f29d8ab60b1352cf4548a1a038cf3d923\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"fad9cba453f811618739c6f08a8544a889f48ec7511f7d3ccac0f71ba988967b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"099191e40682a5a6b1df435c6dc10936b8b4e31a891f3520e8e9f8418b1acc3e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"adbf9660bf8db4b1489d019993fddbd2863d0cf7c72174df8663c00e565a1e21\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"13694f4cecc05b3e953bb7d1aa68f96fad9b8548456e1357cc504ba9936493bf\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"fd3f6d135cf69e39efa3702af6a7e665f47a40ddb90f71d1f37cad11438027bc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"db8ed9490207e877020d08d86f8a9769046fd69225998abd4e476e93ef7b9431\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"e3ae0784ebe4c51499f320023e5e93f640f2a33ae4fea237cb7e068df1c76739\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"12dec0ddb151cc18ef75cfe2b4260788095e28a391f359fc3f7da7c75381b728\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"8f6398fb66bae44affa747ad532a12445774a5b43ca2c7196a633d5d03da8c80\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"735d43fce555e32c36cd137abc0678ce944fbfe58a677497d16ab8d9ab37074f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"1016de6b3250a59509e3bc1de65ad0a68ae6faf776c4eaa853d86bce7dd96698\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9a442413f7e81c114c48c6bbdd04c0e3809cdcdf4def1f524f6d3adf70468027\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"785762b8cbcc7dd30b578476b081ad2df517e9e450947fa2591a488b59407126\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"204a90b318233d1075e557d2348b027549cbc82cda4c1d6aea6cfcfa28a96654\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"7bb190477ec8b722acf5b940486e283cbb3ed66f8b99945c184f13fdd5e8b25e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e5f21bd702765764bb09a1ee4f30f2c44baa119970ede500be5eedb7653d9284\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"c83d6ce70647211ab5b215758b02838f2d1d66725baa3ae1e3b9d5635dc53006\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-2-w4-d6cb38')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-worker-w4-d6cb38"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-worker-w4-d6cb38\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:30:02.477Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-distinct-2-w1-5f765a","namespace":"e2e-models-e2e-worker-w1-5f765a","uid":"d874e5bc-086e-49b7-8479-63c6ff45b7cd","error":"tokenratelimitpolicies.kuadrant.io \"maas-trlp-distinct-2-w1-5f765a\" not found"}
{"level":"error","ts":"2026-11-02T21:30:02.954Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-distinct-w2-6fa533","namespace":"e2e-models-e2e-worker-w2-6fa533","uid":"63e7ecd2-1e5f-443e-8faa-52695d3c0588","error":"tokenratelimitpolicies.kuadrant.io \"maas-trlp-distinct-w2-6fa533\" not found"}
{"level":"error","ts":"2026-11-02T21:30:03.013Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w0-0c9014","namespace":"e2e-models-e2e-worker-w0-0c9014","uid":"4f647df6-1d5b-433b-b4fc-1279ff1755f7","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w0-0c9014\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:30:03.433Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-distinct-2-w2-6fa533","namespace":"e2e-models-e2e-worker-w2-6fa533","uid":"b07eb333-9977-4e40-82bf-212c077157f3","error":"tokenratelimitpolicies.kuadrant.io \"maas-trlp-distinct-2-w2-6fa533\" not found"}
{"level":"error","ts":"2026-11-02T21:30:03.574Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"distinct-2-w2-6fa533-kserve-route","namespace":"e2e-models-e2e-worker-w2-6fa533","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"distinct-2-w2-6fa533-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:30:03.638Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"distinct-w2-6fa533-kserve-route","namespace":"e2e-models-e2e-worker-w2-6fa533","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"distinct-w2-6fa533-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:30:03.815Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"distinct-2-w4-d6cb38-kserve-route","namespace":"e2e-models-e2e-worker-w4-d6cb38","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"distinct-2-w4-d6cb38-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:30:13.296Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","TokenRateLimitPolicy","ConfigMap","HTTPRoute","AuthPolicy","Limitador","EnvoyFilter","Gateway"],"eventTypes":{"create":13,"delete":3,"update":11}}
{"level":"info","ts":"2026-11-02T21:30:13.522Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:30:14.739Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:30:14.825Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:30:14.825Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:30:17.172Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:30:17.176Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:30:17.176Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:30:17.183Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:30:17.193Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:30:17.226Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:30:17.343Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:30:19.931Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:30:19.931Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:30:21.181Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthPolicy","Gateway","TokenRateLimitPolicy","HTTPRoute"],"eventTypes":{"delete":2,"update":3}}
{"level":"info","ts":"2026-11-02T21:30:26.474Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:30:26.544Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:30:26.550Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:30:26.557Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:30:26.553Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:30:26.590Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"error","ts":"2026-11-02T21:30:26.664Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:30:26.664Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T21:30:26.729Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/766cf4bb260ece5a17a1555c9563719c5bb7959c9d88b568184ae41abd76eaaa","error":"authconfigs.authorino.kuadrant.io \"766cf4bb260ece5a17a1555c9563719c5bb7959c9d88b568184ae41abd76eaaa\" not found"}
{"level":"error","ts":"2026-11-02T21:30:26.798Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/123ca98e9a0a804d113e560c125759c8e2f539b94d72ccb5454ca9563adb403a","error":"authconfigs.authorino.kuadrant.io \"123ca98e9a0a804d113e560c125759c8e2f539b94d72ccb5454ca9563adb403a\" not found"}
{"level":"error","ts":"2026-11-02T21:30:26.855Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/15b2e87aa08919282b8acd840a1e8677e8854f820cb1d4115c0f0ebbeba4b541","error":"authconfigs.authorino.kuadrant.io \"15b2e87aa08919282b8acd840a1e8677e8854f820cb1d4115c0f0ebbeba4b541\" not found"}
{"level":"error","ts":"2026-11-02T21:30:26.915Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/456e5dd7dfa9810034544082c8cba90a71807c15f93751d5e3f6273265dd2a02","error":"authconfigs.authorino.kuadrant.io \"456e5dd7dfa9810034544082c8cba90a71807c15f93751d5e3f6273265dd2a02\" not found"}
{"level":"error","ts":"2026-11-02T21:30:26.981Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/3d6689d07457b06902f3cdae810a6a9071ef1bd6fa7f7675596735eeac6d7b7b","error":"authconfigs.authorino.kuadrant.io \"3d6689d07457b06902f3cdae810a6a9071ef1bd6fa7f7675596735eeac6d7b7b\" not found"}
{"level":"error","ts":"2026-11-02T21:30:27.038Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/dc6a6f9b82cff312739bacc49810b2d51c7df335dc8178b49ebd65433b463649","error":"authconfigs.authorino.kuadrant.io \"dc6a6f9b82cff312739bacc49810b2d51c7df335dc8178b49ebd65433b463649\" not found"}
{"level":"error","ts":"2026-11-02T21:30:27.544Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/maas-default-gateway","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T21:16:03Z","generation":12,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"371b36ef-c4b7-499a-87db-1bdf4e8f92de\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:26:44Z"}],"name":"kuadrant-maas-default-gateway","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"maas-default-gateway","uid":"371b36ef-c4b7-499a-87db-1bdf4e8f92de"}],"resourceVersion":"34974","uid":"86b5bad7-2bb7-41c9-b2c7-bb4c8f13292a"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"61b044087f8d56658ae99d15d4fab3cf1ad74e6636795c133e054a5aace0540d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e511d90f2140d9cde0b2100a0a488dacadd8f510bb901601d5e6fd25343a0f1c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"1e42d143d6033a677e2aa0de97c78600094e515d7c0d3f86b4925ef8be636163\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"26b7799af8a40e8b9585c255ec018a63b0074c27282d4dccebed45f14e703b5e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"ce74c295ef1588342c7308478a1dc6f6aa2cefc063e489a124e536ac32ecfdba\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"fbe95a07558afcf05ef68ff5beb293f527d6ab93dfe79956b5406dc463d78363\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1d34a156ee5008fe\\\" || auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"cbfbaf187a90415d\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1d34a156ee5008fe\\\" || auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"cbfbaf187a90415d\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"40a29ce438b5ca497e4389ce52025a9b91c0cf3177b1bd5c8519b041cfdcf75f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"845137604829fbc62550504d7bbe5ae8d55ea1cf474160cd789a72e811000e4b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5322619ef71b1d1ea3204f9014d0341d4402275b6ca23fca69d61cfc9a61e883\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"16b86e50920afda06ca195a717436238f5fca7f2e1bbe0939875bcb7d559cf31\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5da9070dfa3a5637213b5443376170dda26f57f381af542891ff3b19cc7a9d06\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"00ac1aeee65e93fab2ccfd89c11167f4d954e1cfb3e8b09ad3371a4fab4b6369\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"55c23b9552cb66c175ed2202220df6480eae89be2cda2e925458acf31c5bdbce\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"99f16470bd82ba57465b128d1c0fe73ef189001d77c6ead3fc34c98ad3ce27a2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1d34a156ee5008fe\\\" || auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"cbfbaf187a90415d\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1d34a156ee5008fe\\\" || auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"cbfbaf187a90415d\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"a6d134df42d4d90d93840f63dc770cadabd22dc22af01f991b6c067e96733c95\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"0be74a5083c4760789001949965ce7020664f6347b769f9f20735f95f9d34989\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4902f5a84509d49ec2fb75275af9692b524b1334f7c919eff1d9f33957acd5c4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4f0e9d14c4d1857d5415458306310b00d6a94ce68179c717917d13d30ede9b87\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"29d1c55f30b76c66bfb15588c297271fac7d5e9ca415f0c938d63e524a8187e5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"df729ecdaa88f0abfee16b94ea7be9c5aa7ccdfe91fbe0676e22ca4bfae35f29\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"69baf76a5f2e8f4f8d3e40025586b942794274a22455dc40e0b7c0116f0d2297\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"8199294e302361a6898546d62809d67d522e9c2b375c8b8727f0d966f7ad4d39\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1d34a156ee5008fe\\\" || auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"cbfbaf187a90415d\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1d34a156ee5008fe\\\" || auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"cbfbaf187a90415d\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"61ef91ec2e76cc107813a7351d7e38bb32d1ebbff452efa771b01f8a512fb99e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"f2d9c20918355999f92bc489c836e0d17ed8acb713739da4b73fc8ee019fc8a4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"c19d17a63dc280a83fa4dce8ef0f825a16118c6817d3126d095473335018edd0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"05aa8311318e9111c5925f4be454406e209ab832bc6e8ddf01725ebe4f1ffdcc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e680857c19914d59f115788ea93836704a1ddab04f5e495bf863d62ad8a5aa8e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"96b761d418352e3f8d172aa80bfb5542df670414bec97704e615f2e3e665c8aa\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4a199d441e37ffe8d62509ae7048cfd055df0de5619e9be81a8f47f9a64a7051\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"f17cbb57db714a7faf03a7e4ef3921069096709486e13c6b84b4b75ded84ca96\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1d34a156ee5008fe\\\" || auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"cbfbaf187a90415d\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1d34a156ee5008fe\\\" || auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"cbfbaf187a90415d\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"d8631ed26c63871d1138b31e9c971d72ad1152273309b27ee33862700ff4fb0c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"67a5fec0fb2398a03579a732c5e4640c9f9c5db5385b91db90ffb49522369904\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e5b5be5a42ead835fa1a13840fda21cf5afb14b8226da9a3008a321db777f685\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"a01c6bf1aa626b04ec6a9fc85abb6ced9b4a9c4cafe81d2176013cf3b0b4c4aa\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"0eb9568cf0385cf054d8f3ebcce089d8b225a9fe1b6061e3689f7bd26415f872\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"633e4cdca29207ccc8220565a86635db5bf3f227ef564ee1a0da6a5d6076231e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"ecaead2c94524df89be70a7c961f93dee41ef96545655d22914542a89dffe341\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b9f3d06eb6a92218fa1757dab6cb8e66e42102d46c94e6c0db854f694d6d855c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1d34a156ee5008fe\\\" || auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"cbfbaf187a90415d\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1d34a156ee5008fe\\\" || auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"cbfbaf187a90415d\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"7054423a069def7a36dcb993faa1143223d985021782b2552d55a522caf2eba9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"deac1d64e5b84f2fc26848a49153d512090eb1e2bffb72dd7091fd21a1234e18\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"3dbcd4467449162cad999d40988202fafebe535215351d004f1bf05937c76508\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"534f6056dec477fad33defb3049c84dc5497dacd9f6e3f2061b13ba089ed1cbd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"fa823b540319ebed6b9b488f79dda81b66933f7e616cfdaebe3543ae31b33b13\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"fb6ca2eee2169356e662d36e92b2b679a1235a86d976f9807297ad56386f6e2a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"0427c8054235bfb15b63a5a467ab470ce1cca867b5a232117e73059a4ec8891c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4aa2417057e81c2889811e45d786ab1591e3dfafc889b838aad26a3ec2cbfe9b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"acb4b8def068bc86711642e3242fd621a66a54452bf86a82586fc6bf69e8192b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"66831c252eeacbf3e19995c48be4a005b1726766550076c58cb47b979bece639\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"a80090acc18b7b092f5e9f2d49fd8643f16514df89a716f8f69afe4a7afebb76\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"f85e753996f9e90384b461c5504814ca0cada63ea0f44d6630a619ab36edbe08\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b72a3d2d64d0ddc05f076a7fcf59d924552b45080846c09e1084e67867a76e9c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"cd58d9e2c4a744adbc8ab336cd016f27bc1f14a1de2e975afa26b7f5113d1bfe\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1d34a156ee5008fe\\\" || auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"cbfbaf187a90415d\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1d34a156ee5008fe\\\" || auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"cbfbaf187a90415d\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"29c80f1787fdadd41eb24cbda56972d49e35d261e06b4f4fcd5851c7e2de3068\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1d34a156ee5008fe\\\" || auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"cbfbaf187a90415d\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1d34a156ee5008fe\\\" || auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"cbfbaf187a90415d\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"277489d8f3c2c5149e18b965c81958774efa7e81299a66265853d6af2e16037b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"7c211141c74fe1e91cc494ac860a81616dc49e2a5d1951dc70bf0f42824d53e5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"17df13edb14ef5c49ef0cc29deaea97728695c57b5ccad8feb2b23589083e083\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"014f0c5a15872002db778e7e40dfcf7dede4ab2db05bb6a08641f5d523cb3afc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"bdac37244e7b891cd2973e74c7b0db5110c344505a09a86e51fc6486ba35139d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"ea8a88726b68ceff7de514d89e12df024a67856b697e02c26b6e762395fdaf0d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"81df9bef1abee093a91a2eaab4b1a53122eb16d4150f27c879439ca5d99112f3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b3be2474c46178c0c39839b29d8d7c87b103574b042bb23175ac0e9786fde158\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"13fe2d56bb22ec9a1307da7bad05cdda8724fe788533352aa581ffdc96874c78\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1d34a156ee5008fe\\\" || auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"cbfbaf187a90415d\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1d34a156ee5008fe\\\" || auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"cbfbaf187a90415d\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"fbd262e90a5eaaf98d72db889488cbe13bdac9381f78343ea46c402679569fb2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"9794c132b0cd770efeb9723db862265df6a3584117821e44e2a5660a971c59eb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7def4ca304ff3869be64c2c02523fd9d2ff43465099dcd1124399f293eb4480f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"a86375603000eab9b808785894e0e63f3e53024a46681e97c41a06c4e0c67023\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"54eea38241838159e47386cb814ad20fc30631ee8c42d57f0ff8da80fbbf62a0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"d5b69938a04a8020c8a8d10df4921f2989326ca4811c3843a7201bdb1d5cb848\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-unconfigured-model/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c5a685f2a5ebdef5f1dee488990c0798a45ddce399cf99e7d0c505a5f46c69ac\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"0fcfc87f76b773c6a38375e46d76e569a372370e3ae2e7003932ed8ef776f5bd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fac07f302f653115fda3d376325a268abaf66025ed0e4af73e88bea3f41fe933\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"aa28eac51fc5e37c385a11a534759b09fb7998ba74bb01195dd8ff89d9e9ec43\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model-2/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"06165835c4461c0b16a2bc5bae936aff3c2f351edbef8aa378f1110874acedfc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"17390f436804c5d305f1dcb9ea78a72032310736cf630bb9589448f605bd1fd6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m-premium/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ad8714d3b8aed2a9ffd68fbcf0288557e9c1c059c1b59ad3e9a09910b37fd61b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"c4353817d988db43a8dd6b0d5c29305f9dcda76e19c9ef2c820808b0384a0bf4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-embedding-model/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"726a74c13fee356e859d9317271facbb60b066acbc5571de22d056f13c60878f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"1415e0d2aa117656e44a7d6aeaaf16aa87f18bdeee129f7e6757b2e1c7f996d3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-trlp-test-model/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cad6ab5a81a65fd4cb03a0fefdab5de82aa18c30a5b95078b1d05214b0606f40\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"0629facd48a81e3c82281be4a3f8566f55e61d1a30a8516b23bbb63c58e8f6f8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e5f81c7f7812462ebef000c68dc043013159f22201d2eeecf05c220e809f96ed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"2e292ccc99f990aa723c04a99267923f5b62fb8f3e0ab1a978e8334b9397ada0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-unconfigured-model/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"68502d1c1143a647ad56f2759ea89a4c5b3c74a8054739f7e7ea9ba6535e3b74\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"2b69b629cb2b5224adc61a8925f43333ba0b52ab39260c124057e9e82898937f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"74b47f1aa1203aad58596cbaab10ae46e8fddd08ac49eb57a26bdba532d88e72\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"d1e427bebfc099de9df176c73ee76d5dbd6f77919e840913d3a10818678c7394\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model-2/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3167d3bf853032a93e8569019dcd3e5aa33af9cb580cf9ca138990567fc9d857\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"482d2a79771eafe7f8d177701f43a13c6c4916251440ca00830042e050247443\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-unconfigured-model/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"99606c4eac496429be47144db9f3f48867815df12eb99d7be8073b767d7e44de\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"e635ba9dc59ae1e09b34ee6e0f2718b1c31e6f6b6ff2bc6d05c094fedc42c40b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m-premium/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5d590119308c6f848b12dd3ecdfb1b06cc2fe172af702455c342075944a045ff\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"caf1a50009b65f25df3a996283d38ada17bb57a2ebed842a552f137f6121c63a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-embedding-model/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0e042276580ed8976d8ad3afd87a71640025c28b9b48f5c88eb159ec9998209f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e17697b7e023603155a06feebe0602591826e794ee2f5189abf795c259be1b37\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-trlp-test-model/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0829dbf2b5dc0900de272826295adf351de381b46fa6fba00b896213530780f6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"1e772a79f4b1660c75cf3493e21c9ddb58d2de640363115c57dac03a10f22c33\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cc1ffc2ee4e05618c28c108cac668c0c02eb8e658953439e47a733edab44a1a0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4fe1d1c6df78a26f30e2392ae9da7fc67b0845dfda48a89e247bee6aa536d8e1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-unconfigured-model/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"486615827938fa99814e929fe7dc62bc16f7563179fef855074eb73dc7ce4724\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"ee2f6a8baeba450552a3e168b9df1808bba4e2c59106ad0881ae78aee4fcbd40\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-echo-model/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"98ec9d74d07c88c1e6923ed1cbafd4c5b41bf1763b3a942282f964f72425ae57\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"653f23106eb8a10791805e2f9355c750c56aa6873ef311fe707e76083d93d55d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model-2/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2ddbced6f2f51d410743da1d9db1257d0006d99f38986dd7cc7efd26620791ad\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"1e776cd43733621e16ebc27c91dbdeea062f73e4dde2f494701c85a6843faeed\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d752a44ad8df3a50b5a1147110eb89039ed764e1fed197b1f77e0935c424a90b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"62f67bf9885222d9a86a95e02ed17ae26ad7cf71e15aae0a7517e647c29618ca\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3083301b5359be118f04faaefcd72fd127f2297a3374ef7231b59a59a31b405c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"e85460469045801c3e6927ab49333ff01612a4899d5a7c29ec27824b9942f3b9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m-premium/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"67c67ce733de50e7b3d797bb248036b01badfe02e958f5f76af05b58a504989c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"f9b414e31cae5d16cc1ad22ba2462b8816d9369a97316f40f32a6e7912fc4f78\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model-2/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2d4a2275e6cbab5c26d5c3cf2d75aa2776066390e5b66f5498b16b26bc596af7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e33110b3dae1dd80b2bfa573def0b488a6fd4f1243962fe81d58e1853ed2d3f5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-embedding-model/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"23672b974f0dbc05100a34c78d2b029e41f1d5a3752f3fcb52915f56db360e25\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"a6183db94e49e3ba0149a19f4e52ff19aebb55d6261b0cacec0656136bd2adf4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-trlp-test-model/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8274337fc3f0de48e5213819aeb4a46559c4f8b3428c1bae43c0d75207ef5264\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1d34a156ee5008fe\\\" || auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"cbfbaf187a90415d\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1d34a156ee5008fe\\\" || auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"cbfbaf187a90415d\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"efcdf81b8f74d74207beb897f447376d1f950ae12e8a330f1ae67b0d9dc6a545\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0e89fc4b75d3a5dd95fca2c4d8ae33c7826f05a8016c44eb39e28c3c1860fcfb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"7f0f599e497ae797f3b5922614ceddb3375c007237412d01b520bb7498ef288d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/premium-simulated-simulated-premium/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ab505bdf28287fe00099987c1bde2c2f297c40c792a7f6cb5fbfa5adc44754d3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"06c1aa31be81b1f5c6266514c955712865b30117291a39dd749994f4ce931145\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m-premium/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1704c6bc15d6f547acca888061680f2275f690cb79e5af6fee44747bcf278b95\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"6a8319194e2c2fc998268cdbab03a5aae2d83019f5ac30c316c4e548895b7c63\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"eaeb360b41b3f9e0bd6b247d4dae3eef1ffc3355d6e9408df3f8f71bc7f033b5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"32cfee4e66c307d5ebed6a406d2260f4374553d184b5486fc53cb64bc6ffcd8d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-embedding-model/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"135ffad9bbcd33779a0b9a1c0dc5d5f547356be21489762803640aca855c728a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"3194cef788c3fa9898599a57480aeaed07c6eac2edf957788235b37d22918588\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-trlp-test-model/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"17002b7f0c8e62582ad262d9c2b8b038ee7f2a9327fe34f21fd4f47134b7b8cf\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5acde2b886749c1c54f99db5c33887e6fc5ed0caf412daacfb5df0f329882c66\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a6a6232fd5656520e75d100c41add5f1637dde9705a4ec608bbb90b724c258a5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"37a71c27032e51fdbc7ca688064a47abb86230a8138af6eb55e8069fad975a93\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-echo-model/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"92917da87eaba4f2684cd45947a3698434b99ff4ca6d3ddde51d6573aecb1600\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b2b26e0af9ad7defb486e5d1db19af6bbdd0998559d16f3776651669aeb4d067\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-echo-model/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aa7038625b8f43b0c002f79637065e5ab90468f50f998759d08f2c4640c07c04\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1d34a156ee5008fe\\\" || auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"cbfbaf187a90415d\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1d34a156ee5008fe\\\" || auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"cbfbaf187a90415d\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"2a62f0614f6526bc3f195f838aebd1abe29514f2707db40d9ef738d645ccf001\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"de97dd5d45c6eb12b4a1112ed1f362d8544427428d2249a399e26ba069d6aadb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"22b2ec7ec96ee09c9e07a84cd3d313c2223af42433bbb28c5846401f64d5e3c1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/premium-simulated-simulated-premium/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"dc061bec60bd28b1c132bf30965b4810124429576337bcc4a6030617600d1714\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b188b939a496049e47b8ef664d7c7c490722f1753404a08d89ccec1dcb87b8fa\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-echo-model/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"75612d85af2bae456dadd78163b2d2f9015c0a0bf4e20bcb8a555e6a5ab3b8c0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1d34a156ee5008fe\\\" || auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"cbfbaf187a90415d\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1d34a156ee5008fe\\\" || auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"cbfbaf187a90415d\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"96bc4fc13cb63707a942ca33034f78d2b39476a10860398523789db3990584d1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a4493fc88328eba553ef36791fbf4706bffae04a1ac501d099b12309ebc85c6b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"d84e45c7a3e370ea510e8e0294e009b29bc2f2ea789c47559293007b6c4410d2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/premium-simulated-simulated-premium/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2d953f7313807988e63546aa32431d96f77e6989c672f8ab42827c1c21918630\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1d34a156ee5008fe\\\" || auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"cbfbaf187a90415d\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1d34a156ee5008fe\\\" || auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"cbfbaf187a90415d\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"dd2f15d9a08862ab664dadf9bf5da25828d327a11a07849fa919713f034c2b0d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/facebook-opt-125m-simulated/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d69b9c128f599c9ea1af84bb3e783ed71688baf6b3ad2b86f2b7183f9a4208b9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1d34a156ee5008fe\\\" || auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"cbfbaf187a90415d\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1d34a156ee5008fe\\\" || auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"cbfbaf187a90415d\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"4dfeb9ff2318af8f84e70b11545800bb83948c080a97ae1ece5780d4022bb383\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"dd89509e97b96670685602ae2d08749226db8693944d2c6f868af9d3e0a5feb5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"1025db78adc8b9c9592b692cc227b1a306a99ac5502300d9ed4ed7615f5e3ef8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/premium-simulated-simulated-premium/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3386c5e86c72abcdab369776ccd7182024ab8681cbe497e81724868f101a3c0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"58e90354179740b1af406b2911c9997f3f3283475aeb77ce7918f3b3239a293f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9e75e9fd02f51c2f043b145c5d6b82e95f1447b388ee529262aea27a6a2774ef\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b89d1075a79c93acaa097e4e6db4d6a4b23bf3ffe5e964409e29b258ed725a99\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-2-simulated/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0913a452a02695c6681f1037232199b40b64236fed4d29cdbb41561695826340\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5c0b495d1a10c1cf1548ef17998cb18c0ca25371ad42d5ffe1aed42bd55e31ad\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-unconfigured-facebook-opt-125m-simulated')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"010adf02b2e7deb40c572f4729b6dd4619847c8e6344137326b72df28772fc1a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"c04f8a7c7387e6794115c41161cb001d8a07340d2878cb8f36774a8f6a200ba4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"105cf4dd91a8abf4a93abd65b255521c3d37b560b5d23f3ec59757b5b362fae6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"7e7d1a0ec6d957a4d4de94f93078f10e836b23442c9cfa90f11c8520cca12e87\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-embedding-simulated/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"75fd86e2a4870af5fd78f2ad7aa2a9d79aff977b3678d81954b1e207a9315f2c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"c3cfc634a11046a837448628e2f17db0ed3466194da289a808544d874ecf6451\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-trlp-test-simulated/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"54cd0149b818480305f3d0024b3c95629cafb641b48195d003b2b7006d5c6bcd\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"f5bc618bde549671e84473b23ef3632426f8606e2045744a860c603f2a7675d3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bf65ad13397c94660867eb0205e06d1c9bebda4b019f632c0d0b8ef989930381\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"d8d67afd40f17474755bd3f6b00e265761bf5154febca129bc3f2b0bcd749c41\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-simulated/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f9fa9cfc2b4e701183573419a92c79384cd30210289602f0115c75c5029d55aa\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"ac2105eead12bb02dd7d1691cc77fc8a580b903f98564a8fd585dfa345dec1dd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"596921ddc7ba8523386263c5cffcbd6ad9b6a385318ed7e24f72be06f36fc398\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"f4ae34c5c82a0969651301a535f404653a60a5d75f20c7ea56ad9bb89b67e9fb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f95805f0e9b755664735d898c1d644d571943be553204d3f86136bc35719ff13\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1d34a156ee5008fe\\\" || auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"cbfbaf187a90415d\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1d34a156ee5008fe\\\" || auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"cbfbaf187a90415d\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"95c39f44eae69bd53f57e5ff93243887dafd591c9b8cf2e736f0ab034e67021d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/facebook-opt-125m-simulated/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8d5571efc1d304f5bcfc2ffb4ac6819154ba5556c29ce33416d460b887427984\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5d6b359055267732253f201a1fe48f0abe6d5e22b011c70e1cb006eea672f535\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e91aceffc2d4f6d6b120625bd3ca23781b74a1cae6cf1da26bda310bbed0ef07\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1d34a156ee5008fe\\\" || auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"cbfbaf187a90415d\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1d34a156ee5008fe\\\" || auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"cbfbaf187a90415d\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"c8475d27649a649c955538ff79eb001372050ff4f1d4ad295b01dc6fcc69ba2a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/facebook-opt-125m-simulated/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a402d1681ab35bace735c19b1d084a86eb3d741d4e1c14371cfdaa55d22c3ebe\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"7320c049419b863194fd55db5ebd887462dd24e1289e6308d79f047431f2bed9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-2-simulated/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f9b535aed6243496a67741936e53a0d303bea1b872a06fb62f1f9c27150edc40\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1d34a156ee5008fe\\\" || auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"cbfbaf187a90415d\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1d34a156ee5008fe\\\" || auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"cbfbaf187a90415d\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"5eeab80447ec6c71797517b4d94c6623353e89097743360eadd7f31115976dfe\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/facebook-opt-125m-simulated/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a9800464506c58f005016df354e160757732171ff4d19747202524955329b998\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4984a24eb707d1b965a79974a98ed4afc271f2ca356b150cbc8943de1ddcfef8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-embedding-simulated/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c82a1a3dc2ce54c0b664f79a2cd895a3c40f774b3694999badae8cedd328292e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"276f5d5d67b2bd83c05c2b39e4a262885498e6807e3129a866eff0651b3604a9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-trlp-test-simulated/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"669658556fba0f45c2a82def2f57614416614ddf154ed8dc5f4f9188f10130f2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"692f39321f892929348fe56801dc14c8a35eaf749609a3a5f4b5e684edddf17c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-2-simulated/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c4399a95e89654e5b2bb5fabe45bc947d11ccd1448ebf64c30b195b34f239d58\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5b273834f06c6341dd07bba6c809b3297ba2514e6d3b9b5d0f4f8211c68ccf8b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-simulated/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5e4821ff903ad6ca2e1c42162432e34d8b0a2a78052961e753d36b742193432f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"f35ed2fb168a3a608435006c8c1b103242765d7d37f41bf1dbdb7bbc0331da89\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a91faccafad197e2a4065ce3d12a052ac484d2e8fb2fc9265ee48f02b28e6dce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"fbfd0ada86117ffb0a134e591bf8b8390012983d25496ef188c6da73fef5eaec\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-2-simulated/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0020c64019ffd1a0bdcc75e6441e6a30e6d8bb08f463f67bd2408a1e82b95b2a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e78a4964c93ec23890e62f7f50201f5b832b4c714066a914dc734d8ef60e8213\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-embedding-simulated/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7c924aa2b37ea38067b4e69052d541ea2e7c86fbdaa79b19f9ea09e87adbe4ff\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"d5cf96eeeaa56bb891ea0cba28f7beabf17a8c0f061ea01c768ed842dd26334f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-trlp-test-simulated/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"028a8b5bd5d4e690eebb2f20c5fd47cf0b3c6e2a3619ba9e55322bbca7b94cc3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"8fe4100eab1f023f5b06dd8e19bcc80109b82503466d49576acc234cdda9bf0e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-simulated/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"80056c658070f49140955cb6eabdbd252857a614af6b0f2f2de7a1ab1cd47949\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"53aad0199369eb8c8f787ea099e93092089c04344e8f910dcff366f54bc831cb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-embedding-simulated/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2416d7b42d11a09d7152746be0e114f8fdc87d0fbd0efa9dec5b52b011082194\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e0cfec53d1f17771317082d9a7d69806ae3468971bac79a1135f2b0d51ecdc07\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-trlp-test-simulated/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"50c2058cf11e07a931b06ac4446a56eee86855f00badf26618abe486a7bdcfd7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1d34a156ee5008fe\\\" || auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"cbfbaf187a90415d\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1d34a156ee5008fe\\\" || auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"cbfbaf187a90415d\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"f3b6e6c38a521fae8ef5c7fddf3b3178baba88effb4e5338e0b387e28ecc468d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"134a7a790ba665547ca14f80f917549f66ee5063fc41096471c0778399db6dd5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"4ddd3fa1f54c642a57a48737e710ec0116705776084d8cebd8134dfa49accdde\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/premium-simulated-simulated-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4d18a96899c43d55ee63d2ae1a7a938c7e873d88b2fd95f06b2e3aae2c7f1c84\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"44e38055536c3f0d49cb81abb42bfefcf2c78faf963a6160afbe459bbc04db39\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-simulated/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8d34bd12ba2030284fcb69127f53b8158bbdd4a1432bfe619165b4c2c96cc061\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"c9dd9c233e43b53241ee27e937246e51b8f3331f30a7fba22640617c1b0bf47a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/echo-simulator/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"319e246831bdaf5e765e63d5511b516594fd2b64527850e2ddabd2a4a85532ea\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"7cfd2ed5cb8a5913fa5f55b92b02805c6778991c01c80eb14a0962cc710a56ff\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/echo-simulator/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a8c8220ad6f1387002e262ace5db78a2c4bb39e5953306702a228215174f6796\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"87e1712d02794c6d66ec1a932f02901d7a4369f46d0f041178cd3efadb7f59b7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/echo-simulator/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1e077a716d89a43572a3c16e8d0b0436816baa48a2ea227603701f10cad6d6f4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1d34a156ee5008fe\\\" || auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"cbfbaf187a90415d\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1d34a156ee5008fe\\\" || auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"cbfbaf187a90415d\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"ae9eac2a2b8c8311bb8c6ea82ab445a5d6f50d2d51c3f79962be9d82007097ad\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/facebook-opt-125m-simulated')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3f23315aacd6e16f4ab41f96aeedc9549d1abdfc9476577a47d45d12875dec5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"165d3b8e224f71685dee07aadd133117aeeed097eae99437d561d5bfa2d22233\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/echo-simulator/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6687eb3cec74c6c51428ce3f3d22d50ba269f59015d1bc8f185da49eb095534e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"05ac0e89d0298398d3996609d7c22b514bdf08bfa3787653bc739995c5942441\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-2-simulated')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bfd36c5ed73eb81df97258ffa1aa36d8cbf6f3e7a8096c33ca4ff417be59d002\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"d5ac583036f3821c88111dd82571eab1fc94aa4e9fcd045b27336f798e26075d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-embedding-simulated')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d303c788902ad4467c7ae545d65cbef45564d1c0d56396c93057df3909461aa1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4a6b0d84cc35c0f532405eea81056481fd54e7ad71284a97ce8f6a2424eac819\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-trlp-test-simulated')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2f53b030326b8e1f5908c601aecd3fffcb6d08a8337d0bdc53ee1fc699a4cd71\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5c3bcd9fb119b0fd45f3b4ba5de5f905cacbb4963fec309a0961a40f76a7a7a9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-simulated')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"098187a2b31ef966f647c443716610cb8d70bdafedfed7bbd4f8b1b568817678\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__4542e5a2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7182a301e3dfb7ea\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/external-model-e2e-rt-sw-847782-931a1687e4da\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-e2e-rt-sw-847782\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__4542e5a2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7182a301e3dfb7ea\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/external-model-e2e-rt-sw-847782-931a1687e4da\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-e2e-rt-sw-847782\"]}],\"name\":\"d4bc8ab4f961e4da03ea520b66c210a99261bedcaa3b8ea63bfd065975305cdd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-rt-sw-847782')\",\"request.headers.exists(h, h.lowerAscii() == 'x-ai-routing-candidate' && request.headers[h] == 'llm/e2e-rt-sw-847782/llm/e2e-rt-sw-847782-a-provider')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b278a3f65d6cc70c6e2d022678205eee6ccd6b0dd1185b975c61ea5d681e4fa7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__4542e5a2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7182a301e3dfb7ea\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/external-model-e2e-rt-sw-847782-931a1687e4da\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-e2e-rt-sw-847782\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__4542e5a2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7182a301e3dfb7ea\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/external-model-e2e-rt-sw-847782-931a1687e4da\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-e2e-rt-sw-847782\"]}],\"name\":\"6552a07f5e2833f4750b76f64454853491f84950146659c393be378468143ba3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-rt-sw-847782')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"94ddc5e77f082c32bebc7a36bcebf621518ebf303e83b9c540da1352d04e620b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"50057c9a2acf4ae7152e8c97f7778cb04340d1470974e5272422d0bf244a4e5c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/echo-simulator')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c6918972d1a7f8ad5201880b7d6d9c1191ca1f25376682f691def7868e3fd02\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"01cc37113b4d6c301e355f63decf46a21e93a023494bdfeaeed2890c97ec1f57\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a82769ff87473da04c27497e160e9b4b1a5dd93578e0cf2342be8b2f06845269\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e747b72d92315b743934153588614b27670cf0c9d9dc4fb380ea4965def7f235\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"06b05a8e4dd69bdc4f333ad9509ee8cad3c5c0f5dd48edbe94c1158b60f79ed3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"661962837510c6dc6d1faa64e61ec3086efa9e0a2e7315c6ded616c1879e5ba8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b4bfec1b33959dd0ebfc5cd6fb410688e820d4b55c7f149cb4acc4353f30a9b2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a7740f6e77d024a437502c023fb1d8939cb3cc2b9ed7f4073af7d779e19459eb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"f82564e076ea3e672592bab71e048537faba17a5e909884c2a0204e235905a69\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2ecffd49fe780ea8d7ee498582caa2c41bc635ad490315792e681c7defe84b85\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__4542e5a2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7182a301e3dfb7ea\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/external-model-e2e-rt-sw-847782-931a1687e4da\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-e2e-rt-sw-847782\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__4542e5a2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7182a301e3dfb7ea\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/external-model-e2e-rt-sw-847782-931a1687e4da\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-e2e-rt-sw-847782\"]}],\"name\":\"f9bad537fbe7a6c4935a5a7c8686a356adaa96259346b265b4b0283d55b8466d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'e2e-rt-sw-847782')\",\"request.headers.exists(h, h.lowerAscii() == 'x-ai-routing-candidate' && request.headers[h] == 'llm/e2e-rt-sw-847782/llm/e2e-rt-sw-847782-a-provider')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a908063c86927e6bf07b7d793aad9f277ac3c2a8f5f5d468b116cb9e07929b14\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"fbdfff5b213f506d78434055d011cf63d616653e502ee04408a43578986e1e5c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d1d232e06f90d479cd9b802f24889e83af58c51cf54ba273d5e24dcb8a297688\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b49f2d7e152d4de959577465d2494ee11771b4c439cb6eae71c90bff26224fb4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"810f299b76daf089b33c92cfbe0445ab5cc89a48d38e36df0cc89ed6cd1fe8df\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b27d6255cac73fc039120e157e1f3ce0e99e86995ac5a66974d5e8744df6c64d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4f800155f293f82eeaf5fd6a9553c0a1bee90f47a295bba8d7a04b3f11faea33\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b1ccc7ca46f6a14e90afe1dddfab8763f07f30549ce1cda0bae985581f063098\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ce7d381faee9ff949d68d825ffa1dcb9247dad19667ec59a8e91847320dacbe0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5d72fc7cc241ffd60d83142a900be014cc5d57320142e013493b21ecc86cb534\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6565c4085b3917d5390fe1b0194fb3d8319f1d56b45867e3c68ff740b5c16ef3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"be1ccea8a4cc19c7190600de6631fcb661b63db81e2862348a6ef4f90bf33fa3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8d8c8aae1332bb0300ac2d65be9b8708fbfde6d4b5599ec52380cf1f70956045\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1d34a156ee5008fe\\\" || auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"cbfbaf187a90415d\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1d34a156ee5008fe\\\" || auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"cbfbaf187a90415d\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"ca48ea5d9ee701ac5383800306378d945e66ca5427eba33396e6805ebbdc1ea7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f6df6bc14432fdc346191db86ee06e75c8090ed87a32c984493c837e97a10be6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"fc54a1d4f18d4d59e58b6a3aa31dbfaddda2b89e5c28dc9eacf14ff38a414021\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"528f8663751fc08f3e8ae4ff6fd43a63d61572c7f149dc0fe75912f5f4b33047\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__4542e5a2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7182a301e3dfb7ea\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/external-model-e2e-rt-sw-847782-931a1687e4da\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-e2e-rt-sw-847782\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__4542e5a2\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7182a301e3dfb7ea\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/external-model-e2e-rt-sw-847782-931a1687e4da\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-e2e-rt-sw-847782\"]}],\"name\":\"3ab01a6a4b50257801cab44c4e08e694374d0c202b60aafd1e6d17ac6c55021d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'e2e-rt-sw-847782')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"maas-default-gateway"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-maas-default-gateway\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:30:27.830Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-worker-w1-5f765a","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T21:22:08Z","generation":12,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"4caf3c5b-8145-48de-a05b-6a1b9a102f00\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:29:53Z"}],"name":"kuadrant-e2e-worker-w1-5f765a","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-worker-w1-5f765a","uid":"4caf3c5b-8145-48de-a05b-6a1b9a102f00"}],"resourceVersion":"39626","uid":"fb3e4914-c809-4feb-81f5-a0a468b56725"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bcf0aab5299349f1dd1df89a10a558ad5617afdfb0f30d972811f3dbb51b1ea5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]}],\"name\":\"f2c753e74bbc5983406d967abd1143e62400e0f08a2e36f6ffa42c06a3a6974c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/simulator-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"db6f9ff18eeb49f1421400a53d101cb100b1a88466190b46fb6dbed22a42e073\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]}],\"name\":\"eedd7a1bac5c7747d7137dccbdafefbc4f76edb1acf806e0399e7d01c0c93443\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/premium-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0623abc228b11818faa4a08b26d906ef498cb9511f2bcee2bcd7c9e8dbb0a23a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"0a44edd91442d2ddfe39cb24e50368dfc1e81bad179d3235d38e40f25e9d22ae\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"99ce90aab60d81af668145560f9879cd2b5941652fd3e18c3d45856709a0948e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"91d7b5395adff9d28bf7ef05c8e81f9bd73a716e4072d28f8624ff5f9381a8fe\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-2-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bcf0aab5299349f1dd1df89a10a558ad5617afdfb0f30d972811f3dbb51b1ea5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]}],\"name\":\"76a34f19bf7079dd4104caff1731257297b843b61401a91d00b1a27ccab63fd7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/simulator-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"db6f9ff18eeb49f1421400a53d101cb100b1a88466190b46fb6dbed22a42e073\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]}],\"name\":\"263fa7af352a917ec5f565f1287ed3339005bf0c3ba787dcb8a5e539d84cfaff\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/premium-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0623abc228b11818faa4a08b26d906ef498cb9511f2bcee2bcd7c9e8dbb0a23a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"e78483f4191a6de2a454384113672ed5dcab6ca23c10f3e5052c523e46b7a77c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"99ce90aab60d81af668145560f9879cd2b5941652fd3e18c3d45856709a0948e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"601fd1e14b5e1e1044cd1ad2841f6c4703624cbd2a380dedacb373ba7867c1eb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-2-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bcf0aab5299349f1dd1df89a10a558ad5617afdfb0f30d972811f3dbb51b1ea5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]}],\"name\":\"3451d924df135b44fe4e7857db1417971e78cee0d322dc55f2d9dcfc1a98438c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/simulator-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"db6f9ff18eeb49f1421400a53d101cb100b1a88466190b46fb6dbed22a42e073\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]}],\"name\":\"c12741fd641c86bf88bbd47e58d2e5d62933e3e0f320cf13ec7d52df7a394c29\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/premium-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0623abc228b11818faa4a08b26d906ef498cb9511f2bcee2bcd7c9e8dbb0a23a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"7d42ed92cf0df2b010ce6bb7fe8510b6b214aa6493d82bbe3bdd85788b9ced2d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"99ce90aab60d81af668145560f9879cd2b5941652fd3e18c3d45856709a0948e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"89e9e9283f23750b835cfc41e1a3e8f29103f8fe9ceff7e9517fedfa07286e72\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-2-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bcf0aab5299349f1dd1df89a10a558ad5617afdfb0f30d972811f3dbb51b1ea5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]}],\"name\":\"70ba0b522bbd69a6ed9f77952d20b92d482b03854cc92dbb7d522bd33335c96d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/simulator-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"db6f9ff18eeb49f1421400a53d101cb100b1a88466190b46fb6dbed22a42e073\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]}],\"name\":\"65d2403634b5ea32b46b6ea0b85de94e33a3af4a2416095b99fbdb18350add91\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/premium-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0623abc228b11818faa4a08b26d906ef498cb9511f2bcee2bcd7c9e8dbb0a23a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"f16ad623eef6c3389dd02c8e5699fc3224f733fcfdf7f5e04c94d15bb259d565\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"99ce90aab60d81af668145560f9879cd2b5941652fd3e18c3d45856709a0948e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"31f5ec2b96aaa4e6b31984c22b75d9d621a704605d13ed2d59121449937c911d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-2-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bcf0aab5299349f1dd1df89a10a558ad5617afdfb0f30d972811f3dbb51b1ea5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]}],\"name\":\"ba40310e6c4dc6ab4a0b4c712eda89883762afc9beb70d4b7c23b27f69b9ab49\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/simulator-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"db6f9ff18eeb49f1421400a53d101cb100b1a88466190b46fb6dbed22a42e073\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]}],\"name\":\"bd657b2cf110d146eb81bf7b91f3184e0028cf98e5195ef2ddb8f508863741de\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/premium-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0623abc228b11818faa4a08b26d906ef498cb9511f2bcee2bcd7c9e8dbb0a23a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"2f0dfd729a81441e924bd38747be17f316e3b9b9e9528ea0a39238207dd25e7f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"99ce90aab60d81af668145560f9879cd2b5941652fd3e18c3d45856709a0948e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"d373660753c800ef6dc88aa9dcf376944988375525f3908104ef1f83260983ff\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-2-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bcf0aab5299349f1dd1df89a10a558ad5617afdfb0f30d972811f3dbb51b1ea5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]}],\"name\":\"d637ac7d402bcd26ac6f88370d996d05abc8c7982ed2c2cc4095675044806a8e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/simulator-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bcf0aab5299349f1dd1df89a10a558ad5617afdfb0f30d972811f3dbb51b1ea5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]}],\"name\":\"30abcde41a2149187abd00b7dbf1da4982d5f53b5da1288f5b95a0d579abbd6a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/simulator-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"db6f9ff18eeb49f1421400a53d101cb100b1a88466190b46fb6dbed22a42e073\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]}],\"name\":\"e253a93d7a1e997f4ec04774e63bac26b7573119884a469fa9cadfdd694f2c86\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/premium-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"db6f9ff18eeb49f1421400a53d101cb100b1a88466190b46fb6dbed22a42e073\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]}],\"name\":\"857e58268f515ca3e78ba5dd4b121c1c64a1556ffa6fb72ca451501f13fd956c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/premium-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0623abc228b11818faa4a08b26d906ef498cb9511f2bcee2bcd7c9e8dbb0a23a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"d6e34b9866f1888f862664b06edada2fc5b06428a00da8529b16758a3eda81bd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0623abc228b11818faa4a08b26d906ef498cb9511f2bcee2bcd7c9e8dbb0a23a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"d8a7afed6f125f1efe48eb9763d5f6da06382ed5c648453e53d16207a819a353\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"99ce90aab60d81af668145560f9879cd2b5941652fd3e18c3d45856709a0948e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"4e6de9db11e4f53c670f806b7f8fa9eef7623d7a93fac0088e6bc4808c690024\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-2-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"99ce90aab60d81af668145560f9879cd2b5941652fd3e18c3d45856709a0948e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"e4a3e27b6d899463b5db743e92f4f3eea337802f422e60f3725234174543f7ad\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-2-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bcf0aab5299349f1dd1df89a10a558ad5617afdfb0f30d972811f3dbb51b1ea5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]}],\"name\":\"c06ce02686be6c949fde11dd46005249ce969a6a4cd5979e062f2fd0e328306e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/simulator-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"db6f9ff18eeb49f1421400a53d101cb100b1a88466190b46fb6dbed22a42e073\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]}],\"name\":\"a5c2e2f330e8d4b7f1cc2fd43eb290bf161724714abfed900324fd2909e2a064\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/premium-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0623abc228b11818faa4a08b26d906ef498cb9511f2bcee2bcd7c9e8dbb0a23a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"f32d2c346b05e35d553dca7fe2805eee4c7886686071be499c78e95d284e8bd5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"99ce90aab60d81af668145560f9879cd2b5941652fd3e18c3d45856709a0948e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"6f1d479dd9b2c444c7bbd9d0b29aa4d86c30e494765ff79074f52d3018d29503\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-2-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fa1a008e4957943b0d2d9d600bd19dafc0caa0b522e5c1d1e09ecc5d82a64f4c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-5f765a\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-5f765a\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"b218feb88b60257514445a8b1d44e3ab1edb938de3bc6d6fdb02ef04222c6dcb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8614fe473acb7380c1bbcefbfc7ddc49bdb08a20998450fd852a13de53bb8a12\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"5340f589ec7e8ec67c1190312eeca907b744df43dafe4398f0722d074bfb32b9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-2-w1-5f765a/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"58ba249888c7ebfedfcb5aec9df19d4b07d2856710ac2163dcc961a176311fa9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]}],\"name\":\"4d61c78710f351b5667f692e1f8792c5724b52f7fc998511134665312fdd896f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/simulator-w1-5f765a/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9fa5392cc7c0130bb8596420fcb1a79f07b3d804fb9e4de459f680cdcfd5dcfc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"b1d7cdd38dbaf49bd08c0343391886f319979629ab66d478079771f78f733a35\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-w1-5f765a/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2aaf9242e876623422852fe471269a2d268f4d784b14c7ab37ec9f34c17f3060\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]}],\"name\":\"f201dec897e559ed36b9a30f0bbf86c43aae129e674ef36595083bda93e4b839\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/premium-w1-5f765a/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"36a5aec7d5b7178c754711c0ad90ec391fbc4764ff98bc952ff9d4d46a3e1fad\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"e1ac9296595d90737d084f76147f4acec9440f2802b7b4ad18409fe9de33bb5e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-2-w1-5f765a/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c19827aa458f939a86c4dbefda3dabc4f554898dbb7e2f92b488060e9e90b5cc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]}],\"name\":\"6d546403540eabf244c73a602659986050165bca90bc795de701a61411a1c48e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/simulator-w1-5f765a/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"922492b3fb118d2a03b9019d5fd7a1e7fc6f7f5e4559c5e1a0ef89b6f41e6c00\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"5cbb9e2f75cce25ddb3c2b6eb86ac94a59b3619ba9df40d1b5dd3580109ca3cc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-w1-5f765a/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"37f7dad0ca5234ce11642187ba11e681aa288a9b2a62a6d47b06de5fa5c385ed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"ec08733aeb0db1141aa8a8a511c7859111cf54e374fddf2e382a4616e38a9f7d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-2-w1-5f765a/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"784ccec783ba11c98817fe5af2849f9f4970be19046e351a067c85add913f548\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]}],\"name\":\"9327d3b7df136b8c0fed4aaa35057ac8d1022305472875ccc8c55a524105fb1a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/simulator-w1-5f765a/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"beb0d5e916dc078abcaba4ea5b4d8012d5c2d8edfd07ca54d585bfe44d7c605a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]}],\"name\":\"8cff0046c214e842687a3a284fe4fabc8a45eb2579168ac47aa1b4908bd95fc4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/premium-w1-5f765a/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"39a9f89f974929e5c36b7ca16af0fe122642ef82605ca091ecae9f1aab1c8c39\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"633ba07e8fd8d505f7f6918d4c95117ed7435ee10e97f4b5b67ea8fb88d406a9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-2-w1-5f765a/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5bc63b4c1a02d51f1462172790f7018aec7db9fb8a2a61024ca7c15aac9065b4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]}],\"name\":\"2bdf38e0b22608328672d2ed39e7a6336f89c14fb615a48fda4a36a65c185b32\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/simulator-w1-5f765a/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6ceeddb720a82c7a3a1051f6517a47c73f8528f97b9e67d8dd2f7dd9419967e1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"73c4b3ba76c71b5ac2b369625b3de4081ddfaca2a924b7a8741f70090acba47b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-w1-5f765a/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b8fb7aae7cac121f592817a5e9754983e04e46d9e4226183153bf83b778fffdd\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]}],\"name\":\"b288a64704f96ac78878f6909232d8598eef54cca0d7adc2629cac87b6802414\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/premium-w1-5f765a/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8f0923ad4223ef053267784d904817130eaaaa279092e9f9f1500d0325c2e6a7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"127ad269f06b6d28319f2bb527c4cb8c00c67080e95ba7a4c5aae51849cf6881\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-w1-5f765a/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9f6fc629fa43de74b0fb261de7e8b46fbdfe4f21235446879cd916210856d6f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]}],\"name\":\"3345e3b0c95bd559e9c6ce41f622270b0d9eed1deb3d862eb2d4fad368905626\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/premium-w1-5f765a/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4afb168c7cbb67555e268bc246b8eeeba53cda69691eb181663c1375ab099775\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"c917df68cc69647c025db7eb577471c675040ae5aa7ec4537927ac6f148031ea\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-2-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"719394d8154dd624eedc306180a33baa4128531f223bc2727d0376601dd634f6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]}],\"name\":\"94c5946d9d9c3cc245ba073b8c7a87c64029cba185e4d624d2145ef119722e87\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/simulator-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6cbb9b4408bb48fa5c471c9684ef41f50ebbc4e85135af89ff2781ab48666f2a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"7aaa0a43baf33eeaf52534a90f734bbc375ee8f202c1994adc991d076f599c57\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"796ce8085bd3851fe6a6d0c9b4c29504c70e44da1ae3ea663bfc85d308b1e5b1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"d7eb7b84f6936309cd84db740a6f755286a5345ec159a7046e2c3f3126780262\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4139e076413d5d9d1fd2b594b83d854cc771dfa28886f3f67439ec043220dd9f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]}],\"name\":\"0b53b3ab98bfc66b662cb3ccde6535694ee9e681e165e011925491f011e74e55\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"505545a95fce131db80f848e9990387e6b3e42a2f7e2375f56bbc07efcac9723\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]}],\"name\":\"3f3727d24e2cdb2256f9ce1aa9d7daf02e123ff83dd7745a54bf0be968b8f9fd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/premium-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bd641664cfab5eecac33b1ff0c46f78597ed896bbc4c7a81487d56141be11715\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"c6d9f4f268ffd7b969efc4b42666a18e7b4e74fa0efcee36ff06291b64cdd07f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9112a3b536f3eb5f79a5b52d0ee8a7a26d3700b295f3ce2775128d2841f01ff4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]}],\"name\":\"f08d8256a9bbcb38779e30702529b4c292d4f2775e4ae9817b47fa8337570bcb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ddbb47f4f9dda290c11f442f07feec9b2e64a236ec2c98dd4fb16a3796302ba3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"fb5e9f944ff60517f890fed5aa51a590589ee84870b6b00ffb1d187e035ed1c3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0768841c9057075fe648e2fa67028e1fc0bee839efdd3e78e081dac6a9e13397\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]}],\"name\":\"2e7b2a851ead1f1cbcc5f6106eac7e445acafba2c4c4ad4a5a56639d6af03796\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7f1003cf42290c9494548cc907c9d6b31f90160185f5f9a729a625709fd1fb40\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"7de1fcf03a98bd9434df66c8e2bbabb8a6758cfd8b4c1bc07707e0cd17f3a70b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b7e1694df51b77341405c6097e6d1487bf70a48e8a95816d2cfc62e5ddd6a999\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"e45d437fabc94b7146571bcd5ac6f2fee56e43a9f023c9e1e15d67d077bb0cff\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9178bfcf79bd6f1164069b245bef389ffaa38dddce2763e94a3e39d83454aa7f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]}],\"name\":\"2e3472e08ab25f673a6a47899dd2756fa7246fcafa45a33d1cfbd451f1a6da2b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"106dc24382c96b56f69df1e4bfaa0455678809d57faded1081bc4e26a642d4a0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]}],\"name\":\"922243bc7c6610ec5ba0285d821a4e92cf6386c7e495914f5a3fe8f9160a0647\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4ff864a27b8c6cdd9a746e87a7d53b4055daacec9650360ef6d48d5964395d3f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"b6f9cb2cdae82e814be4f1c67b0c2f3da01ef6645a272400a2fe7577eb5815ff\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0b8fd96f5e30886bce6ea837ac57b2f3d77783c525b1de469227d248ca2a1d6e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]}],\"name\":\"9ad77601cac881a53e95a12cc3d1e21e0beee1d4e9757eaa68fbb36f70dbe5e2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"dc6825eadf840da0185447dcfb22803683fc39051aa637aea7a66d081b192bf7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"4ed033a41f89a0f23149658aeb2f5cbe79d4d5b179ddf0addaf56898cfb91f45\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e1e7c7c242c339c99da1caa3f217a7bd53ffc78a71bee9a0e898d1f0b8471fb3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]}],\"name\":\"00a6f26194c6932f8037cd0201f950c67a9b8fbee2e5ed3817f9a97812c711c2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b0ee4efc66d9a6e357c482407ac7794ac3e2e51168e28a743b633a36b12f1489\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"4f607540ea8ad5f65e31b3b8bf068f37a827d58181018c53d169b4c83e69fc48\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c4c89ab332c30b38dc4f16ef73fecdbd0ef26ff23424b1e8fd0d18c2d45cf73d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]}],\"name\":\"892cea79034a9b0e44e5d14d2ace5c60fa5e183f87a7ffb536724af7425a469d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6ac0410a29c97032cc673c8f56fb055dcd84c1040f73657459b7f1183a6ef131\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"777413beddd80a2dbe7efbaba4adc804e5a12db4f911e0e22a0ea59643cf8a40\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9d278f3acef96193a8d6a95bb17fda6beacb6c6949e61147bbb0a9f984d383ca\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]}],\"name\":\"c89ebfbf5d6c50d68e0202a4a7f2450fb6de7656dcb639d8a2d40d475718ebc7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8e06ac6cbf5999144a3b0f3b2584acaac3b4eb8d03d892bc45e03712448c4a9c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"e52e079eb305353b58c669f26348af185ff2ff22d378b7c80663f6bbaa04aa50\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f7254b99580aca11d813d05cebe8fd0d083eab4978ed55c24131cbd3917e5e39\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]}],\"name\":\"a5339e879056a8880ff59d0bd2b4a470fa93075d67e5851ae7b49fba2bef41e6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a2866a5a08cd0abaabb645c82aff8b6635fdbd34410a7b092e32a8b164086e19\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-5f765a\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-5f765a\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"cc60bc0276d07b9216150b4bc6b21e75f85bf16c7cf27ea44774f135d5d03080\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b651c6e6a372a592c9723851c4377c52eae8778a18d51a17e65b611b0b04e077\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-5f765a\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-5f765a\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"3c78a568a81450298f63da5aa6923258e0adf684426ab83ceb35e01cf96e31be\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e206eae15f3c87b50ca80d04704d63fdf1ea76a805ec0dff6aaf8552207a1be8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-5f765a\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-5f765a\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"2b06fb39c490ea09b70252ff358244737d19e14a20470f0c43270d8a8d663698\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2ce874ebffdc76810fc3c080f4a7068ce8f4e9a05d63e70150e7fc6ef281b797\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-5f765a\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-5f765a\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"4ea6ce64f8c082ae7ad14a6cda98b463639b3ce9f3c1fb4c0f89d8e025314dd5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a2db302be0c4963be9b2d68075376d29342d2e854fa4746701662a56823b450e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-5f765a\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w1-5f765a\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"c252574ae7fb8eaff36f49460a23a178a025ecce5b05cd990eb6d87e58fc178a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b6a8f91d1ffdf775c75f2a1c84bb520696572aea4d3ece8ed9123766f347b2eb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__fad03a9b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"eb8f732e30de3ce7\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-simulator-w1-5f765a\"]}],\"name\":\"7edb3db3dee9ba3102857080aca6e9bec53bbe738951ad9a83ba0cb19f036f1e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/simulator-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"eadff6644620dd26a92e8dd1076b97db8fef2224eb03b70ce4e7ee1ef8dc0b30\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__25eab2d7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8438bb70301fb076\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w1-5f765a/maas-trlp-premium-w1-5f765a\"]}],\"name\":\"41b87dde831c23a98bbe55369e4882c3bfbc1b8dcecce6cd22b590fe3e2fd450\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/premium-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b4056adace047bf2186763869c2f6a0524a9534ef874733d3868dfd41db1a7c9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"bc833d07dbe8f000644c82cba26ec9f2ce483a0cd86141971709f215bd14e019\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"98aca426d9ec5ae558219406a36e9375b2e6291ddc5e73bd3960b21edfe258cd\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"8e27ae43b5f0896611602b3ee9b020104ca8fa9588c510a3aa8b4c406a47912b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-2-w1-5f765a')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-worker-w1-5f765a"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-worker-w1-5f765a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:30:28.021Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-worker-w2-6fa533","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T21:21:58Z","generation":13,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"350cbfc3-ae8f-47d8-bf88-3bc797a06de4\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:29:53Z"}],"name":"kuadrant-e2e-worker-w2-6fa533","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-worker-w2-6fa533","uid":"350cbfc3-ae8f-47d8-bf88-3bc797a06de4"}],"resourceVersion":"39639","uid":"e9c29fe8-1b7a-4730-9bc2-e4f3e80147bd"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2538346ffaabe171687c406d12f294530661f7690a04d14ab2327034447b1886\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"fc3c7a9daa18c716699d2f1fa233a5848a5d36cd60feee59a35bb57159d77252\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"df8548d2a100989756489c2811783626f3836ef18d08ba8c81bfb6b9e9ef9c28\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"983a86a79f65831a149f35f3c7673bbfb37560154023198d82ebb8965ed48c8e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/premium-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"13cb74b6bdfe9b2af39effc13c9d5ade5172cb10a5930c6aefbe733c0ab0cad4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"462645ad06b45e6f5c9824c64f8ebc4010534cdeadc425c4ab2c9b0594a88a7d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b565990bc269af90f4e0533dedaf97fc37dc70b037af910a7605358eda2713f5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"b369d9c3b4e9e1fbdb75c9e353f7e25f066823d31fb733c322ac2192463d58e1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-2-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2538346ffaabe171687c406d12f294530661f7690a04d14ab2327034447b1886\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"53b8e179280ac5286bf38489ea72372b11c85a8c387359bf689ebecff1663d36\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"df8548d2a100989756489c2811783626f3836ef18d08ba8c81bfb6b9e9ef9c28\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"c166f75566a6849f94f19ff1eaf52bbfeb65e132db0ce99439215a5fba3cf50f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/premium-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"13cb74b6bdfe9b2af39effc13c9d5ade5172cb10a5930c6aefbe733c0ab0cad4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"2eb901a322f6f85745b1b216f71a9aeaf7eef69af5cc7ad9aead13448f127634\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b565990bc269af90f4e0533dedaf97fc37dc70b037af910a7605358eda2713f5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"fae945183d4744cfc72f99d3814545646a9a87e750465f9b67476229ff21e62f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-2-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2538346ffaabe171687c406d12f294530661f7690a04d14ab2327034447b1886\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"89b4eca3220447cd92c83c9c71f9e61e645c1f746a07d9b87eac9b2d4af27f2a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"df8548d2a100989756489c2811783626f3836ef18d08ba8c81bfb6b9e9ef9c28\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"82b649105e404b52dbe59777c528effe8ddcaf390c919bc52a045d6654c17d27\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/premium-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"13cb74b6bdfe9b2af39effc13c9d5ade5172cb10a5930c6aefbe733c0ab0cad4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"0491f04b3838b4a997ad42c2f3b87b5bc525f5236ef6a51647a0af61e52bf52d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b565990bc269af90f4e0533dedaf97fc37dc70b037af910a7605358eda2713f5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"e160eef909b8d94a314732c333511d40579117e325a0f92347c702a5ee49c702\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-2-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2538346ffaabe171687c406d12f294530661f7690a04d14ab2327034447b1886\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"0f54f971c3b78f7352580f77fc5be3e00c2117ef445b417be77bf67ea75539a5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"df8548d2a100989756489c2811783626f3836ef18d08ba8c81bfb6b9e9ef9c28\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"616030c276c95a5326d811265a5516c30019307d032046e4dbf9c60aed89bb9f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/premium-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"13cb74b6bdfe9b2af39effc13c9d5ade5172cb10a5930c6aefbe733c0ab0cad4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"60974e3173a2c5fa225357d66a1c4055fbb2b76b845de70e5504acc58902d471\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b565990bc269af90f4e0533dedaf97fc37dc70b037af910a7605358eda2713f5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"18b6544f1fecef176364e89f35a905f48ff233680f0d7e6adfd1caf2b5f57048\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-2-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2538346ffaabe171687c406d12f294530661f7690a04d14ab2327034447b1886\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"6982a3a190cf8786b034f1d39a14b07dab2e5311ed66344e600b389726798c72\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"df8548d2a100989756489c2811783626f3836ef18d08ba8c81bfb6b9e9ef9c28\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"d8b01a7d8bf17be310055802641797f595c1e7290b01b91e2b87cf0300418b94\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/premium-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"13cb74b6bdfe9b2af39effc13c9d5ade5172cb10a5930c6aefbe733c0ab0cad4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"28c14a49b36fb1c2749324536c3bd478da8cea176c30e855a8c62d376476a248\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b565990bc269af90f4e0533dedaf97fc37dc70b037af910a7605358eda2713f5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"d42afd956ea2d4dcd0f0aaadc1669934e404dadfe3651ba4498df28db6f58683\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-2-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2538346ffaabe171687c406d12f294530661f7690a04d14ab2327034447b1886\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"87456404dc6fbf2160a52ba615889680b0c5cf40dc6100bb0e888288606dff25\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2538346ffaabe171687c406d12f294530661f7690a04d14ab2327034447b1886\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"8b9c2ea6de06bba9ed1ba2a65e99d1500ef45630a372914ecf445da73d74600a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"df8548d2a100989756489c2811783626f3836ef18d08ba8c81bfb6b9e9ef9c28\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"9222b1bebeb91f5bc797ef6f55e59f628b5f90c3da7305c7a50abb490cf18e24\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/premium-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"df8548d2a100989756489c2811783626f3836ef18d08ba8c81bfb6b9e9ef9c28\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"63ba67de9ead24d6aab10a349447139ea4c7227426ee6072b8939e91ccf0ed30\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/premium-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"13cb74b6bdfe9b2af39effc13c9d5ade5172cb10a5930c6aefbe733c0ab0cad4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"b23898184efef7f96fc649e5d2902d9e6f7d32805be8858eb5f57e88696a09d3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"13cb74b6bdfe9b2af39effc13c9d5ade5172cb10a5930c6aefbe733c0ab0cad4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"652be1bab4f56953c3da93778aeff670b21e92a5d993934466d89aaed158b5b6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b565990bc269af90f4e0533dedaf97fc37dc70b037af910a7605358eda2713f5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"e11de01e8f11e362fe12a9bcc574088487751f93b5de75b1bd8c99739acc40b0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-2-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b565990bc269af90f4e0533dedaf97fc37dc70b037af910a7605358eda2713f5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"4672868f1e2492bd2ac79be6374bbac36317364afff96ce0c9c7ac3d568f0b14\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-2-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2538346ffaabe171687c406d12f294530661f7690a04d14ab2327034447b1886\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"d58c446a6a9364595eaae0256bc0befa6f57ed0387674ac1d6970632cb6b41f0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"df8548d2a100989756489c2811783626f3836ef18d08ba8c81bfb6b9e9ef9c28\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"6e120ade3c6d3506708dea5d54e9bc2fd6306ec4718a0c11f9c0a89c0ea6f1cd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/premium-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"13cb74b6bdfe9b2af39effc13c9d5ade5172cb10a5930c6aefbe733c0ab0cad4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"f9f60e3c0c3c06fefd218a3662bf2dac472c1d5acfd112579332b16c2386f504\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b565990bc269af90f4e0533dedaf97fc37dc70b037af910a7605358eda2713f5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"6f55ce1a1c1254c42ba8a4204eaa5d732a42974a08d182b225b6ac98681f141a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-2-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"79e41416d85afbda9f192c421571f899a58b4937465fe640fd4d17dfb0d8240e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-6fa533\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-6fa533\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"af109b5290beff4991ef93d4a835ce24ed3b0986578fba7947a76ca1a6dd65e2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c17d6c6438d8754832a843b7a082fa7fc719ecd30696a3551f3ca815dd52f28b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"fcc5f235388ea2c13a59ae86bacfc4eb4fab79468e3ee8c91a602bb5eeeec1c9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-2-w2-6fa533/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8abe3e629bd34674437803d6e54a0cb90fe0d0df12d2eac23f0b40d2f4990b37\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"ccb67df939c7a3278e2bb82db8d5dc418650599ab46b4bd1d8fe07cf9bb459d0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"371e486415502802484cc345e68be13e0a37a1abb38f2f6c8cce9f8e79b8d9c1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"b41e21a5fb7ad8cd75dbaa2def82137084248aef58468ce3d04ebccec2987b3b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-w2-6fa533/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8f50bf1a21545f68eb583e07935b8b0da52bbc4743a8bc67c4d9545b76da56af\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"7206c2870629f698a99d45c9e7140cc1334b531b1ad5a3c88c147fac40e793b2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/premium-w2-6fa533/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d4fbd382871bb4f5406c37842f4848012cdca0b01e2d7698dc28e396dc18659d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"4924ec7c564baa67e51d989aa281cf4421dc82ba2910dd5cbc5e8ec66fd31e46\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-2-w2-6fa533/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"503064d3f84a23711f1dad5e35d11ef1efceaefb2204608d180ef8d886666ffa\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"1036f7f4f8b7c68faa7a499350cf496a96528b515b125a726c7e904d5297c1e6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e199374b1d053d8a1ea2fb463b47f0da1b100cb9029acd61282384f0bb2553a2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"fc0e1b2816287c18a95319a2d0a9379a9f7bf931fff586f75645e37973bc0009\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-w2-6fa533/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b3a9fbda204f0b6bfe85682d0fee9fd7a9712977e22af554d2d82ba07f1a075a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"e94cca1d60d77f1db698aae8d99dc62d60279b8e5de4556def17f51ea3d8b77b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-2-w2-6fa533/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"41e99bc62a2ac4e8034135f4b655088597f627c66b2efc4627394d148bc2b0ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"b2fa16adeef96749257d873656ef49327fe454d7ba806ae3a8a73ec44c8a092d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2f2531e01fa8fc0031706fadbba0c1818c30681dcf9d2c65b1c7c23230ea3a32\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"d04838d25723911d554e0017a035ebf67253923630681f27a1c93b44878b1bcc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/premium-w2-6fa533/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7be093b94c77d8e466548a812b2fd67ba6e4cdbef2e705474d1a124d26a40f56\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"89ba01e718f4b0e60188b8031e9bd1e3cf1d64712b57d397151cd36a5d6214df\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-2-w2-6fa533/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f1edf5f89fd287762fbbefa668581cdc8f1877a3f31497227c537000670166d9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"dbf8e642e7e029e70e317d8df7b5d12be0fc1f008d29ff415d7291c09924eecb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cf13f5a3da5f1ddbc441422b55ececcb0ffd227c7be1c942dc1d4c428387bca0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"0aa6387a836e4d80af5fd5a2d66846f1a40192a89e137f80c52334aa6d868a1c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-w2-6fa533/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"afe9746e0af749da011756561a859419e447efc535f5e3f3773b1d18a5b5a9ac\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"7ae7a5b24207da4f6cb3659a8b6639f53e96a876f02aaa1f0a8b92813f856ad7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/premium-w2-6fa533/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"739e19d51d8fbdeccfc8bc7587afd12132239f688ec6cf8d9586f242a71087f7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"5f4124bfb1cf4c49006c1e2d45346f89a11b72e563d9f8e2d4df054bb65c496c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-w2-6fa533/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8309dc44d5088e48040255bf86dbc622de08fc216837cd0027a69bdf179a9d2a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"206d678ecc5400943db26abb21afd48a2ffc6fee651aa73c8301a56858221aa0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/premium-w2-6fa533/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8f577e4cdeda37406cbf43b607fe4ff7a6bd85c0d3b2c53a45b82a9207f437f9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"7cdf48530943053e434f696a48871881d26809d6cd1a88e8b6daa617fd34d36f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-2-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"206e50a9b0e5f83281f994d9f1d85f92406e3544297c47017c081f763b10dd96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"1d9b68bda9fa73e5f8e8ac869771d602c5f128903fd22e64db2370f9749a3113\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6ed7710bfd4535612b60aefac40ff2eebbe50fc666cc75f29a23130bdd6ea269\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"1245658c93fce9ced820408e5e090ae4dd51a7c56161a6cfb1ef978beecc3557\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"313f15eb64d50822c9c91871179d7a6ffa3111f658f213fdc0612575f480add7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"eb5df92dd93dfd3d0bc54e95c455fd8d583232e993ed8aed3db80f624312b066\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"62457e23e29ce9b4e8380d685c5e9e84bc5137e91486a6f9c1c9e352ca3a021c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"957121ddf9ee4c2793cec71a8576e07ee1925a201f93c8de02b6fce446d010d8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1ce9b189744d237515a1896d038a3437e8e31669b01937d8cf3a067728ee7e82\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"672be8f3fbaf802659dc395e46e1b17c7ab1515e557eab74f4c7d2c055ad4cf7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/premium-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"881b63d46f0e94053b88caefbfd71fdab183199879cb564ccb3671b6189fcc2e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"4e3e10829c680ef4fa33002314a596e964d519ea2f3cd6331d666a22cfb597e5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0947683a63afc3251194a3b586cb934b1350dcaa171c4fd826d6773a00d5cf2a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"88202ce79ddf6dca9b8c8b1fbc0aa013155bc9975075ee9158a09c6708287af4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"66eb2a66302c20c8061f062df1542c7ad1db513c8b1988f81768f7d266f6665c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"64c175753cea5698cd255c8a903061deed215a3afcc403ae39f57d7b0f7600be\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fd7deaf8530c822c1b10ef4c1b0887086bc840af6d5c7a730508ddcb6e179095\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"14655ca6105b9121c6e780127a21626d2e779082f0ea2674b0d77647d247a24c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5ea067858e444716d33ddecbe718b086e12804ce72bba0a6f135b64fb1bb1c60\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"c88bc53da3544fc41175edc07ced29960aa58c4f7ebf17609eb30f993b862ccf\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"828fe179b1caaef8c4abb4ba71cbe53ab31fc04108a1194889605dd8100c90f1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"f249401e68d6dcd41e2325910ee9db0254c3afa92a19923e1751980966a4694d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"60ca770315801fd35b67ab23639ba4ac6a344fcf95fe492c267cc87cb90ce14f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"d7f0af7e7ca785bc5de89e740ff47459e16eb3ba9360c1eee59d6d8d2f7389bd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6d6f6c08f92b4cefaa6a997643ec612cf9c62df4fa750dd0f5d4c3d50d40d2bb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"daf823a39b0f169fe5f258178380bcf0b3e996152ebcc401fb21de178f041b24\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5cddd3e1918c7df14f710eb09cebc745d043be6f81e6c1e1f2a3803e2f0c6513\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"b1d5e4fa434bbb80c0f5baf3d8ee1797394841413a8f28625f4e0c9d2388764b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1f83c46a7c87c216ad3b7a3697a1ad6c518cb36972a910efbc3c7eed6ab3956a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"496ec6213c84428bc1374936695dcb9246c04c80a4460a92e53220e4641a7116\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e701c3e95fd6d7e3e60b9f162039289bbc904c42df899db9436b6ad7538d1ffc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"576f13852617450ef4f108d2d8c65426c74c6f743bd5e3d6530d746e72633fbc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"25cb748ea88f201b192c863c4e2fb40e5931cd9cfed0d04ae104e35dbe48f38b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"c49c039641c1cdbec2a8f5cc805b4b722943e1336d082080571a2f2fcb073186\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ad04b751b35d313ca76c5057f5e800aa0d5504bc27298aa1762dd803d351bff2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"a24ccfd407372af3bd4160c32a086ddd01bc5d92e15a1f783cdc3f7d8f642124\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3ecbc6560d7cb2e5396471349d24b95ff664f3b33dfc188e590c2b772721287c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"2e058e1b6b4635806a5e2b8fb08fed6fd11db7595be6907f89a86777a30aa9b5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f27c742360d050f8cfba473367fd8076f0a6abdf57b30c6116d8b1fa7559bcc0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"b7571ee2e0ac1a2c804f33ccb2108d7694841ff5c0b7595435bea59672db0c41\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"319a8bd03b55a51284dd6790058e026879ed8db3e6d527dedb4a9314473afa5b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"ac54aac970a6722b49c3410bffc6b58a3832c579aa7c3629ff80507ab769f2d3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8be72fdf7a1e6b1379ac7dc12f7c40286d882ef14376e9fd3e726b2fb781546c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"ac78bc480a068b655886c2d9dd75e3a680756398111216d2be7e8a3e730e4206\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"23d2f913b5bde1ed64144a38680e6282220982f4f5ea1167fabdda3234dbc67e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"c6c6e62fb02ec82dd2ad63c3690b3887e0701c293e1871ee382d92ea80f88f66\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"51e9e3c7450b52b22ca45c280738926226df3d95852d8df43ff47cf85cca9e5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-6fa533\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-6fa533\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"64fb7512cad2bf5a1c9b6978a7f9de714d5a739282aa9ca951ee3b4f417da286\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"dfa08453b9c8623db01e432dea4f9e09b3d7f80cbbee3a69df753c6d3fbfbded\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-6fa533\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-6fa533\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"af2b1c5e2c0a798508b2ef3249c778b1b43898c8636c878f66d20c220701a6f4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"517c7132d716e14e14b2c9fccd696f86bc7a24a46c391e71d07ac910d0dd1c18\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-6fa533\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-6fa533\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"ee9f66c18cbc8fcbae62d62e57dcbad633d943ff04a829fbc8bb030c121bf426\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b93afde66771848b5188f78e530f2f596324f9fb9f05b2dd8f1cb49489f2bda1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-6fa533\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-6fa533\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"c514ea15546ae0041f8d77a7e65bd51a98d808edee2739e914353f03c270d86d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"de3ca7c8a9dcdebe0c2a67b74b3bc72bdc4a8f34aff1f0c69df675fbb03b1e05\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-6fa533\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w2-6fa533\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"985f90a1588b57b9e2061e7440127c4729ab98e674bb91d1e90364de9aea35ad\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"edbbdcfc920b88151941be1a4c41ad8be6a38bd6beddae7387db202bc3e9b302\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__89e97abd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"596d26e942c05757\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-simulator-w2-6fa533\"]}],\"name\":\"15153104d9c89c44b59d96d9d8825fe62d21af5bd4db90b6c300fa53823a0ef0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bf3fa706be871596c50143869f253e98ce7aa463d723d2f419d378a041dbfbe5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__bd2929e8\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"699e021178016276\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w2-6fa533/maas-trlp-premium-w2-6fa533\"]}],\"name\":\"4e925c4610a758f575689b807fc7a61cef2c3891e2cf0a1c1074186e65a2e8fd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/premium-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f09ce0bd9bc651317469310c8a604d792e7c7c55751d184a920638cf66ba0dd5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"499fc57e7a454d5bcd94feeb06b43584bb9133eb048e9ee5f20041a16d87ebaa\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bc33498b2dcdc2f8d2612aa17c0e640458a4442c9d7f2ad45303aeb15b5bccb9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3325065e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w2-6fa533\"]}],\"name\":\"7ad42a3389048956d61fafc75400a2a68540cd2e35da26f1e7b80db45868f7dd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-2-w2-6fa533')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-worker-w2-6fa533"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-worker-w2-6fa533\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:30:28.218Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-worker-w0-0c9014","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T21:21:39Z","generation":7,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"ddb57683-c2b1-4246-8c87-c1833e256a52\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:29:31Z"}],"name":"kuadrant-e2e-worker-w0-0c9014","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-worker-w0-0c9014","uid":"ddb57683-c2b1-4246-8c87-c1833e256a52"}],"resourceVersion":"38946","uid":"3a59a593-1a36-4e21-9529-ff8f3620d431"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"86115b8156c50eab2036378ac37ec53b33537f0eef44a4aa5d81752c24254c82\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"c69d9902b654dc255ef5aa6007c01753aa727fc097ae6b83d952cc0cf913761b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bdc9387e460a2dc1a85bc42d8ce6440788e8331159ace91b443c9628ef7c1fed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"2f68643a3c63d5b17fdfef48d85bd91a0973501f0d563a896e4b380a0b00d185\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e1cab00a309f6035001c6bed21b280b9cd6d81b83072c8f351fbe860f69886ad\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"d886729ca10572769b8b41e68ee56fb12942ea073f0b48ede22b1cc50bfcc40f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fe65e47ea66e64f823a934786806a737bfe3ca692bad4019774d91daeb2348d1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"e10af8f1a2640cf1de04932f79e79764db98097340db6ec566b3ab0af709d0d8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"86115b8156c50eab2036378ac37ec53b33537f0eef44a4aa5d81752c24254c82\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"34720a2e4d6ed7817a277e99c8b6c63bea050141799be3b70b3690e8575a06a6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bdc9387e460a2dc1a85bc42d8ce6440788e8331159ace91b443c9628ef7c1fed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"3a712e9256a22351eb20be5c7695beb1ebb8fb8ce2b2061a380c7829f310a235\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e1cab00a309f6035001c6bed21b280b9cd6d81b83072c8f351fbe860f69886ad\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"24d4dc5eb03a2701700ed1da77fab5dada30f4d5f19acc2aeb784ab7c2913842\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fe65e47ea66e64f823a934786806a737bfe3ca692bad4019774d91daeb2348d1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"95b56d1eb3f5f986a8dcd4728f616565f9664996c1a434f44f7b87c3972457ca\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"86115b8156c50eab2036378ac37ec53b33537f0eef44a4aa5d81752c24254c82\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"f831f6710914a69194c3f7c48e2651f7e183a1e62afcb27c73307245ab045f93\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bdc9387e460a2dc1a85bc42d8ce6440788e8331159ace91b443c9628ef7c1fed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"ad3a2d8079306ff1eeb9734837c5b71f0724eb8028848f90dbf05b80557a363c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e1cab00a309f6035001c6bed21b280b9cd6d81b83072c8f351fbe860f69886ad\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"44114992b7dce232405acd1cfada4b72839265de04c15b8c8b12cba013144276\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fe65e47ea66e64f823a934786806a737bfe3ca692bad4019774d91daeb2348d1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"a594b6f1c0a2b22e4714c27e98575eda080192ee3760bdfca9b4ad6aa516eee0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"86115b8156c50eab2036378ac37ec53b33537f0eef44a4aa5d81752c24254c82\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"de21a6b7dab6f53ab9e521b41625d35020e107d76ddb50e2958e0e2a412d9e40\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bdc9387e460a2dc1a85bc42d8ce6440788e8331159ace91b443c9628ef7c1fed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"9d9413f8be4dfb8834299266127fb239516760f378a7601605194b5533f62a28\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e1cab00a309f6035001c6bed21b280b9cd6d81b83072c8f351fbe860f69886ad\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"b608ac3153414f90d7bc1d459d441fc96968144e3d07d2286f28927e15b1e621\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fe65e47ea66e64f823a934786806a737bfe3ca692bad4019774d91daeb2348d1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"31897c718cc142df0d5d16918dfaf37807fffedaa54950878ada2e28c78ed1ea\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"86115b8156c50eab2036378ac37ec53b33537f0eef44a4aa5d81752c24254c82\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"0f90af4971cd47ea5ddd60d45eba18a900b5cf23592a3f0ecd9d46778e3738e0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bdc9387e460a2dc1a85bc42d8ce6440788e8331159ace91b443c9628ef7c1fed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"93ac09aaab9c4f036a2bdd254b8b96a4151063abefd4189c40778e53ebecdc09\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e1cab00a309f6035001c6bed21b280b9cd6d81b83072c8f351fbe860f69886ad\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"8791484f6beb20141c5c557cf7cec8b4649b67a98f43b54539a6ee6a88bceb5f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fe65e47ea66e64f823a934786806a737bfe3ca692bad4019774d91daeb2348d1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"5009bcd6ede0ee206f1c68b91ea406216f5da58a2b1c5f056ba6778c5f13d641\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"86115b8156c50eab2036378ac37ec53b33537f0eef44a4aa5d81752c24254c82\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"140e618f0bcaa91b635c87d4f29e5f8813bf0436d1f6e9b36373faecbdec61eb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"86115b8156c50eab2036378ac37ec53b33537f0eef44a4aa5d81752c24254c82\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"6acbaeb49e85ee3cb000f040214618990342fd0a59de5b2c5a1f90647758a246\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bdc9387e460a2dc1a85bc42d8ce6440788e8331159ace91b443c9628ef7c1fed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"5b6e6a7f7dc5f0d34eb857ca49303262b3c223fe67458805f41c060248c5dbfe\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bdc9387e460a2dc1a85bc42d8ce6440788e8331159ace91b443c9628ef7c1fed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"2127668fa8fef2292ac1484bc4a37390a4f7d56256dc3e5dbee6c3e5a11a9b76\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e1cab00a309f6035001c6bed21b280b9cd6d81b83072c8f351fbe860f69886ad\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"0aa314d93ee3acda2c2d9263c7d5271f8931007a465cca802fa4f97f82de8fea\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e1cab00a309f6035001c6bed21b280b9cd6d81b83072c8f351fbe860f69886ad\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"cb70a8e00aa575e704bd5c438dfcc5d7f8961efe6033fd93fae3fc6eca018120\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fe65e47ea66e64f823a934786806a737bfe3ca692bad4019774d91daeb2348d1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"1acbce7018705c04168bda5187e037e60c0fe47f186f10f96e84266e33b5b034\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fe65e47ea66e64f823a934786806a737bfe3ca692bad4019774d91daeb2348d1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"52baf0b74be4e68628b5b4ef71a9d95dad1cf739658ce467c9b24c3165eac562\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"86115b8156c50eab2036378ac37ec53b33537f0eef44a4aa5d81752c24254c82\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"a9b1a49056b3283c82e0d4f88ad61bed5b6f4b736a70f1bb2ef4ba19a80a05e0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bdc9387e460a2dc1a85bc42d8ce6440788e8331159ace91b443c9628ef7c1fed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"30c85ca7419d0f9a695b73530b16cb571b50e9dde62c1210e8c4fe44c14e4def\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e1cab00a309f6035001c6bed21b280b9cd6d81b83072c8f351fbe860f69886ad\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"5a52f00c07e5813093290d1bee011f0120610619cb82666a79b0139919644d6e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fe65e47ea66e64f823a934786806a737bfe3ca692bad4019774d91daeb2348d1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"309ad48f4f9314f702e5565256eb6d81567787f6737820f7ffb21a6d85a92b93\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"00c4d48b9f06a2f5dbb9cbe22ae3dcc9e10401b038e62058849dcebe2769e4f1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-0c9014\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-0c9014\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"02e0339b7fefd72794f04b407e26149d4822a36b0c408bf1129e0f7ccdc0cfdb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"884ebceaf8f5da21059151f97834277770ed77023feb57f83fc8c75e495f8d1c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"bb55cf856b87c0953ba4478213144ef02787b3cbbf80cc32e530521407ee40b0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7da280ddad70ebcc1b84b8a595244d0682cd0302755439371683331c4562cfe5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"23b1ef8cd3219264f8227915650891004d0dbf97a799031e0e6e6967fcd5f1c8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fe169ab2014a705a54df2fda4ec719f7132fd6bba54202f7531ce8df8da2bdf6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"5f4fc30622e992160dd04a2ed38f7e44c1794374d6682ae9f1f7ca01be3ee831\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8cb0b0d9cbe25e4182aea7d2ed6f3ca636a7d0c9be364f722b182dde26da45e1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"ca6fe2da7884bdf4da7e4fad467882fb9f7b1a542ef29da25c93b58c0a2facf5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5f8a52baf63f9e4c9ea31b6e22c9076262e33bc06968bbcb213439af05ae3a21\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"4e45e802c43f08adeba0b390be3827705a757991fe469c439db480762890906f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9a7eea6dc0fbfacc7f1b1980a90d1b04de88692dd5758d6a6457477b77a64673\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"0657b3667bafd18f07dc410bc515b76f51256e8c487baf4fe36409a313e6191e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ece9796b491eeaad9788ab6c426bb54d8cbb85433a9010ef2c4d3f579cca0db0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"5b95fd1a3cba680d3078cbfcc3ed349106804d68df9ff279d7829f1ce54c9fcb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3d645f3ac772a0cc5a9a71b4e6a542a2b2ab9962190903cb5d89d3e8e45b7f9d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"d61768c90b21a96135005ba91b0f0abbf7ffc2bd4f372c506a740a4d2280118a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bcf1ddf402fe28df1f45e616a2e2380b51177c45a7f8dcdd03bc2aa6b5814d26\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"0d7aee7ae66dd59feb746b56375d3063a0a395dd032211e5f6fd8a79acc4c534\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4cc208f8f31098b1cdf91b5776a85b52bae0339e659b20995e8ad11208703993\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"d480cd881add8aa6a454eefd0ff4a4f1883e0f31dd0af2c4fc8d49930dfd988a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"096fbc9d544918ac5b9d60464268ef3b1f03546e96ed130c743da74445576f52\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"862991ab77df3e7a553882c71a94c90c8006da4badbb5d62b2523a0c2ae8397b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"228ec96802a09009d984b3728e4e96175fefb32ba2e3b918071e85b3f8ec79d0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"1174da5781e0d01a3f99ec7d577f0c792e9d2f3d97450b0297d625c782aae7c6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6d14c0784badaddad1e95c3697462cedd1c5a5cf32d3a98f16155abc0721429e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"c6601f905085efd63830b0439c759fd2e17f4b3a0625b37e6ca853dfb418a3fe\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"669fd13dfb6f84f6e255bbee071a63253e1d5bd80a372cb6a445299b3c53a1a6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"aae79ba1b6eabe4b8be62d566c21c48755697af6a5a955ca0108115f218409f6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b0bfe3b1d3a080ff25e482046cf0d1df0ca30a090ef9f8424787467410af7627\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"cfedc7f35c0353d53fec0474975ad5e05c19ec8b2ac4718a77f59ccd7fb1233c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b0476fc7cd4ea3306c893f375fa8b815ad5c84676dd8000109732b76fc6c9e7d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"2fc0502446287f4669be2a416f781c0acba21256ff9eb15861862053f18d0e29\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4dcc64ddad4ef375730fe33c8b8925944bf0c1750f66d8a3347219a51dd190d3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"fe7515ad4af2d0fbe432bcf9bb564a76c332dd67819f108c4e0ccd547ada4eb1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a24eea90cd520665ff61391c71ddaf8965158b1b42c4e6f9fe99dd03dfa7c401\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"2036d4e41537afdd08f850cbe0bbe0d23c83b572c0c1f917f2cd718904dfce6d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1cd65b24c576b1e8f7a954fffca2225dfb109bf5a068107003d4f72206723e55\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"909bedc4bbf04ca094fb3d369cf7cb3b15d83ab3e98ef27c04ee79b787659c95\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"be088898c71049f4ea232cae6dd479dfab1a9947fba6b17e7353ce14e639507c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"cfc0c9b5c46987f78f689a5a334275694f4c03653d50c2fbe6e969e238c7f8cb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"03e9bc99c98697160f9a6db2252bc0ba9e88e4ed113a3d5d851256f6cee3dcab\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"642d89c776f69505ff2a885b3a3e0374200ad36c578ca4799ed899b1dc0cf546\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0e0bbf1b6879cb3f68f7ea7f2afda47c74a88c5d3cb97fdf3e110cdc54718649\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"f05bad08945108f9026112e207cee46af50e92faf4445f0e991b27b9412c4c58\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ad6b1369f6065e5d01605f83113ef1c7c93ed4b3fa8d01ad81d870c4a418f675\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"9eb0cbcb37fa43674c71b90f27589d7260b93ced662c1ceb0efe4cb1f91dab4c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4b932ff2b149c42a260b63c5bdd2b0515a398d1964de7381e0735756ee620b8e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"6fbda76757cae53d56b898432e232fb51847f0a1452503c1d53bf530847020ed\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a8ba5320fff14c281f32c2b0a9e757f0e205aace00c294b0d13fa46185724d35\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"8d788326bd35d2b328ba885da80b8eac2f0f1f55930d0bd275aa0c5fd637e227\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0ad1aa31e975e4b569a9617aed9c37982646578e71674b0d96896f60dc232a90\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"c8ee3691fdd0cb6a376274ca4ee98e52cb5718f985d4f539fb764ae6116296f6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0be4b31b8961f89b18ef02b2a56a0b76e7cb0d94a4440a467414ac2d9a504010\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"235df022eefeafa48d660af3720c4cb0c0fec34ddef36d3c467db88f9a57b07f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"69645d92530f5991fb0c1154aa418715dafc9eb9b4b827c33aa742687b00c4fc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"b449a8480f629d5de320a05efeec5a558221dbb03b4dac7572367202e5ec4e3a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"96d049688a520cd26e12f2232f544b815eac1611ab00713e2f641e57b40e5f84\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"bc1544ecfcc1a9c24b532fcd9001124011a4a99e354877a6f611310592c512dc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fbfa7264341556b62c34307c6c836c7e015aeca2df10913c89f8c2d9d38fd28d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"787567c7ebc18db7ec0598b9dbf1466caebf9a1d07f97cfb4afbc3f8bc3fd0e4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"03938d68f68953b697b7b9ec3a9bb3205251dab0d8c28c8488a51872990c74d6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"0d7a95a011dd25d93bb4476331e0b43d38df072b07b758073c5e89ae27e7c6e3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea4599ace477623ac871dedf5650245e6a589cd60cb7c50944431b6bd5453ebc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"06aff6eabb02cda098099e156015c1b3f2389b929e7df774b34188d1589de73e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"463f896d9e9b5a3f2518e764053718a018fbe93828587f90cc4250e5a67a2236\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"88eb8224ce85abcb39e51aee14e03c01d32d86bc4f686e66279e969a1413d263\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d2e0eee1c8e9f13da0b4cd4af8a834f482ac80e1620cc44747922a7c61d6a51b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"203a868aa43281568c0e425caebe830e36d9bb16cabaf6e7dd92722711d4e496\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0dcf2663d1fa4c3fb5056f3703d9d1a316345e3f4ea0e2503f77738258a9e6a2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"c4e555c424bbb24fa529375505443d3163dbb2379b150d3ae00c6689e4123fae\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"29a6e78291fb6eb1600fcc523c35316897713ec3a1f3092074998de0701a2bff\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"220018b07e05f37b279946d5b903a8c5295a21774b20d317b40db4ae44ab089f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea78fba3abdfbae2cfbad8389b4c97d45d924dfb8eebd29422ca7a2b62f9564f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"86fdf51aa1b29a978535560d7a45ad778e5802bfe467d27e1295c743248d1507\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"dcddce6770eda2db3f8f60d8b51b5ed927194e11c56d328f35000b6f5e92dbdf\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"df9a2fd989201e2d0ef8377583b501f9afac6836df894071bbae9e6b6b2598f4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b8e8a49e358e54b12e2aba59e563ba17bcf32315bebde13a721f3b7ebfae18ba\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"742ed2fd7d94f5d252aeaa965657e054bac8691ea31b81375ab8a5488c2f2888\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"327ad026e5a9c61ed15c52c9e2fb0c219e4d9a636a17ed736f525f2b42ebfd6d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"8b45807e9f971b175f77e49aa0f5e281c0245f33f6942f95c36aedfd7d419199\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"59093ab44195ceb3a72fd7400b422644d3d7c840cd3e838bafbbcf827cbcc073\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-0c9014\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-0c9014\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"bde801ad48bcba39a3cf88516077f8fad94dd2ce0692d0f274ab650cb9cc6614\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fbf5e5a312486cd624620a8628b976f89d3b75ffa1d3e47224c08e003294432f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-0c9014\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-0c9014\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"047906c5f7db776a9bd905e481a3347b0c84bd6edf626dc5626ed91115c7408a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cbaea0f78f7b655ed1c234a9fbf7020e12e29bee546d39c314b814aa1692620f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-0c9014\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-0c9014\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"1e414f5eaffdbc43cdaeda8552267e2b46abc1a6b41adfdb24735f3843a9c51f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2ab986aa56245948b966f417e9db684ac2bae70862e05b68a996c57de4d7c4c9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-0c9014\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-0c9014\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"3f61be5c1cb2e788fb6ec123b23519795a5d4fa05fbf9eb842b61931843e1834\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"83f9aef31a325eccb5ee1ca5935289e892a53f7f9d05ac2a6d2b8a973624d6db\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-0c9014\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-0c9014\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"ead8e640f12ec2a2a5b9632dbacd377499d067469c52a5e5c7791f29393639d3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"93867ab0bab47561de7ff57c3a2f54a4e134cfb5a3ee35d78ee703589d669077\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"760f6f0b0f0dfc05ff96616a7ebd6878ae6a8e384823348a74bc46e7ee6e70ab\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"06c24ca69f585351676e3a47fdf7a96df9b9a8fe85641e1c3348c8cfdfe446cb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"2089b2caaee71efefb7e26192d15a3376881340fd07cbc304d192587b50b0c07\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f713c09235fdc689702761ce6f8fb3c2c03ea75f66382e5121160a24cf7aee9d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"78522ace7509d509793c07978801f1f4bab7d64f1ad59df33af972c953cd6851\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6b6f55f762b51c1f46156308a7f509359377c543fd3789f104b3416ff46e3216\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"06aab5232bb89b6e09b9780286eb3fceeee4557f3ea4efd5ede8278ad6c21170\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-worker-w0-0c9014"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-worker-w0-0c9014\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:30:28.420Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"maas-gateway-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"maas-gateway-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:30:28.591Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-facebook-opt-125m-simulated","namespace":"llm","uid":"da8edb1a-ed61-454d-939f-fc7cd235d9fb","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-facebook-opt-125m-simulated\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:30:28.856Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-worker-w4-d6cb38-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-worker-w4-d6cb38-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:30:29.147Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-e2e-rt-sw-847782","namespace":"llm","uid":"ac76a284-ab3c-4e2d-94fd-5ea4dec861ab","error":"tokenratelimitpolicies.kuadrant.io \"maas-trlp-e2e-rt-sw-847782\" not found"}
{"level":"error","ts":"2026-11-02T21:30:29.206Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w0-0c9014","namespace":"e2e-models-e2e-worker-w0-0c9014","uid":"4f647df6-1d5b-433b-b4fc-1279ff1755f7","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w0-0c9014\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:30:29.522Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:30:29.522Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T21:30:29.652Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"distinct-w2-6fa533-kserve-route","namespace":"e2e-models-e2e-worker-w2-6fa533","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"distinct-w2-6fa533-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:30:29.775Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"distinct-2-w2-6fa533-kserve-route","namespace":"e2e-models-e2e-worker-w2-6fa533","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"distinct-2-w2-6fa533-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:30:29.855Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"distinct-2-w1-5f765a-kserve-route","namespace":"e2e-models-e2e-worker-w1-5f765a","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"distinct-2-w1-5f765a-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:30:29.982Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"maas-default-gateway","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"maas-default-gateway\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:30:37Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-mt-70efbbab","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-mt-70efbbab","reconcileID":"b0c3c1a8-026d-43a2-b0dd-0ad6aae23088","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-mt-70efbbab","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:30:37Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-mt-70efbbab","event":"CREATE"}
{"level":"info","ts":"2026-11-02T21:30:37Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:30:38Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-02T21:30:38Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-02T21:30:38Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:30:38Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-mt-70efbbab","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-mt-70efbbab","reconcileID":"99284389-ca04-4628-8f58-4a7fc79da7d9","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-mt-70efbbab","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:30:38Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-mt-70efbbab","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T21:30:38Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:30:38Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-02T21:30:38Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-02T21:30:38Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-02T21:30:38Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:30:38Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-mt-70efbbab","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-mt-70efbbab","reconcileID":"ae50bce9-952b-4246-a500-e0d69fb645a2","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-mt-70efbbab","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:30:38Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-mt-70efbbab","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T21:30:38Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:30:39.125Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","HTTPRoute","Gateway","EnvoyFilter","TokenRateLimitPolicy","Limitador","AuthPolicy","AuthConfig"],"eventTypes":{"create":2,"delete":8,"update":15}}
{"level":"info","ts":"2026-11-02T21:30:39Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-02T21:30:39Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-02T21:30:39Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-02T21:30:39Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:30:39.256Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:30:40.534Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:30:40.724Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:30:40.724Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:30:43.472Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:30:43.476Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:30:43.476Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:30:43.488Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:30:43.488Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:30:43.494Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"error","ts":"2026-11-02T21:30:43.554Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:30:43.554Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T21:30:45.314Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-distinct-w0-0c9014","namespace":"e2e-models-e2e-worker-w0-0c9014","uid":"f8486e18-d4db-4692-aa96-fcde638df78b","error":"tokenratelimitpolicies.kuadrant.io \"maas-trlp-distinct-w0-0c9014\" not found"}
{"level":"error","ts":"2026-11-02T21:30:45.785Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w4-d6cb38","namespace":"e2e-models-e2e-worker-w4-d6cb38","uid":"486176e6-7786-40c4-9ce0-6f4a68b408b2","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w4-d6cb38\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:30:46.243Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:30:46.243Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:30:47.668Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway","Kuadrant","HTTPRoute","AuthPolicy"],"eventTypes":{"create":1,"update":3}}
{"level":"info","ts":"2026-11-02T21:30:47.839Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:30:47.853Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:30:50.549Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:30:50.567Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:30:50.840Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:30:50.940Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:30:50.940Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:30:53.234Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:30:53.246Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:30:53.252Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:30:53.252Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:30:53.252Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:30:53.269Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-11-02T21:30:53.327Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:30:53.327Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T21:30:53.381Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/528f8663751fc08f3e8ae4ff6fd43a63d61572c7f149dc0fe75912f5f4b33047","error":"authconfigs.authorino.kuadrant.io \"528f8663751fc08f3e8ae4ff6fd43a63d61572c7f149dc0fe75912f5f4b33047\" not found"}
{"level":"error","ts":"2026-11-02T21:30:53.436Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/b278a3f65d6cc70c6e2d022678205eee6ccd6b0dd1185b975c61ea5d681e4fa7","error":"authconfigs.authorino.kuadrant.io \"b278a3f65d6cc70c6e2d022678205eee6ccd6b0dd1185b975c61ea5d681e4fa7\" not found"}
{"level":"error","ts":"2026-11-02T21:30:53.491Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/2ecffd49fe780ea8d7ee498582caa2c41bc635ad490315792e681c7defe84b85","error":"authconfigs.authorino.kuadrant.io \"2ecffd49fe780ea8d7ee498582caa2c41bc635ad490315792e681c7defe84b85\" not found"}
{"level":"error","ts":"2026-11-02T21:30:53.546Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/098187a2b31ef966f647c443716610cb8d70bdafedfed7bbd4f8b1b568817678","error":"authconfigs.authorino.kuadrant.io \"098187a2b31ef966f647c443716610cb8d70bdafedfed7bbd4f8b1b568817678\" not found"}
{"level":"error","ts":"2026-11-02T21:30:53.761Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-worker-w0-0c9014","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T21:21:39Z","generation":8,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"ddb57683-c2b1-4246-8c87-c1833e256a52\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:30:17Z"}],"name":"kuadrant-e2e-worker-w0-0c9014","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-worker-w0-0c9014","uid":"ddb57683-c2b1-4246-8c87-c1833e256a52"}],"resourceVersion":"40777","uid":"3a59a593-1a36-4e21-9529-ff8f3620d431"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"86115b8156c50eab2036378ac37ec53b33537f0eef44a4aa5d81752c24254c82\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"c69d9902b654dc255ef5aa6007c01753aa727fc097ae6b83d952cc0cf913761b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bdc9387e460a2dc1a85bc42d8ce6440788e8331159ace91b443c9628ef7c1fed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"2f68643a3c63d5b17fdfef48d85bd91a0973501f0d563a896e4b380a0b00d185\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e1cab00a309f6035001c6bed21b280b9cd6d81b83072c8f351fbe860f69886ad\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__339b427b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"b000a1cb08b465cb\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-distinct-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__339b427b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"b000a1cb08b465cb\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-distinct-w0-0c9014\"]}],\"name\":\"d886729ca10572769b8b41e68ee56fb12942ea073f0b48ede22b1cc50bfcc40f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fe65e47ea66e64f823a934786806a737bfe3ca692bad4019774d91daeb2348d1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__8d3565fd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"5bbbc901b17a1196\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-distinct-2-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__8d3565fd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"5bbbc901b17a1196\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-distinct-2-w0-0c9014\"]}],\"name\":\"e10af8f1a2640cf1de04932f79e79764db98097340db6ec566b3ab0af709d0d8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"86115b8156c50eab2036378ac37ec53b33537f0eef44a4aa5d81752c24254c82\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"34720a2e4d6ed7817a277e99c8b6c63bea050141799be3b70b3690e8575a06a6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bdc9387e460a2dc1a85bc42d8ce6440788e8331159ace91b443c9628ef7c1fed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"3a712e9256a22351eb20be5c7695beb1ebb8fb8ce2b2061a380c7829f310a235\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e1cab00a309f6035001c6bed21b280b9cd6d81b83072c8f351fbe860f69886ad\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__339b427b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"b000a1cb08b465cb\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-distinct-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__339b427b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"b000a1cb08b465cb\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-distinct-w0-0c9014\"]}],\"name\":\"24d4dc5eb03a2701700ed1da77fab5dada30f4d5f19acc2aeb784ab7c2913842\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fe65e47ea66e64f823a934786806a737bfe3ca692bad4019774d91daeb2348d1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__8d3565fd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"5bbbc901b17a1196\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-distinct-2-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__8d3565fd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"5bbbc901b17a1196\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-distinct-2-w0-0c9014\"]}],\"name\":\"95b56d1eb3f5f986a8dcd4728f616565f9664996c1a434f44f7b87c3972457ca\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"86115b8156c50eab2036378ac37ec53b33537f0eef44a4aa5d81752c24254c82\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"f831f6710914a69194c3f7c48e2651f7e183a1e62afcb27c73307245ab045f93\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bdc9387e460a2dc1a85bc42d8ce6440788e8331159ace91b443c9628ef7c1fed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"ad3a2d8079306ff1eeb9734837c5b71f0724eb8028848f90dbf05b80557a363c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e1cab00a309f6035001c6bed21b280b9cd6d81b83072c8f351fbe860f69886ad\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__339b427b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"b000a1cb08b465cb\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-distinct-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__339b427b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"b000a1cb08b465cb\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-distinct-w0-0c9014\"]}],\"name\":\"44114992b7dce232405acd1cfada4b72839265de04c15b8c8b12cba013144276\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fe65e47ea66e64f823a934786806a737bfe3ca692bad4019774d91daeb2348d1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__8d3565fd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"5bbbc901b17a1196\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-distinct-2-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__8d3565fd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"5bbbc901b17a1196\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-distinct-2-w0-0c9014\"]}],\"name\":\"a594b6f1c0a2b22e4714c27e98575eda080192ee3760bdfca9b4ad6aa516eee0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"86115b8156c50eab2036378ac37ec53b33537f0eef44a4aa5d81752c24254c82\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"de21a6b7dab6f53ab9e521b41625d35020e107d76ddb50e2958e0e2a412d9e40\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bdc9387e460a2dc1a85bc42d8ce6440788e8331159ace91b443c9628ef7c1fed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"9d9413f8be4dfb8834299266127fb239516760f378a7601605194b5533f62a28\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e1cab00a309f6035001c6bed21b280b9cd6d81b83072c8f351fbe860f69886ad\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__339b427b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"b000a1cb08b465cb\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-distinct-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__339b427b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"b000a1cb08b465cb\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-distinct-w0-0c9014\"]}],\"name\":\"b608ac3153414f90d7bc1d459d441fc96968144e3d07d2286f28927e15b1e621\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fe65e47ea66e64f823a934786806a737bfe3ca692bad4019774d91daeb2348d1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__8d3565fd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"5bbbc901b17a1196\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-distinct-2-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__8d3565fd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"5bbbc901b17a1196\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-distinct-2-w0-0c9014\"]}],\"name\":\"31897c718cc142df0d5d16918dfaf37807fffedaa54950878ada2e28c78ed1ea\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"86115b8156c50eab2036378ac37ec53b33537f0eef44a4aa5d81752c24254c82\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"0f90af4971cd47ea5ddd60d45eba18a900b5cf23592a3f0ecd9d46778e3738e0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bdc9387e460a2dc1a85bc42d8ce6440788e8331159ace91b443c9628ef7c1fed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"93ac09aaab9c4f036a2bdd254b8b96a4151063abefd4189c40778e53ebecdc09\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e1cab00a309f6035001c6bed21b280b9cd6d81b83072c8f351fbe860f69886ad\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__339b427b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"b000a1cb08b465cb\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-distinct-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__339b427b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"b000a1cb08b465cb\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-distinct-w0-0c9014\"]}],\"name\":\"8791484f6beb20141c5c557cf7cec8b4649b67a98f43b54539a6ee6a88bceb5f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fe65e47ea66e64f823a934786806a737bfe3ca692bad4019774d91daeb2348d1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__8d3565fd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"5bbbc901b17a1196\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-distinct-2-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__8d3565fd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"5bbbc901b17a1196\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-distinct-2-w0-0c9014\"]}],\"name\":\"5009bcd6ede0ee206f1c68b91ea406216f5da58a2b1c5f056ba6778c5f13d641\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"86115b8156c50eab2036378ac37ec53b33537f0eef44a4aa5d81752c24254c82\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"140e618f0bcaa91b635c87d4f29e5f8813bf0436d1f6e9b36373faecbdec61eb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"86115b8156c50eab2036378ac37ec53b33537f0eef44a4aa5d81752c24254c82\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"6acbaeb49e85ee3cb000f040214618990342fd0a59de5b2c5a1f90647758a246\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bdc9387e460a2dc1a85bc42d8ce6440788e8331159ace91b443c9628ef7c1fed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"5b6e6a7f7dc5f0d34eb857ca49303262b3c223fe67458805f41c060248c5dbfe\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bdc9387e460a2dc1a85bc42d8ce6440788e8331159ace91b443c9628ef7c1fed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"2127668fa8fef2292ac1484bc4a37390a4f7d56256dc3e5dbee6c3e5a11a9b76\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e1cab00a309f6035001c6bed21b280b9cd6d81b83072c8f351fbe860f69886ad\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__339b427b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"b000a1cb08b465cb\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-distinct-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__339b427b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"b000a1cb08b465cb\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-distinct-w0-0c9014\"]}],\"name\":\"0aa314d93ee3acda2c2d9263c7d5271f8931007a465cca802fa4f97f82de8fea\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e1cab00a309f6035001c6bed21b280b9cd6d81b83072c8f351fbe860f69886ad\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__339b427b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"b000a1cb08b465cb\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-distinct-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__339b427b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"b000a1cb08b465cb\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-distinct-w0-0c9014\"]}],\"name\":\"cb70a8e00aa575e704bd5c438dfcc5d7f8961efe6033fd93fae3fc6eca018120\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fe65e47ea66e64f823a934786806a737bfe3ca692bad4019774d91daeb2348d1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__8d3565fd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"5bbbc901b17a1196\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-distinct-2-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__8d3565fd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"5bbbc901b17a1196\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-distinct-2-w0-0c9014\"]}],\"name\":\"1acbce7018705c04168bda5187e037e60c0fe47f186f10f96e84266e33b5b034\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fe65e47ea66e64f823a934786806a737bfe3ca692bad4019774d91daeb2348d1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__8d3565fd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"5bbbc901b17a1196\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-distinct-2-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__8d3565fd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"5bbbc901b17a1196\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-distinct-2-w0-0c9014\"]}],\"name\":\"52baf0b74be4e68628b5b4ef71a9d95dad1cf739658ce467c9b24c3165eac562\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"86115b8156c50eab2036378ac37ec53b33537f0eef44a4aa5d81752c24254c82\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"a9b1a49056b3283c82e0d4f88ad61bed5b6f4b736a70f1bb2ef4ba19a80a05e0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bdc9387e460a2dc1a85bc42d8ce6440788e8331159ace91b443c9628ef7c1fed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"30c85ca7419d0f9a695b73530b16cb571b50e9dde62c1210e8c4fe44c14e4def\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e1cab00a309f6035001c6bed21b280b9cd6d81b83072c8f351fbe860f69886ad\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__339b427b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"b000a1cb08b465cb\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-distinct-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__339b427b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"b000a1cb08b465cb\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-distinct-w0-0c9014\"]}],\"name\":\"5a52f00c07e5813093290d1bee011f0120610619cb82666a79b0139919644d6e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fe65e47ea66e64f823a934786806a737bfe3ca692bad4019774d91daeb2348d1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__8d3565fd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"5bbbc901b17a1196\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-distinct-2-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__8d3565fd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"5bbbc901b17a1196\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-distinct-2-w0-0c9014\"]}],\"name\":\"309ad48f4f9314f702e5565256eb6d81567787f6737820f7ffb21a6d85a92b93\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"00c4d48b9f06a2f5dbb9cbe22ae3dcc9e10401b038e62058849dcebe2769e4f1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-0c9014\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-0c9014\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"02e0339b7fefd72794f04b407e26149d4822a36b0c408bf1129e0f7ccdc0cfdb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"884ebceaf8f5da21059151f97834277770ed77023feb57f83fc8c75e495f8d1c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__8d3565fd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"5bbbc901b17a1196\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-distinct-2-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__8d3565fd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"5bbbc901b17a1196\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-distinct-2-w0-0c9014\"]}],\"name\":\"bb55cf856b87c0953ba4478213144ef02787b3cbbf80cc32e530521407ee40b0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7da280ddad70ebcc1b84b8a595244d0682cd0302755439371683331c4562cfe5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"23b1ef8cd3219264f8227915650891004d0dbf97a799031e0e6e6967fcd5f1c8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fe169ab2014a705a54df2fda4ec719f7132fd6bba54202f7531ce8df8da2bdf6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__339b427b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"b000a1cb08b465cb\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-distinct-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__339b427b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"b000a1cb08b465cb\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-distinct-w0-0c9014\"]}],\"name\":\"5f4fc30622e992160dd04a2ed38f7e44c1794374d6682ae9f1f7ca01be3ee831\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8cb0b0d9cbe25e4182aea7d2ed6f3ca636a7d0c9be364f722b182dde26da45e1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"ca6fe2da7884bdf4da7e4fad467882fb9f7b1a542ef29da25c93b58c0a2facf5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5f8a52baf63f9e4c9ea31b6e22c9076262e33bc06968bbcb213439af05ae3a21\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__8d3565fd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"5bbbc901b17a1196\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-distinct-2-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__8d3565fd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"5bbbc901b17a1196\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-distinct-2-w0-0c9014\"]}],\"name\":\"4e45e802c43f08adeba0b390be3827705a757991fe469c439db480762890906f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9a7eea6dc0fbfacc7f1b1980a90d1b04de88692dd5758d6a6457477b77a64673\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"0657b3667bafd18f07dc410bc515b76f51256e8c487baf4fe36409a313e6191e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ece9796b491eeaad9788ab6c426bb54d8cbb85433a9010ef2c4d3f579cca0db0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__339b427b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"b000a1cb08b465cb\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-distinct-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__339b427b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"b000a1cb08b465cb\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-distinct-w0-0c9014\"]}],\"name\":\"5b95fd1a3cba680d3078cbfcc3ed349106804d68df9ff279d7829f1ce54c9fcb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3d645f3ac772a0cc5a9a71b4e6a542a2b2ab9962190903cb5d89d3e8e45b7f9d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__8d3565fd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"5bbbc901b17a1196\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-distinct-2-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__8d3565fd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"5bbbc901b17a1196\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-distinct-2-w0-0c9014\"]}],\"name\":\"d61768c90b21a96135005ba91b0f0abbf7ffc2bd4f372c506a740a4d2280118a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bcf1ddf402fe28df1f45e616a2e2380b51177c45a7f8dcdd03bc2aa6b5814d26\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"0d7aee7ae66dd59feb746b56375d3063a0a395dd032211e5f6fd8a79acc4c534\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4cc208f8f31098b1cdf91b5776a85b52bae0339e659b20995e8ad11208703993\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"d480cd881add8aa6a454eefd0ff4a4f1883e0f31dd0af2c4fc8d49930dfd988a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"096fbc9d544918ac5b9d60464268ef3b1f03546e96ed130c743da74445576f52\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__8d3565fd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"5bbbc901b17a1196\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-distinct-2-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__8d3565fd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"5bbbc901b17a1196\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-distinct-2-w0-0c9014\"]}],\"name\":\"862991ab77df3e7a553882c71a94c90c8006da4badbb5d62b2523a0c2ae8397b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"228ec96802a09009d984b3728e4e96175fefb32ba2e3b918071e85b3f8ec79d0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"1174da5781e0d01a3f99ec7d577f0c792e9d2f3d97450b0297d625c782aae7c6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6d14c0784badaddad1e95c3697462cedd1c5a5cf32d3a98f16155abc0721429e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__339b427b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"b000a1cb08b465cb\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-distinct-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__339b427b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"b000a1cb08b465cb\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-distinct-w0-0c9014\"]}],\"name\":\"c6601f905085efd63830b0439c759fd2e17f4b3a0625b37e6ca853dfb418a3fe\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"669fd13dfb6f84f6e255bbee071a63253e1d5bd80a372cb6a445299b3c53a1a6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"aae79ba1b6eabe4b8be62d566c21c48755697af6a5a955ca0108115f218409f6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b0bfe3b1d3a080ff25e482046cf0d1df0ca30a090ef9f8424787467410af7627\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__339b427b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"b000a1cb08b465cb\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-distinct-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__339b427b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"b000a1cb08b465cb\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-distinct-w0-0c9014\"]}],\"name\":\"cfedc7f35c0353d53fec0474975ad5e05c19ec8b2ac4718a77f59ccd7fb1233c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b0476fc7cd4ea3306c893f375fa8b815ad5c84676dd8000109732b76fc6c9e7d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"2fc0502446287f4669be2a416f781c0acba21256ff9eb15861862053f18d0e29\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4dcc64ddad4ef375730fe33c8b8925944bf0c1750f66d8a3347219a51dd190d3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__8d3565fd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"5bbbc901b17a1196\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-distinct-2-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__8d3565fd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"5bbbc901b17a1196\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-distinct-2-w0-0c9014\"]}],\"name\":\"fe7515ad4af2d0fbe432bcf9bb564a76c332dd67819f108c4e0ccd547ada4eb1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a24eea90cd520665ff61391c71ddaf8965158b1b42c4e6f9fe99dd03dfa7c401\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"2036d4e41537afdd08f850cbe0bbe0d23c83b572c0c1f917f2cd718904dfce6d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1cd65b24c576b1e8f7a954fffca2225dfb109bf5a068107003d4f72206723e55\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__339b427b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"b000a1cb08b465cb\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-distinct-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__339b427b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"b000a1cb08b465cb\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-distinct-w0-0c9014\"]}],\"name\":\"909bedc4bbf04ca094fb3d369cf7cb3b15d83ab3e98ef27c04ee79b787659c95\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"be088898c71049f4ea232cae6dd479dfab1a9947fba6b17e7353ce14e639507c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__8d3565fd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"5bbbc901b17a1196\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-distinct-2-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__8d3565fd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"5bbbc901b17a1196\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-distinct-2-w0-0c9014\"]}],\"name\":\"cfc0c9b5c46987f78f689a5a334275694f4c03653d50c2fbe6e969e238c7f8cb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"03e9bc99c98697160f9a6db2252bc0ba9e88e4ed113a3d5d851256f6cee3dcab\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"642d89c776f69505ff2a885b3a3e0374200ad36c578ca4799ed899b1dc0cf546\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0e0bbf1b6879cb3f68f7ea7f2afda47c74a88c5d3cb97fdf3e110cdc54718649\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"f05bad08945108f9026112e207cee46af50e92faf4445f0e991b27b9412c4c58\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ad6b1369f6065e5d01605f83113ef1c7c93ed4b3fa8d01ad81d870c4a418f675\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__339b427b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"b000a1cb08b465cb\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-distinct-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__339b427b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"b000a1cb08b465cb\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-distinct-w0-0c9014\"]}],\"name\":\"9eb0cbcb37fa43674c71b90f27589d7260b93ced662c1ceb0efe4cb1f91dab4c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4b932ff2b149c42a260b63c5bdd2b0515a398d1964de7381e0735756ee620b8e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"6fbda76757cae53d56b898432e232fb51847f0a1452503c1d53bf530847020ed\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a8ba5320fff14c281f32c2b0a9e757f0e205aace00c294b0d13fa46185724d35\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__8d3565fd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"5bbbc901b17a1196\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-distinct-2-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__8d3565fd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"5bbbc901b17a1196\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-distinct-2-w0-0c9014\"]}],\"name\":\"8d788326bd35d2b328ba885da80b8eac2f0f1f55930d0bd275aa0c5fd637e227\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0ad1aa31e975e4b569a9617aed9c37982646578e71674b0d96896f60dc232a90\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"c8ee3691fdd0cb6a376274ca4ee98e52cb5718f985d4f539fb764ae6116296f6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0be4b31b8961f89b18ef02b2a56a0b76e7cb0d94a4440a467414ac2d9a504010\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__339b427b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"b000a1cb08b465cb\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-distinct-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__339b427b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"b000a1cb08b465cb\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-distinct-w0-0c9014\"]}],\"name\":\"235df022eefeafa48d660af3720c4cb0c0fec34ddef36d3c467db88f9a57b07f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"69645d92530f5991fb0c1154aa418715dafc9eb9b4b827c33aa742687b00c4fc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__8d3565fd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"5bbbc901b17a1196\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-distinct-2-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__8d3565fd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"5bbbc901b17a1196\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-distinct-2-w0-0c9014\"]}],\"name\":\"b449a8480f629d5de320a05efeec5a558221dbb03b4dac7572367202e5ec4e3a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"96d049688a520cd26e12f2232f544b815eac1611ab00713e2f641e57b40e5f84\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"bc1544ecfcc1a9c24b532fcd9001124011a4a99e354877a6f611310592c512dc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fbfa7264341556b62c34307c6c836c7e015aeca2df10913c89f8c2d9d38fd28d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"787567c7ebc18db7ec0598b9dbf1466caebf9a1d07f97cfb4afbc3f8bc3fd0e4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"03938d68f68953b697b7b9ec3a9bb3205251dab0d8c28c8488a51872990c74d6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__8d3565fd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"5bbbc901b17a1196\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-distinct-2-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__8d3565fd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"5bbbc901b17a1196\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-distinct-2-w0-0c9014\"]}],\"name\":\"0d7a95a011dd25d93bb4476331e0b43d38df072b07b758073c5e89ae27e7c6e3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea4599ace477623ac871dedf5650245e6a589cd60cb7c50944431b6bd5453ebc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"06aff6eabb02cda098099e156015c1b3f2389b929e7df774b34188d1589de73e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"463f896d9e9b5a3f2518e764053718a018fbe93828587f90cc4250e5a67a2236\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__339b427b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"b000a1cb08b465cb\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-distinct-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__339b427b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"b000a1cb08b465cb\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-distinct-w0-0c9014\"]}],\"name\":\"88eb8224ce85abcb39e51aee14e03c01d32d86bc4f686e66279e969a1413d263\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d2e0eee1c8e9f13da0b4cd4af8a834f482ac80e1620cc44747922a7c61d6a51b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"203a868aa43281568c0e425caebe830e36d9bb16cabaf6e7dd92722711d4e496\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0dcf2663d1fa4c3fb5056f3703d9d1a316345e3f4ea0e2503f77738258a9e6a2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__339b427b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"b000a1cb08b465cb\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-distinct-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__339b427b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"b000a1cb08b465cb\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-distinct-w0-0c9014\"]}],\"name\":\"c4e555c424bbb24fa529375505443d3163dbb2379b150d3ae00c6689e4123fae\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"29a6e78291fb6eb1600fcc523c35316897713ec3a1f3092074998de0701a2bff\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"220018b07e05f37b279946d5b903a8c5295a21774b20d317b40db4ae44ab089f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea78fba3abdfbae2cfbad8389b4c97d45d924dfb8eebd29422ca7a2b62f9564f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__8d3565fd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"5bbbc901b17a1196\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-distinct-2-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__8d3565fd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"5bbbc901b17a1196\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-distinct-2-w0-0c9014\"]}],\"name\":\"86fdf51aa1b29a978535560d7a45ad778e5802bfe467d27e1295c743248d1507\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"dcddce6770eda2db3f8f60d8b51b5ed927194e11c56d328f35000b6f5e92dbdf\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"df9a2fd989201e2d0ef8377583b501f9afac6836df894071bbae9e6b6b2598f4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b8e8a49e358e54b12e2aba59e563ba17bcf32315bebde13a721f3b7ebfae18ba\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__339b427b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"b000a1cb08b465cb\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-distinct-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__339b427b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"b000a1cb08b465cb\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-distinct-w0-0c9014\"]}],\"name\":\"742ed2fd7d94f5d252aeaa965657e054bac8691ea31b81375ab8a5488c2f2888\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"327ad026e5a9c61ed15c52c9e2fb0c219e4d9a636a17ed736f525f2b42ebfd6d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"8b45807e9f971b175f77e49aa0f5e281c0245f33f6942f95c36aedfd7d419199\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"59093ab44195ceb3a72fd7400b422644d3d7c840cd3e838bafbbcf827cbcc073\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-0c9014\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-0c9014\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"bde801ad48bcba39a3cf88516077f8fad94dd2ce0692d0f274ab650cb9cc6614\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fbf5e5a312486cd624620a8628b976f89d3b75ffa1d3e47224c08e003294432f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-0c9014\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-0c9014\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"047906c5f7db776a9bd905e481a3347b0c84bd6edf626dc5626ed91115c7408a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cbaea0f78f7b655ed1c234a9fbf7020e12e29bee546d39c314b814aa1692620f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-0c9014\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-0c9014\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"1e414f5eaffdbc43cdaeda8552267e2b46abc1a6b41adfdb24735f3843a9c51f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2ab986aa56245948b966f417e9db684ac2bae70862e05b68a996c57de4d7c4c9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-0c9014\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-0c9014\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"3f61be5c1cb2e788fb6ec123b23519795a5d4fa05fbf9eb842b61931843e1834\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"83f9aef31a325eccb5ee1ca5935289e892a53f7f9d05ac2a6d2b8a973624d6db\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-0c9014\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-0c9014\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"ead8e640f12ec2a2a5b9632dbacd377499d067469c52a5e5c7791f29393639d3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"93867ab0bab47561de7ff57c3a2f54a4e134cfb5a3ee35d78ee703589d669077\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"760f6f0b0f0dfc05ff96616a7ebd6878ae6a8e384823348a74bc46e7ee6e70ab\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"06c24ca69f585351676e3a47fdf7a96df9b9a8fe85641e1c3348c8cfdfe446cb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"2089b2caaee71efefb7e26192d15a3376881340fd07cbc304d192587b50b0c07\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f713c09235fdc689702761ce6f8fb3c2c03ea75f66382e5121160a24cf7aee9d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__339b427b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"b000a1cb08b465cb\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-distinct-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__339b427b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"b000a1cb08b465cb\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-distinct-w0-0c9014\"]}],\"name\":\"78522ace7509d509793c07978801f1f4bab7d64f1ad59df33af972c953cd6851\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6b6f55f762b51c1f46156308a7f509359377c543fd3789f104b3416ff46e3216\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__8d3565fd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"5bbbc901b17a1196\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-distinct-2-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__8d3565fd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"5bbbc901b17a1196\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-distinct-2-w0-0c9014\"]}],\"name\":\"06aab5232bb89b6e09b9780286eb3fceeee4557f3ea4efd5ede8278ad6c21170\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-worker-w0-0c9014"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-worker-w0-0c9014\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:30:54.045Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-worker-w4-d6cb38","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T21:21:30Z","generation":11,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"36c0d6c0-4ad3-4739-8e18-24485ab1bc48\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:29:54Z"}],"name":"kuadrant-e2e-worker-w4-d6cb38","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-worker-w4-d6cb38","uid":"36c0d6c0-4ad3-4739-8e18-24485ab1bc48"}],"resourceVersion":"39654","uid":"2255fc2d-ab48-428d-86a8-4726b25b244c"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7f9f489fba4cc345dba07951f043d704ea999478c1da34cd23037357dcdf1384\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" || auth.identity.selected_subscription_id == \\\"dbe49dae34748961\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" || auth.identity.selected_subscription_id == \\\"dbe49dae34748961\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"f61d2b7d2f64f1d64a2dcee70f47ce24c9c6eb4854589984128561c58f6171ac\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"12f3d170c629c434ef1558f623819a2294b75940427c1164b50933cdad3fb52f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"4d6b2e7d73dcdd0567dbe7811fffb6b677ae17a404dd4e000e5586417b4abff9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"af01177c39cc2acfc81deb8fed1e1062fd6125232da28da32592d4c0fd546c97\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"c66c5829a3315f16b0f26dd5daed466c5b2b261235b86bfb98043e96d7dd9de0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"16e9561ee4c6deff2fa31e8a5aec69ff1b5c963a2bd79d3413890752338a808c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"85bbc444688b414fd85af5d3f6532006d93d40793700cdf48cc119eb12135602\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-2-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7f9f489fba4cc345dba07951f043d704ea999478c1da34cd23037357dcdf1384\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" || auth.identity.selected_subscription_id == \\\"dbe49dae34748961\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" || auth.identity.selected_subscription_id == \\\"dbe49dae34748961\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"5b984da304c827646ff112362de545fa451a799e7f6999eac00f25f038606c2a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"12f3d170c629c434ef1558f623819a2294b75940427c1164b50933cdad3fb52f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"ad40721e9bd95807ea332811f94d79eb07b9dd045127a232886a7924332cbc73\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"af01177c39cc2acfc81deb8fed1e1062fd6125232da28da32592d4c0fd546c97\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"9190216f349b0595dc54d5cad3f429f840bbb0e4a2c199f4f2c79134aeb92beb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"16e9561ee4c6deff2fa31e8a5aec69ff1b5c963a2bd79d3413890752338a808c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"4447ac687428f773a4b67c9b5c06c6a0359aeee3ba2dd093ddd5af4018b5d896\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-2-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7f9f489fba4cc345dba07951f043d704ea999478c1da34cd23037357dcdf1384\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" || auth.identity.selected_subscription_id == \\\"dbe49dae34748961\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" || auth.identity.selected_subscription_id == \\\"dbe49dae34748961\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"b91256531abbaaf08ed45e4a93b53e9af9ebb53002123196214bb374517e81f0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"12f3d170c629c434ef1558f623819a2294b75940427c1164b50933cdad3fb52f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"597cf592078ae14c96f33099e96fee363339bedb2f5d430fdd69e28e8be2a8ff\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"af01177c39cc2acfc81deb8fed1e1062fd6125232da28da32592d4c0fd546c97\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"165316669577d87085504ec32756c6d6d67f595b2690025965232ab07a1da412\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"16e9561ee4c6deff2fa31e8a5aec69ff1b5c963a2bd79d3413890752338a808c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"b868f10bd5b40e8919994fca53311146eef16ba432d05144082d631a9418e83a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-2-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7f9f489fba4cc345dba07951f043d704ea999478c1da34cd23037357dcdf1384\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" || auth.identity.selected_subscription_id == \\\"dbe49dae34748961\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" || auth.identity.selected_subscription_id == \\\"dbe49dae34748961\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"490344715bd8708a2d31131fc3b4e370beef7eb7d9942ba89fc82080284e6244\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"12f3d170c629c434ef1558f623819a2294b75940427c1164b50933cdad3fb52f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"aeb99e2df9a1951917065c7b887084431b3e62a6f4d47287af43193676a5b8be\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"af01177c39cc2acfc81deb8fed1e1062fd6125232da28da32592d4c0fd546c97\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"76f141d8a065403b5c0a2fc7e2c76ce1301f93b13d91fd2078e5f2b4d2280197\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"16e9561ee4c6deff2fa31e8a5aec69ff1b5c963a2bd79d3413890752338a808c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"fb58ee2926965a2dcd5e496ba51d76076fbac1dbb0faeb6aaa8849736beb98ec\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-2-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7f9f489fba4cc345dba07951f043d704ea999478c1da34cd23037357dcdf1384\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" || auth.identity.selected_subscription_id == \\\"dbe49dae34748961\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" || auth.identity.selected_subscription_id == \\\"dbe49dae34748961\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"fa28a7ae652b865919d1ff4c61fd33bb8512d3139af38d1ceb9697a99e63cc6b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"12f3d170c629c434ef1558f623819a2294b75940427c1164b50933cdad3fb52f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"601d68ffdf7137fde779cf41214f1c74f63e6b717be0b7aad1eb56041a2d9b76\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"af01177c39cc2acfc81deb8fed1e1062fd6125232da28da32592d4c0fd546c97\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"b7d42066b553c2d03aee2da38514171a14e8ae8d343c0fda8f80d3265343c45c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"16e9561ee4c6deff2fa31e8a5aec69ff1b5c963a2bd79d3413890752338a808c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"157f8deef4224451e2a5d831c8369a39aa3b418062c8767a9f84de3947b7356c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-2-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7f9f489fba4cc345dba07951f043d704ea999478c1da34cd23037357dcdf1384\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" || auth.identity.selected_subscription_id == \\\"dbe49dae34748961\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" || auth.identity.selected_subscription_id == \\\"dbe49dae34748961\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"2dea78ba3797dedd7edd7b687182785345cfd95029e2131769c5797e3b752eb5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7f9f489fba4cc345dba07951f043d704ea999478c1da34cd23037357dcdf1384\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" || auth.identity.selected_subscription_id == \\\"dbe49dae34748961\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" || auth.identity.selected_subscription_id == \\\"dbe49dae34748961\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"cdb3a0c564011d63952f137daa521c84f02a66f8a75696ef9ac4f1f2cc9ea8c9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"12f3d170c629c434ef1558f623819a2294b75940427c1164b50933cdad3fb52f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"e019089f573a8879defa7fdce139828725d9f042c5a4dc9974b9185a8a382c51\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"12f3d170c629c434ef1558f623819a2294b75940427c1164b50933cdad3fb52f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"6a08c6dd0c7522c09a18466dfa733eb68e8c593cdc8d2890ccff2f5c9064fcc0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"af01177c39cc2acfc81deb8fed1e1062fd6125232da28da32592d4c0fd546c97\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"6f15db2f827c7eda1ecbf154277f01be4351cb08f525fa50ec0da278253b6d6b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"af01177c39cc2acfc81deb8fed1e1062fd6125232da28da32592d4c0fd546c97\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"5a27a9e4c9daab234151b3ade5f24a8f9f235443ec26586cc0a883b4ca237233\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"16e9561ee4c6deff2fa31e8a5aec69ff1b5c963a2bd79d3413890752338a808c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"1589c12ca11e6544f2b7072121804f185e5630b2cdcfa71c0561af4619194727\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-2-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"16e9561ee4c6deff2fa31e8a5aec69ff1b5c963a2bd79d3413890752338a808c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"1faaf26cba48036c2d95bf76257bcd6baf769ac5e6eed0a8964eec058af259eb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-2-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7f9f489fba4cc345dba07951f043d704ea999478c1da34cd23037357dcdf1384\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" || auth.identity.selected_subscription_id == \\\"dbe49dae34748961\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" || auth.identity.selected_subscription_id == \\\"dbe49dae34748961\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"31c0c96d54839068517aaeb062676423451143447943cafff7ee595d9fd1feca\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"12f3d170c629c434ef1558f623819a2294b75940427c1164b50933cdad3fb52f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"aebde4a102828558eb0fbde9709268d7adabc75fadf451c730e0573c086e2f07\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"af01177c39cc2acfc81deb8fed1e1062fd6125232da28da32592d4c0fd546c97\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"87ed1d3b3cd1e3027869c6fc197828ccea328c7f84e2acdf7e06e70b8842fdd7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"16e9561ee4c6deff2fa31e8a5aec69ff1b5c963a2bd79d3413890752338a808c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"d90c0faa5819af99665a29bf35d18a090fc213efb27bcb06e9cc9c8a2be3094c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-2-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a69bb45bad035c53dd8c7176828b1cc26d0c9d3f775d2059034b1639ca1b49d8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"79db77eb448edf55b65761a293f7f6fc07c9d4365912f7a8595364cdbf33d994\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"94dcd05ea37e3629c540245bc47fd87fca3f73a8e2994ead89bda609cefca74a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"f682bdd564171974ac50af1b79bec8319fb070d4f9ff054872e07f0bb5970828\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-2-w4-d6cb38/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e5e9b9fa41efe7f56f3ea6e9079d12a9f3e89cd596105815b30b04ba7ba1281b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" || auth.identity.selected_subscription_id == \\\"dbe49dae34748961\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" || auth.identity.selected_subscription_id == \\\"dbe49dae34748961\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"9b7cb9a28ed2fc7fdfa23c7d8d869cc573e3e72423805bef3f945a77d2785710\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"32a498b3029fba046b39d6c26d52ecb2de8f74b942f2d122b45240b1a839deae\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"7442c06fdbee3ca35e62201bfc1ded73b46ccce5d6905e07f6a1792cecd8bc10\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-w4-d6cb38/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"dff7a596e1042978304d40238abe84063cc499f4a6a2f9def85e7c84d1df1ebc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"4ebe0e741886c221cfcd8d1126bcb3535dcbe15c7f802a713d3b2ceb8cee37e1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ad3bad78fb2ca1b68182c777555c2a07f35742a0dc28e73d65c173489bf20bfe\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"adeaca08e9f8fd42fe69e77eee49140cfd5715eac018c5601b0d3378d917d2ce\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-2-w4-d6cb38/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4db1dd6250896b02d5f97b90471902db72d349ea082f211b7b5e4046c827d477\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" || auth.identity.selected_subscription_id == \\\"dbe49dae34748961\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" || auth.identity.selected_subscription_id == \\\"dbe49dae34748961\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"9e4cdffa79635674b661188290cd9c853017f5721accaa1f268edc6c6b7f2590\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1f3d6ce43ced512267c700bcaefac5fe1e5a0f56279d9c49efc4ca04e0d03518\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"a9a34f579b60868ec0be5a14bb835a3898e0c43fe25650166ed2178248bbe1f9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-w4-d6cb38/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c7906cc8021baa6797dfa1978c7ce78b494865d95b66f59ca1cd380376b5fba9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"6ae22229709f702a5686121e25321b1ca57a9a38cb7380c3cbc347a36b32a2f4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-2-w4-d6cb38/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8ea982efbe7afcd4f8dbaa4e864584b38ec852971d686ed11c87e99f1b9f4f9a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" || auth.identity.selected_subscription_id == \\\"dbe49dae34748961\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" || auth.identity.selected_subscription_id == \\\"dbe49dae34748961\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"1ed83021e2408187ee74cd1a66732d37b92c80d46439951ce5e0f654f1542381\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7d8b4229a4e8df0df0b627da5317c526c045e2ab5837161d638a7835193820d5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"36ee8c63f509519eef9ec6e2c257745b647d322586f8289611274ca06f90ec11\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"33871c6a0ae4feae1469b537cc1ea6bbbd60286eed4edf3f6b041e5ca65d4b23\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"44c4b2971f379de31e5b1b9aa432f9a0e14ca85e20312f6967c9581de8fe5e23\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-2-w4-d6cb38/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2c4b4abb753457c4ad4bd5815f6ce55723fcfcf44f298a47923e03e51d023a49\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" || auth.identity.selected_subscription_id == \\\"dbe49dae34748961\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" || auth.identity.selected_subscription_id == \\\"dbe49dae34748961\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"3ce9856de6f3b95cc2ed4fe4abeef13ecb59b5b1ef0102b858e5d3ec0d8afa89\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"99a01d66d9ba32727c09707b61669b110b150d8025da9291ae815b1d8e07454c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"77ec05cc7c773a3540c71498b5777588286f6a84b1595d80c4f1634ded3def93\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-w4-d6cb38/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7fdbd59414185d321c56439c757d9c725c67465b49a83a52b935fdd9c5f0df82\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"2eb3ad4b5e4be8080b2e0309815371172455a7e5f61cf9c3c595f17e99e6f681\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c806bf2d4d850ded382b88489831427afef078ecb67dd4c920a1355d1453a2f9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"ac190091ad6e540c35613b81dc40071b56f4f92355769f89e35c56f588a5f040\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-w4-d6cb38/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bb82cce53996fd9a50a4f33832b37ff599d227ab91d54895bf0ab989d1eb0b01\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"138b7da9a4ea2091f7b13106ba292672e2ca1d22138b32de717b07cab221eebc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9ba6421c13373b029e319749dfcc66205cba71509d9781aae6bc20029ca16a7b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"64d8cc6534e1f2b54595d10cceba7274e4820b1bc4cc4a0f7fffbb2bb61304a9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-2-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7ebdbd5a6be861834fc366408f369ad8f021dfe8f061cbc93334bc801f3df98f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" || auth.identity.selected_subscription_id == \\\"dbe49dae34748961\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" || auth.identity.selected_subscription_id == \\\"dbe49dae34748961\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"be4080fc1058816edd779c6c2b40a1657320a89a6a86b4ff7358026a6adb2e23\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6d3e7a9a4b4298310e0bfe2e3cbd62aec91a573c07d02cbee9db82354ce9ae45\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"8cc4fab950417e53f8887a857eadcd63e5254ca90ce535ac8312884267a353f5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b69fcfecbff8a7db20373884ddd2ca22e39f7a814dfc0946441bf6dc7f369a4d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"b2ed152f8ee7914ee5d821eac3bce97f229c18d303b8bf53e7c6d08dbd946a69\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a6e80d640d49da44f2b60f9db62279137aa6839ed5acbca6493b96977b1f3f9b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" || auth.identity.selected_subscription_id == \\\"dbe49dae34748961\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" || auth.identity.selected_subscription_id == \\\"dbe49dae34748961\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"b470ad22bfeca185d9d86c6a107cdea6e62f1aaf494ef31244de0d30052bbcfc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b1fdba63ead328fd43c505e06394bc2adb7e5e2dfb0a1e55ef2c41d8f345142f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"30a1d05fede91486be251352bb7291a36ac69d50b6fce18433612afe29f1b4b1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f333a7db2a4322946ba06e577de4e4465e1174fb5cc0bb60d8d97ffd9018dc4b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"ee6bf02baeb9e28323dc2d9fa206cb2ed963925f778322eed091490229b29e9e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f2655bcd7b6a7d3d8a4479c1c943c5f2b4d4fbb7d96408fc7ce07c4e7bd9f30c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"12835533e58f43762872e20b92b523339a9de435dc7d0f689b42133b367fae44\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e99af4c913dc9844409b7c31f2f26b7f80984fdcc4a30c1de535a7a3435d0ae8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"c9d5a4401f4154088ac8ced8673158a379ae2073a1dce32a0504c995271c0e88\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"309f6b916a61539853033efc6ca2e083c01c99e5b96f857a7c78b89f9816f598\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" || auth.identity.selected_subscription_id == \\\"dbe49dae34748961\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" || auth.identity.selected_subscription_id == \\\"dbe49dae34748961\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"788f4c0f9a4e5a97247c2043b8125cf170fe6674c40d873723dc972c4d5d93af\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"68beb50e573f7f8f729255a19248728f937beeab700e92bcc9c0a070e602e982\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"26447c99384ffe81ccfc09fad9c33ffe60c6796933a9e2734b738ff5de8c664b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6060eef24f1f9e109ceaa90837578da0e77128864be44cea71a6e4d056f6aed1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"075d582681ff3e0d68d4a835d43bc72dd6bc492d9a3ca8b6dd3ef470e6b6946d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9a1afd5e20de63bb2c85d93c9c3fd7aae15a0f45cb6e07dc467b8063b97decee\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" || auth.identity.selected_subscription_id == \\\"dbe49dae34748961\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" || auth.identity.selected_subscription_id == \\\"dbe49dae34748961\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"4c928eaa593596b5c3719a02958892d193943b2129a32e43035c896d93b232c1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4b5d6544ef7fd39f49a5af0551f4a404b0a5f49df3054a95306b7f797216c599\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"8773bca7122a801a4f199775b03693ad30e316ffebea5bcaf72af079bf14f24d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c5c4680765cefb123f1033aa2b612856432a81adb7bccb16df753674ddd4a42e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"cb4b2a4191c8a55c17ce5101bc78ca33035bffe16815d6ab6f63b4fa3147b68a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3474cd3af51b646106406cc4778f6a5608fdc62b1fd92f27ccbcf8ab285bc05c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" || auth.identity.selected_subscription_id == \\\"dbe49dae34748961\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" || auth.identity.selected_subscription_id == \\\"dbe49dae34748961\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"f0bc235629f48b82dcaad76bce5cdb80abfa82763d9ad220a11c3e27d70223d5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"af8712f819a09682d066de98c1b93feb5b0f27e478190be446e0c2d881c1e213\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"8ea734d5ea8e3432cc886f3fd011204345c05060f7991aff6617797636b9896a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c34c962f04362894a54cdf652c523865dbd1633f051244729b008181d474e55\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"2c3bfc8693c69427d3231717a8df2d14aba0f1fb87d9fd82bb191f0ebb31c308\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"915885eb7c9a3e141be9223dcd2bf03d4b850977922b9f3ad6f812809cf05a77\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"6816c53aa0b9171acb1b1522501aef6282ab95e3b7509a288af72c749a40063f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e12ef81cd87aec42f5b2528c46a9aeefe6b1bca82398f07b17a52a4bf6e91945\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"bd1615998be1912965bb2d26173bc1bd1e2565f8996f1f21fc476ccff3b1ad05\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a2f26131fa92b8ff5a24a34c4f1276e2ebde9d4239d1c79890c5f312ae6d007d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"199ebbeac914dfbab35c15e934f10f9f3b2214a0617964999f2157bf0c31b763\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a6fa5c95daf46871f07bc4e3ef7985a19659c040a1ef2a7baccccaa90e241705\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" || auth.identity.selected_subscription_id == \\\"dbe49dae34748961\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" || auth.identity.selected_subscription_id == \\\"dbe49dae34748961\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"3a34ac7af354fbf7d29872077cc2e557a29218e220d9e4e79e21710f2084e770\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"347ab4a75cfecc2353073cab067f0c183bd7a253c653eba93329ecf6aa4c77b2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"7eac06b7d9983846e2e0314ba9178882139d7919173fba3a84a8b264634346a5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"16cb85f469e7c5716866312b8b4cc95d7bd4782b54923c1571be2b995ef85c30\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"a65b58c28d5a781726a832c59d62e640ea9d347c008d6795a6bc79865414532f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3aa68add648f18fb79f3def0d73f0c2f29d8ab60b1352cf4548a1a038cf3d923\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"fad9cba453f811618739c6f08a8544a889f48ec7511f7d3ccac0f71ba988967b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"099191e40682a5a6b1df435c6dc10936b8b4e31a891f3520e8e9f8418b1acc3e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"adbf9660bf8db4b1489d019993fddbd2863d0cf7c72174df8663c00e565a1e21\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"13694f4cecc05b3e953bb7d1aa68f96fad9b8548456e1357cc504ba9936493bf\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"fd3f6d135cf69e39efa3702af6a7e665f47a40ddb90f71d1f37cad11438027bc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"db8ed9490207e877020d08d86f8a9769046fd69225998abd4e476e93ef7b9431\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"e3ae0784ebe4c51499f320023e5e93f640f2a33ae4fea237cb7e068df1c76739\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"12dec0ddb151cc18ef75cfe2b4260788095e28a391f359fc3f7da7c75381b728\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"8f6398fb66bae44affa747ad532a12445774a5b43ca2c7196a633d5d03da8c80\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"735d43fce555e32c36cd137abc0678ce944fbfe58a677497d16ab8d9ab37074f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" || auth.identity.selected_subscription_id == \\\"dbe49dae34748961\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" || auth.identity.selected_subscription_id == \\\"dbe49dae34748961\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"1016de6b3250a59509e3bc1de65ad0a68ae6faf776c4eaa853d86bce7dd96698\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9a442413f7e81c114c48c6bbdd04c0e3809cdcdf4def1f524f6d3adf70468027\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"785762b8cbcc7dd30b578476b081ad2df517e9e450947fa2591a488b59407126\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"204a90b318233d1075e557d2348b027549cbc82cda4c1d6aea6cfcfa28a96654\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"7bb190477ec8b722acf5b940486e283cbb3ed66f8b99945c184f13fdd5e8b25e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e5f21bd702765764bb09a1ee4f30f2c44baa119970ede500be5eedb7653d9284\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"c83d6ce70647211ab5b215758b02838f2d1d66725baa3ae1e3b9d5635dc53006\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-2-w4-d6cb38')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-worker-w4-d6cb38"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-worker-w4-d6cb38\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:30:54.497Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/maas-default-gateway","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T21:16:03Z","generation":13,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"371b36ef-c4b7-499a-87db-1bdf4e8f92de\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:30:18Z"}],"name":"kuadrant-maas-default-gateway","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"maas-default-gateway","uid":"371b36ef-c4b7-499a-87db-1bdf4e8f92de"}],"resourceVersion":"40822","uid":"86b5bad7-2bb7-41c9-b2c7-bb4c8f13292a"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"61b044087f8d56658ae99d15d4fab3cf1ad74e6636795c133e054a5aace0540d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e511d90f2140d9cde0b2100a0a488dacadd8f510bb901601d5e6fd25343a0f1c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"1e42d143d6033a677e2aa0de97c78600094e515d7c0d3f86b4925ef8be636163\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"26b7799af8a40e8b9585c255ec018a63b0074c27282d4dccebed45f14e703b5e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"ce74c295ef1588342c7308478a1dc6f6aa2cefc063e489a124e536ac32ecfdba\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"fbe95a07558afcf05ef68ff5beb293f527d6ab93dfe79956b5406dc463d78363\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"cbfbaf187a90415d\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"cbfbaf187a90415d\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"40a29ce438b5ca497e4389ce52025a9b91c0cf3177b1bd5c8519b041cfdcf75f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"845137604829fbc62550504d7bbe5ae8d55ea1cf474160cd789a72e811000e4b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5322619ef71b1d1ea3204f9014d0341d4402275b6ca23fca69d61cfc9a61e883\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"16b86e50920afda06ca195a717436238f5fca7f2e1bbe0939875bcb7d559cf31\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5da9070dfa3a5637213b5443376170dda26f57f381af542891ff3b19cc7a9d06\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"00ac1aeee65e93fab2ccfd89c11167f4d954e1cfb3e8b09ad3371a4fab4b6369\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"55c23b9552cb66c175ed2202220df6480eae89be2cda2e925458acf31c5bdbce\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"99f16470bd82ba57465b128d1c0fe73ef189001d77c6ead3fc34c98ad3ce27a2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"cbfbaf187a90415d\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"cbfbaf187a90415d\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"a6d134df42d4d90d93840f63dc770cadabd22dc22af01f991b6c067e96733c95\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"0be74a5083c4760789001949965ce7020664f6347b769f9f20735f95f9d34989\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4902f5a84509d49ec2fb75275af9692b524b1334f7c919eff1d9f33957acd5c4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4f0e9d14c4d1857d5415458306310b00d6a94ce68179c717917d13d30ede9b87\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"29d1c55f30b76c66bfb15588c297271fac7d5e9ca415f0c938d63e524a8187e5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"df729ecdaa88f0abfee16b94ea7be9c5aa7ccdfe91fbe0676e22ca4bfae35f29\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"69baf76a5f2e8f4f8d3e40025586b942794274a22455dc40e0b7c0116f0d2297\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"8199294e302361a6898546d62809d67d522e9c2b375c8b8727f0d966f7ad4d39\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"cbfbaf187a90415d\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"cbfbaf187a90415d\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"61ef91ec2e76cc107813a7351d7e38bb32d1ebbff452efa771b01f8a512fb99e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"f2d9c20918355999f92bc489c836e0d17ed8acb713739da4b73fc8ee019fc8a4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"c19d17a63dc280a83fa4dce8ef0f825a16118c6817d3126d095473335018edd0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"05aa8311318e9111c5925f4be454406e209ab832bc6e8ddf01725ebe4f1ffdcc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e680857c19914d59f115788ea93836704a1ddab04f5e495bf863d62ad8a5aa8e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"96b761d418352e3f8d172aa80bfb5542df670414bec97704e615f2e3e665c8aa\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4a199d441e37ffe8d62509ae7048cfd055df0de5619e9be81a8f47f9a64a7051\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"f17cbb57db714a7faf03a7e4ef3921069096709486e13c6b84b4b75ded84ca96\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"cbfbaf187a90415d\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"cbfbaf187a90415d\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"d8631ed26c63871d1138b31e9c971d72ad1152273309b27ee33862700ff4fb0c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"67a5fec0fb2398a03579a732c5e4640c9f9c5db5385b91db90ffb49522369904\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e5b5be5a42ead835fa1a13840fda21cf5afb14b8226da9a3008a321db777f685\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"a01c6bf1aa626b04ec6a9fc85abb6ced9b4a9c4cafe81d2176013cf3b0b4c4aa\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"0eb9568cf0385cf054d8f3ebcce089d8b225a9fe1b6061e3689f7bd26415f872\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"633e4cdca29207ccc8220565a86635db5bf3f227ef564ee1a0da6a5d6076231e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"ecaead2c94524df89be70a7c961f93dee41ef96545655d22914542a89dffe341\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b9f3d06eb6a92218fa1757dab6cb8e66e42102d46c94e6c0db854f694d6d855c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"cbfbaf187a90415d\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"cbfbaf187a90415d\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"7054423a069def7a36dcb993faa1143223d985021782b2552d55a522caf2eba9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"deac1d64e5b84f2fc26848a49153d512090eb1e2bffb72dd7091fd21a1234e18\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"3dbcd4467449162cad999d40988202fafebe535215351d004f1bf05937c76508\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"534f6056dec477fad33defb3049c84dc5497dacd9f6e3f2061b13ba089ed1cbd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"fa823b540319ebed6b9b488f79dda81b66933f7e616cfdaebe3543ae31b33b13\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"fb6ca2eee2169356e662d36e92b2b679a1235a86d976f9807297ad56386f6e2a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"0427c8054235bfb15b63a5a467ab470ce1cca867b5a232117e73059a4ec8891c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4aa2417057e81c2889811e45d786ab1591e3dfafc889b838aad26a3ec2cbfe9b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"acb4b8def068bc86711642e3242fd621a66a54452bf86a82586fc6bf69e8192b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"66831c252eeacbf3e19995c48be4a005b1726766550076c58cb47b979bece639\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"a80090acc18b7b092f5e9f2d49fd8643f16514df89a716f8f69afe4a7afebb76\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"f85e753996f9e90384b461c5504814ca0cada63ea0f44d6630a619ab36edbe08\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b72a3d2d64d0ddc05f076a7fcf59d924552b45080846c09e1084e67867a76e9c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"cd58d9e2c4a744adbc8ab336cd016f27bc1f14a1de2e975afa26b7f5113d1bfe\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"cbfbaf187a90415d\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"cbfbaf187a90415d\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"29c80f1787fdadd41eb24cbda56972d49e35d261e06b4f4fcd5851c7e2de3068\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"cbfbaf187a90415d\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"cbfbaf187a90415d\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"277489d8f3c2c5149e18b965c81958774efa7e81299a66265853d6af2e16037b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"7c211141c74fe1e91cc494ac860a81616dc49e2a5d1951dc70bf0f42824d53e5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"17df13edb14ef5c49ef0cc29deaea97728695c57b5ccad8feb2b23589083e083\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"014f0c5a15872002db778e7e40dfcf7dede4ab2db05bb6a08641f5d523cb3afc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"bdac37244e7b891cd2973e74c7b0db5110c344505a09a86e51fc6486ba35139d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"ea8a88726b68ceff7de514d89e12df024a67856b697e02c26b6e762395fdaf0d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"81df9bef1abee093a91a2eaab4b1a53122eb16d4150f27c879439ca5d99112f3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b3be2474c46178c0c39839b29d8d7c87b103574b042bb23175ac0e9786fde158\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"13fe2d56bb22ec9a1307da7bad05cdda8724fe788533352aa581ffdc96874c78\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"cbfbaf187a90415d\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"cbfbaf187a90415d\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"fbd262e90a5eaaf98d72db889488cbe13bdac9381f78343ea46c402679569fb2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"9794c132b0cd770efeb9723db862265df6a3584117821e44e2a5660a971c59eb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7def4ca304ff3869be64c2c02523fd9d2ff43465099dcd1124399f293eb4480f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"a86375603000eab9b808785894e0e63f3e53024a46681e97c41a06c4e0c67023\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"54eea38241838159e47386cb814ad20fc30631ee8c42d57f0ff8da80fbbf62a0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"d5b69938a04a8020c8a8d10df4921f2989326ca4811c3843a7201bdb1d5cb848\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-unconfigured-model/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c5a685f2a5ebdef5f1dee488990c0798a45ddce399cf99e7d0c505a5f46c69ac\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"0fcfc87f76b773c6a38375e46d76e569a372370e3ae2e7003932ed8ef776f5bd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fac07f302f653115fda3d376325a268abaf66025ed0e4af73e88bea3f41fe933\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"aa28eac51fc5e37c385a11a534759b09fb7998ba74bb01195dd8ff89d9e9ec43\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model-2/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"06165835c4461c0b16a2bc5bae936aff3c2f351edbef8aa378f1110874acedfc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"17390f436804c5d305f1dcb9ea78a72032310736cf630bb9589448f605bd1fd6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m-premium/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ad8714d3b8aed2a9ffd68fbcf0288557e9c1c059c1b59ad3e9a09910b37fd61b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"c4353817d988db43a8dd6b0d5c29305f9dcda76e19c9ef2c820808b0384a0bf4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-embedding-model/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"726a74c13fee356e859d9317271facbb60b066acbc5571de22d056f13c60878f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"1415e0d2aa117656e44a7d6aeaaf16aa87f18bdeee129f7e6757b2e1c7f996d3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-trlp-test-model/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cad6ab5a81a65fd4cb03a0fefdab5de82aa18c30a5b95078b1d05214b0606f40\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"0629facd48a81e3c82281be4a3f8566f55e61d1a30a8516b23bbb63c58e8f6f8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e5f81c7f7812462ebef000c68dc043013159f22201d2eeecf05c220e809f96ed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"2e292ccc99f990aa723c04a99267923f5b62fb8f3e0ab1a978e8334b9397ada0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-unconfigured-model/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"68502d1c1143a647ad56f2759ea89a4c5b3c74a8054739f7e7ea9ba6535e3b74\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"2b69b629cb2b5224adc61a8925f43333ba0b52ab39260c124057e9e82898937f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"74b47f1aa1203aad58596cbaab10ae46e8fddd08ac49eb57a26bdba532d88e72\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"d1e427bebfc099de9df176c73ee76d5dbd6f77919e840913d3a10818678c7394\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model-2/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3167d3bf853032a93e8569019dcd3e5aa33af9cb580cf9ca138990567fc9d857\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"482d2a79771eafe7f8d177701f43a13c6c4916251440ca00830042e050247443\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-unconfigured-model/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"99606c4eac496429be47144db9f3f48867815df12eb99d7be8073b767d7e44de\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"e635ba9dc59ae1e09b34ee6e0f2718b1c31e6f6b6ff2bc6d05c094fedc42c40b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m-premium/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5d590119308c6f848b12dd3ecdfb1b06cc2fe172af702455c342075944a045ff\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"caf1a50009b65f25df3a996283d38ada17bb57a2ebed842a552f137f6121c63a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-embedding-model/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0e042276580ed8976d8ad3afd87a71640025c28b9b48f5c88eb159ec9998209f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e17697b7e023603155a06feebe0602591826e794ee2f5189abf795c259be1b37\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-trlp-test-model/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0829dbf2b5dc0900de272826295adf351de381b46fa6fba00b896213530780f6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"1e772a79f4b1660c75cf3493e21c9ddb58d2de640363115c57dac03a10f22c33\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cc1ffc2ee4e05618c28c108cac668c0c02eb8e658953439e47a733edab44a1a0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4fe1d1c6df78a26f30e2392ae9da7fc67b0845dfda48a89e247bee6aa536d8e1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-unconfigured-model/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"486615827938fa99814e929fe7dc62bc16f7563179fef855074eb73dc7ce4724\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"ee2f6a8baeba450552a3e168b9df1808bba4e2c59106ad0881ae78aee4fcbd40\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-echo-model/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"98ec9d74d07c88c1e6923ed1cbafd4c5b41bf1763b3a942282f964f72425ae57\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"653f23106eb8a10791805e2f9355c750c56aa6873ef311fe707e76083d93d55d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model-2/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2ddbced6f2f51d410743da1d9db1257d0006d99f38986dd7cc7efd26620791ad\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"1e776cd43733621e16ebc27c91dbdeea062f73e4dde2f494701c85a6843faeed\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d752a44ad8df3a50b5a1147110eb89039ed764e1fed197b1f77e0935c424a90b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"62f67bf9885222d9a86a95e02ed17ae26ad7cf71e15aae0a7517e647c29618ca\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3083301b5359be118f04faaefcd72fd127f2297a3374ef7231b59a59a31b405c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"e85460469045801c3e6927ab49333ff01612a4899d5a7c29ec27824b9942f3b9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m-premium/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"67c67ce733de50e7b3d797bb248036b01badfe02e958f5f76af05b58a504989c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"f9b414e31cae5d16cc1ad22ba2462b8816d9369a97316f40f32a6e7912fc4f78\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model-2/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2d4a2275e6cbab5c26d5c3cf2d75aa2776066390e5b66f5498b16b26bc596af7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e33110b3dae1dd80b2bfa573def0b488a6fd4f1243962fe81d58e1853ed2d3f5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-embedding-model/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"23672b974f0dbc05100a34c78d2b029e41f1d5a3752f3fcb52915f56db360e25\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"a6183db94e49e3ba0149a19f4e52ff19aebb55d6261b0cacec0656136bd2adf4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-trlp-test-model/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8274337fc3f0de48e5213819aeb4a46559c4f8b3428c1bae43c0d75207ef5264\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"cbfbaf187a90415d\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"cbfbaf187a90415d\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"efcdf81b8f74d74207beb897f447376d1f950ae12e8a330f1ae67b0d9dc6a545\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0e89fc4b75d3a5dd95fca2c4d8ae33c7826f05a8016c44eb39e28c3c1860fcfb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"7f0f599e497ae797f3b5922614ceddb3375c007237412d01b520bb7498ef288d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/premium-simulated-simulated-premium/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ab505bdf28287fe00099987c1bde2c2f297c40c792a7f6cb5fbfa5adc44754d3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"06c1aa31be81b1f5c6266514c955712865b30117291a39dd749994f4ce931145\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m-premium/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1704c6bc15d6f547acca888061680f2275f690cb79e5af6fee44747bcf278b95\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"6a8319194e2c2fc998268cdbab03a5aae2d83019f5ac30c316c4e548895b7c63\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"eaeb360b41b3f9e0bd6b247d4dae3eef1ffc3355d6e9408df3f8f71bc7f033b5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"32cfee4e66c307d5ebed6a406d2260f4374553d184b5486fc53cb64bc6ffcd8d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-embedding-model/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"135ffad9bbcd33779a0b9a1c0dc5d5f547356be21489762803640aca855c728a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"3194cef788c3fa9898599a57480aeaed07c6eac2edf957788235b37d22918588\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-trlp-test-model/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"17002b7f0c8e62582ad262d9c2b8b038ee7f2a9327fe34f21fd4f47134b7b8cf\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5acde2b886749c1c54f99db5c33887e6fc5ed0caf412daacfb5df0f329882c66\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a6a6232fd5656520e75d100c41add5f1637dde9705a4ec608bbb90b724c258a5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"37a71c27032e51fdbc7ca688064a47abb86230a8138af6eb55e8069fad975a93\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-echo-model/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"92917da87eaba4f2684cd45947a3698434b99ff4ca6d3ddde51d6573aecb1600\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b2b26e0af9ad7defb486e5d1db19af6bbdd0998559d16f3776651669aeb4d067\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-echo-model/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aa7038625b8f43b0c002f79637065e5ab90468f50f998759d08f2c4640c07c04\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"cbfbaf187a90415d\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"cbfbaf187a90415d\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"2a62f0614f6526bc3f195f838aebd1abe29514f2707db40d9ef738d645ccf001\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"de97dd5d45c6eb12b4a1112ed1f362d8544427428d2249a399e26ba069d6aadb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"22b2ec7ec96ee09c9e07a84cd3d313c2223af42433bbb28c5846401f64d5e3c1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/premium-simulated-simulated-premium/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"dc061bec60bd28b1c132bf30965b4810124429576337bcc4a6030617600d1714\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b188b939a496049e47b8ef664d7c7c490722f1753404a08d89ccec1dcb87b8fa\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-echo-model/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"75612d85af2bae456dadd78163b2d2f9015c0a0bf4e20bcb8a555e6a5ab3b8c0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"cbfbaf187a90415d\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"cbfbaf187a90415d\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"96bc4fc13cb63707a942ca33034f78d2b39476a10860398523789db3990584d1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a4493fc88328eba553ef36791fbf4706bffae04a1ac501d099b12309ebc85c6b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"d84e45c7a3e370ea510e8e0294e009b29bc2f2ea789c47559293007b6c4410d2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/premium-simulated-simulated-premium/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2d953f7313807988e63546aa32431d96f77e6989c672f8ab42827c1c21918630\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"cbfbaf187a90415d\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"cbfbaf187a90415d\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"dd2f15d9a08862ab664dadf9bf5da25828d327a11a07849fa919713f034c2b0d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/facebook-opt-125m-simulated/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d69b9c128f599c9ea1af84bb3e783ed71688baf6b3ad2b86f2b7183f9a4208b9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"cbfbaf187a90415d\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"cbfbaf187a90415d\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"4dfeb9ff2318af8f84e70b11545800bb83948c080a97ae1ece5780d4022bb383\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"dd89509e97b96670685602ae2d08749226db8693944d2c6f868af9d3e0a5feb5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"1025db78adc8b9c9592b692cc227b1a306a99ac5502300d9ed4ed7615f5e3ef8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/premium-simulated-simulated-premium/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3386c5e86c72abcdab369776ccd7182024ab8681cbe497e81724868f101a3c0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"58e90354179740b1af406b2911c9997f3f3283475aeb77ce7918f3b3239a293f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9e75e9fd02f51c2f043b145c5d6b82e95f1447b388ee529262aea27a6a2774ef\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b89d1075a79c93acaa097e4e6db4d6a4b23bf3ffe5e964409e29b258ed725a99\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-2-simulated/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0913a452a02695c6681f1037232199b40b64236fed4d29cdbb41561695826340\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5c0b495d1a10c1cf1548ef17998cb18c0ca25371ad42d5ffe1aed42bd55e31ad\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-unconfigured-facebook-opt-125m-simulated')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"010adf02b2e7deb40c572f4729b6dd4619847c8e6344137326b72df28772fc1a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"c04f8a7c7387e6794115c41161cb001d8a07340d2878cb8f36774a8f6a200ba4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"105cf4dd91a8abf4a93abd65b255521c3d37b560b5d23f3ec59757b5b362fae6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"7e7d1a0ec6d957a4d4de94f93078f10e836b23442c9cfa90f11c8520cca12e87\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-embedding-simulated/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"75fd86e2a4870af5fd78f2ad7aa2a9d79aff977b3678d81954b1e207a9315f2c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"c3cfc634a11046a837448628e2f17db0ed3466194da289a808544d874ecf6451\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-trlp-test-simulated/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"54cd0149b818480305f3d0024b3c95629cafb641b48195d003b2b7006d5c6bcd\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"f5bc618bde549671e84473b23ef3632426f8606e2045744a860c603f2a7675d3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bf65ad13397c94660867eb0205e06d1c9bebda4b019f632c0d0b8ef989930381\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"d8d67afd40f17474755bd3f6b00e265761bf5154febca129bc3f2b0bcd749c41\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-simulated/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f9fa9cfc2b4e701183573419a92c79384cd30210289602f0115c75c5029d55aa\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"ac2105eead12bb02dd7d1691cc77fc8a580b903f98564a8fd585dfa345dec1dd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"596921ddc7ba8523386263c5cffcbd6ad9b6a385318ed7e24f72be06f36fc398\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"f4ae34c5c82a0969651301a535f404653a60a5d75f20c7ea56ad9bb89b67e9fb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f95805f0e9b755664735d898c1d644d571943be553204d3f86136bc35719ff13\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"cbfbaf187a90415d\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"cbfbaf187a90415d\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"95c39f44eae69bd53f57e5ff93243887dafd591c9b8cf2e736f0ab034e67021d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/facebook-opt-125m-simulated/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8d5571efc1d304f5bcfc2ffb4ac6819154ba5556c29ce33416d460b887427984\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5d6b359055267732253f201a1fe48f0abe6d5e22b011c70e1cb006eea672f535\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e91aceffc2d4f6d6b120625bd3ca23781b74a1cae6cf1da26bda310bbed0ef07\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"cbfbaf187a90415d\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"cbfbaf187a90415d\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"c8475d27649a649c955538ff79eb001372050ff4f1d4ad295b01dc6fcc69ba2a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/facebook-opt-125m-simulated/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a402d1681ab35bace735c19b1d084a86eb3d741d4e1c14371cfdaa55d22c3ebe\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"7320c049419b863194fd55db5ebd887462dd24e1289e6308d79f047431f2bed9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-2-simulated/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f9b535aed6243496a67741936e53a0d303bea1b872a06fb62f1f9c27150edc40\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"cbfbaf187a90415d\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"cbfbaf187a90415d\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"5eeab80447ec6c71797517b4d94c6623353e89097743360eadd7f31115976dfe\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/facebook-opt-125m-simulated/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a9800464506c58f005016df354e160757732171ff4d19747202524955329b998\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4984a24eb707d1b965a79974a98ed4afc271f2ca356b150cbc8943de1ddcfef8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-embedding-simulated/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c82a1a3dc2ce54c0b664f79a2cd895a3c40f774b3694999badae8cedd328292e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"276f5d5d67b2bd83c05c2b39e4a262885498e6807e3129a866eff0651b3604a9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-trlp-test-simulated/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"669658556fba0f45c2a82def2f57614416614ddf154ed8dc5f4f9188f10130f2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"692f39321f892929348fe56801dc14c8a35eaf749609a3a5f4b5e684edddf17c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-2-simulated/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c4399a95e89654e5b2bb5fabe45bc947d11ccd1448ebf64c30b195b34f239d58\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5b273834f06c6341dd07bba6c809b3297ba2514e6d3b9b5d0f4f8211c68ccf8b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-simulated/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5e4821ff903ad6ca2e1c42162432e34d8b0a2a78052961e753d36b742193432f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"f35ed2fb168a3a608435006c8c1b103242765d7d37f41bf1dbdb7bbc0331da89\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a91faccafad197e2a4065ce3d12a052ac484d2e8fb2fc9265ee48f02b28e6dce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"fbfd0ada86117ffb0a134e591bf8b8390012983d25496ef188c6da73fef5eaec\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-2-simulated/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0020c64019ffd1a0bdcc75e6441e6a30e6d8bb08f463f67bd2408a1e82b95b2a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e78a4964c93ec23890e62f7f50201f5b832b4c714066a914dc734d8ef60e8213\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-embedding-simulated/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7c924aa2b37ea38067b4e69052d541ea2e7c86fbdaa79b19f9ea09e87adbe4ff\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"d5cf96eeeaa56bb891ea0cba28f7beabf17a8c0f061ea01c768ed842dd26334f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-trlp-test-simulated/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"028a8b5bd5d4e690eebb2f20c5fd47cf0b3c6e2a3619ba9e55322bbca7b94cc3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"8fe4100eab1f023f5b06dd8e19bcc80109b82503466d49576acc234cdda9bf0e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-simulated/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"80056c658070f49140955cb6eabdbd252857a614af6b0f2f2de7a1ab1cd47949\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"53aad0199369eb8c8f787ea099e93092089c04344e8f910dcff366f54bc831cb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-embedding-simulated/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2416d7b42d11a09d7152746be0e114f8fdc87d0fbd0efa9dec5b52b011082194\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e0cfec53d1f17771317082d9a7d69806ae3468971bac79a1135f2b0d51ecdc07\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-trlp-test-simulated/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"50c2058cf11e07a931b06ac4446a56eee86855f00badf26618abe486a7bdcfd7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"cbfbaf187a90415d\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"cbfbaf187a90415d\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"f3b6e6c38a521fae8ef5c7fddf3b3178baba88effb4e5338e0b387e28ecc468d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"134a7a790ba665547ca14f80f917549f66ee5063fc41096471c0778399db6dd5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"4ddd3fa1f54c642a57a48737e710ec0116705776084d8cebd8134dfa49accdde\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/premium-simulated-simulated-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4d18a96899c43d55ee63d2ae1a7a938c7e873d88b2fd95f06b2e3aae2c7f1c84\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"44e38055536c3f0d49cb81abb42bfefcf2c78faf963a6160afbe459bbc04db39\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-simulated/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8d34bd12ba2030284fcb69127f53b8158bbdd4a1432bfe619165b4c2c96cc061\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"c9dd9c233e43b53241ee27e937246e51b8f3331f30a7fba22640617c1b0bf47a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/echo-simulator/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"319e246831bdaf5e765e63d5511b516594fd2b64527850e2ddabd2a4a85532ea\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"7cfd2ed5cb8a5913fa5f55b92b02805c6778991c01c80eb14a0962cc710a56ff\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/echo-simulator/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a8c8220ad6f1387002e262ace5db78a2c4bb39e5953306702a228215174f6796\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"87e1712d02794c6d66ec1a932f02901d7a4369f46d0f041178cd3efadb7f59b7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/echo-simulator/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1e077a716d89a43572a3c16e8d0b0436816baa48a2ea227603701f10cad6d6f4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"cbfbaf187a90415d\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"cbfbaf187a90415d\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"ae9eac2a2b8c8311bb8c6ea82ab445a5d6f50d2d51c3f79962be9d82007097ad\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/facebook-opt-125m-simulated')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3f23315aacd6e16f4ab41f96aeedc9549d1abdfc9476577a47d45d12875dec5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"165d3b8e224f71685dee07aadd133117aeeed097eae99437d561d5bfa2d22233\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/echo-simulator/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6687eb3cec74c6c51428ce3f3d22d50ba269f59015d1bc8f185da49eb095534e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"05ac0e89d0298398d3996609d7c22b514bdf08bfa3787653bc739995c5942441\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-2-simulated')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bfd36c5ed73eb81df97258ffa1aa36d8cbf6f3e7a8096c33ca4ff417be59d002\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"d5ac583036f3821c88111dd82571eab1fc94aa4e9fcd045b27336f798e26075d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-embedding-simulated')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d303c788902ad4467c7ae545d65cbef45564d1c0d56396c93057df3909461aa1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4a6b0d84cc35c0f532405eea81056481fd54e7ad71284a97ce8f6a2424eac819\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-trlp-test-simulated')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2f53b030326b8e1f5908c601aecd3fffcb6d08a8337d0bdc53ee1fc699a4cd71\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5c3bcd9fb119b0fd45f3b4ba5de5f905cacbb4963fec309a0961a40f76a7a7a9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-simulated')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"94ddc5e77f082c32bebc7a36bcebf621518ebf303e83b9c540da1352d04e620b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"50057c9a2acf4ae7152e8c97f7778cb04340d1470974e5272422d0bf244a4e5c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/echo-simulator')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c6918972d1a7f8ad5201880b7d6d9c1191ca1f25376682f691def7868e3fd02\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"01cc37113b4d6c301e355f63decf46a21e93a023494bdfeaeed2890c97ec1f57\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a82769ff87473da04c27497e160e9b4b1a5dd93578e0cf2342be8b2f06845269\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e747b72d92315b743934153588614b27670cf0c9d9dc4fb380ea4965def7f235\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"06b05a8e4dd69bdc4f333ad9509ee8cad3c5c0f5dd48edbe94c1158b60f79ed3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"661962837510c6dc6d1faa64e61ec3086efa9e0a2e7315c6ded616c1879e5ba8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b4bfec1b33959dd0ebfc5cd6fb410688e820d4b55c7f149cb4acc4353f30a9b2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a7740f6e77d024a437502c023fb1d8939cb3cc2b9ed7f4073af7d779e19459eb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"f82564e076ea3e672592bab71e048537faba17a5e909884c2a0204e235905a69\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a908063c86927e6bf07b7d793aad9f277ac3c2a8f5f5d468b116cb9e07929b14\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"fbdfff5b213f506d78434055d011cf63d616653e502ee04408a43578986e1e5c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d1d232e06f90d479cd9b802f24889e83af58c51cf54ba273d5e24dcb8a297688\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b49f2d7e152d4de959577465d2494ee11771b4c439cb6eae71c90bff26224fb4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"810f299b76daf089b33c92cfbe0445ab5cc89a48d38e36df0cc89ed6cd1fe8df\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b27d6255cac73fc039120e157e1f3ce0e99e86995ac5a66974d5e8744df6c64d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4f800155f293f82eeaf5fd6a9553c0a1bee90f47a295bba8d7a04b3f11faea33\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b1ccc7ca46f6a14e90afe1dddfab8763f07f30549ce1cda0bae985581f063098\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ce7d381faee9ff949d68d825ffa1dcb9247dad19667ec59a8e91847320dacbe0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5d72fc7cc241ffd60d83142a900be014cc5d57320142e013493b21ecc86cb534\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6565c4085b3917d5390fe1b0194fb3d8319f1d56b45867e3c68ff740b5c16ef3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"be1ccea8a4cc19c7190600de6631fcb661b63db81e2862348a6ef4f90bf33fa3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8d8c8aae1332bb0300ac2d65be9b8708fbfde6d4b5599ec52380cf1f70956045\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"cbfbaf187a90415d\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"cbfbaf187a90415d\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"ca48ea5d9ee701ac5383800306378d945e66ca5427eba33396e6805ebbdc1ea7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f6df6bc14432fdc346191db86ee06e75c8090ed87a32c984493c837e97a10be6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"fc54a1d4f18d4d59e58b6a3aa31dbfaddda2b89e5c28dc9eacf14ff38a414021\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"maas-default-gateway"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-maas-default-gateway\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:30:54.556Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-distinct-w0-0c9014","namespace":"e2e-models-e2e-worker-w0-0c9014","uid":"f8486e18-d4db-4692-aa96-fcde638df78b","error":"tokenratelimitpolicies.kuadrant.io \"maas-trlp-distinct-w0-0c9014\" not found"}
{"level":"error","ts":"2026-11-02T21:30:54.675Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-facebook-opt-125m-simulated","namespace":"llm","uid":"da8edb1a-ed61-454d-939f-fc7cd235d9fb","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-facebook-opt-125m-simulated\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:30:54.726Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"maas-gateway-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"maas-gateway-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:30:54.858Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-distinct-2-w0-0c9014","namespace":"e2e-models-e2e-worker-w0-0c9014","uid":"970702da-43b7-4705-b5e9-2f63225f104c","error":"tokenratelimitpolicies.kuadrant.io \"maas-trlp-distinct-2-w0-0c9014\" not found"}
{"level":"error","ts":"2026-11-02T21:30:55.236Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w4-d6cb38","namespace":"e2e-models-e2e-worker-w4-d6cb38","uid":"486176e6-7786-40c4-9ce0-6f4a68b408b2","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w4-d6cb38\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:30:55.715Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:30:55.715Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T21:30:55.859Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"distinct-2-w0-0c9014-kserve-route","namespace":"e2e-models-e2e-worker-w0-0c9014","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"distinct-2-w0-0c9014-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:30:56.033Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"distinct-w0-0c9014-kserve-route","namespace":"e2e-models-e2e-worker-w0-0c9014","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"distinct-w0-0c9014-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:30:56.047Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-worker-w3-f51151","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-worker-w3-f51151\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:31:02.441Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","EnvoyFilter","HTTPRoute","AuthPolicy","Gateway","Kuadrant","ConfigMap","Limitador","AuthConfig"],"eventTypes":{"create":4,"delete":6,"update":12}}
{"level":"info","ts":"2026-11-02T21:31:02.589Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:31:02.609Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:31:04.352Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:31:04.434Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:31:04.441Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:31:04.442Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:31:04.639Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:31:07.360Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:31:07.365Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:31:07.365Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:31:07.367Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:31:07.376Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:31:07.377Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:31:07.533Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T21:31:09.024Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"maas-gateway-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"maas-gateway-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:31:10.201Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:31:10.201Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:31:17.092Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Limitador","AuthConfig","HTTPRoute","EnvoyFilter","AuthPolicy","TokenRateLimitPolicy","Gateway","ConfigMap"],"eventTypes":{"create":22,"update":15}}
{"level":"info","ts":"2026-11-02T21:31:17.331Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:31:18.823Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:31:18.947Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:31:18.947Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:31:21.188Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:31:21.194Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-02T21:31:21.194Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:31:21.188Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:31:21.230Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:31:21.230Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:31:21.236Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-11-02T21:31:22.617Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"maas-gateway-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"maas-gateway-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:31:23.424Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:31:23.424Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:31:33.140Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","AuthPolicy","ConfigMap","Limitador"],"eventTypes":{"update":18}}
{"level":"info","ts":"2026-11-02T21:31:33.328Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:31:34.354Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:31:34.436Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:31:34.436Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:31:36.896Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:31:36.896Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:31:36.901Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-02T21:31:36.901Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:31:36.924Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:31:36.927Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:31:36.927Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-02T21:31:38.576Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"maas-gateway-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"maas-gateway-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:31:39.123Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:31:39.123Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:31:40.128Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthPolicy"],"eventTypes":{"update":1}}
{"level":"info","ts":"2026-11-02T21:31:41Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-api-a-d58d18","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-a-d58d18","reconcileID":"d963a3eb-a7f5-48f6-b2c1-d67796695c9e","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-api-a-d58d18","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:31:41Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-a-d58d18","event":"CREATE"}
{"level":"info","ts":"2026-11-02T21:31:41Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:31:42Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-02T21:31:42Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-02T21:31:42Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:31:42Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-api-a-d58d18","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-a-d58d18","reconcileID":"5d939095-f686-4ee1-a543-419486d115ad","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-api-a-d58d18","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:31:42Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-a-d58d18","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T21:31:42Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:31:43.961Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:31:43.968Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:31:43.968Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:31:44Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-02T21:31:44Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-02T21:31:44Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-02T21:31:44Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"error","ts":"2026-11-02T21:31:45.401Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"maas-gateway-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"maas-gateway-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:31:46.113Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-mt-70efbbab","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-mt-70efbbab\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:31:46.172Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-api-a-d58d18","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-api-a-d58d18\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:31:55.308Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway","ConfigMap","AuthPolicy","TokenRateLimitPolicy","HTTPRoute","Kuadrant"],"eventTypes":{"create":4,"update":5}}
{"level":"info","ts":"2026-11-02T21:31:55.608Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:31:55.628Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:31:56Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-api-a-03ece2","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-a-03ece2","reconcileID":"d5f7bca0-ad4c-468f-bed6-7b65f21431a4","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-api-a-03ece2","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:31:56Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-a-03ece2","event":"CREATE"}
{"level":"info","ts":"2026-11-02T21:31:56Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:31:57.553Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:31:57.823Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:31:57.823Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:31:57.839Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:31:58.124Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:31:58Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-02T21:31:58Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-02T21:31:58Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:31:58Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-api-a-03ece2","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-a-03ece2","reconcileID":"090911df-af34-46fe-81ea-966f8f7b3713","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-api-a-03ece2","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:31:58Z","logger":"telemetry-policy-extension-controller","msg":"Warning: Reconciler returned both a non-zero result and a non-nil error. The result will always be ignored if the error is non-nil and the non-nil error causes requeuing with exponential backoff. For more details, see: https://pkg.go.dev/sigs.k8s.io/controller-runtime/pkg/reconcile#Reconciler","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-api-a-03ece2","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-a-03ece2","reconcileID":"090911df-af34-46fe-81ea-966f8f7b3713"}
{"level":"error","ts":"2026-11-02T21:31:58Z","logger":"telemetry-policy-extension-controller","msg":"Reconciler error","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-api-a-03ece2","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-a-03ece2","reconcileID":"090911df-af34-46fe-81ea-966f8f7b3713","error":"Operation cannot be fulfilled on telemetrypolicies.extensions.kuadrant.io \"maas-telemetry-e2e-api-a-03ece2\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:353\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-02T21:31:58Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-api-a-03ece2","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-a-03ece2","reconcileID":"f5e0e16d-575e-4ad6-b1c4-32d41c231442","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-api-a-03ece2","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:31:58Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-a-03ece2","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T21:31:58Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:32:00Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-02T21:32:00Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-02T21:32:00Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-02T21:32:00Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:32:00Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-a-03ece2","event":"UNKNOWN"}
{"level":"info","ts":"2026-11-02T21:32:00Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:32:00.548Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:32:00.548Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:32:00.558Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:32:00.560Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:32:00.560Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:32:00.623Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:32:00.668Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:32:01Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-02T21:32:01Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-02T21:32:01Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-02T21:32:01Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:32:03.369Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:32:03.369Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T21:32:04.096Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-api-a-03ece2","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-api-a-03ece2\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:32:04.387Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthPolicy"],"eventTypes":{"update":1}}
{"level":"info","ts":"2026-11-02T21:32:08.069Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:32:08.127Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:32:08.127Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-02T21:32:08.135Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-api-a-d58d18","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"kuadrant-auth-e2e-api-a-d58d18","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-api-a-d58d18","uid":"368941ce-4790-45ac-9730-73738d519f4b"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-auth-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local","port_value":50051}}}}]}]},"name":"kuadrant-auth-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-api-a-d58d18"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-api-a-d58d18\" already exists"}
{"level":"error","ts":"2026-11-02T21:32:08.242Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route#v1-completions-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"7423a2f76c00c27e0a8383b9e315e7f7063dd5642156172f597daf18b46fde33","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["7423a2f76c00c27e0a8383b9e315e7f7063dd5642156172f597daf18b46fde33"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-70efbbab.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-70efbbab.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"7423a2f76c00c27e0a8383b9e315e7f7063dd5642156172f597daf18b46fde33\" already exists"}
{"level":"error","ts":"2026-11-02T21:32:08.312Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route#v1-model-routing"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"7dd93d350f32a149c45b09c240b7a22e2323c5563700b192f69d6c453081048e","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["7dd93d350f32a149c45b09c240b7a22e2323c5563700b192f69d6c453081048e"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-70efbbab.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-70efbbab.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"7dd93d350f32a149c45b09c240b7a22e2323c5563700b192f69d6c453081048e\" already exists"}
{"level":"error","ts":"2026-11-02T21:32:08.388Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-a-d58d18","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-a-d58d18#rule-5"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"2d25f68febc8f320146ec2af3ab66dc3421f1ae543d7036c1df1ff1e50efad8a","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["2d25f68febc8f320146ec2af3ab66dc3421f1ae543d7036c1df1ff1e50efad8a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-d58d18.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-d58d18.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"2d25f68febc8f320146ec2af3ab66dc3421f1ae543d7036c1df1ff1e50efad8a\" already exists"}
{"level":"error","ts":"2026-11-02T21:32:08.460Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route#v1-messages-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"686f86f63369549dfd81bff146f9663d1dd02886636e63f1ff5322994f99d220","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["686f86f63369549dfd81bff146f9663d1dd02886636e63f1ff5322994f99d220"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-70efbbab.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-70efbbab.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"686f86f63369549dfd81bff146f9663d1dd02886636e63f1ff5322994f99d220\" already exists"}
{"level":"error","ts":"2026-11-02T21:32:08.527Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route#v1-responses-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"660283bab741313169e87794c6dfdd92b2fd87e67da62906cea103cd6b1b7218","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["660283bab741313169e87794c6dfdd92b2fd87e67da62906cea103cd6b1b7218"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-70efbbab.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-70efbbab.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"660283bab741313169e87794c6dfdd92b2fd87e67da62906cea103cd6b1b7218\" already exists"}
{"level":"error","ts":"2026-11-02T21:32:08.596Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route#v1-messages-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"86769b4cd589416a0961b23aa701cac08477d8ee25523565ff53094b12f68d12","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["86769b4cd589416a0961b23aa701cac08477d8ee25523565ff53094b12f68d12"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-70efbbab.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-70efbbab.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"86769b4cd589416a0961b23aa701cac08477d8ee25523565ff53094b12f68d12\" already exists"}
{"level":"error","ts":"2026-11-02T21:32:08.666Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-a-d58d18","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-a-d58d18#rule-1"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"7d0bb611039e8ebca8af5954d0b9e7821364096893f65af03c311314d484e757","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["7d0bb611039e8ebca8af5954d0b9e7821364096893f65af03c311314d484e757"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-d58d18.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-d58d18.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"7d0bb611039e8ebca8af5954d0b9e7821364096893f65af03c311314d484e757\" already exists"}
{"level":"error","ts":"2026-11-02T21:32:08.733Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-a-d58d18","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-a-d58d18#rule-3"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"f182b2459abee81e600ea86232e1f3f945df5b76d4609a6c8de6416dfc6ea7fe","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f182b2459abee81e600ea86232e1f3f945df5b76d4609a6c8de6416dfc6ea7fe"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-d58d18.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-d58d18.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"f182b2459abee81e600ea86232e1f3f945df5b76d4609a6c8de6416dfc6ea7fe\" already exists"}
{"level":"error","ts":"2026-11-02T21:32:08.782Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-mt-70efbbab","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T21:31:08Z","generation":1,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"55b43ab2-2dfe-4712-81e7-9e7e015fa479\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:31:08Z"}],"name":"kuadrant-e2e-mt-70efbbab","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-mt-70efbbab","uid":"55b43ab2-2dfe-4712-81e7-9e7e015fa479"}],"resourceVersion":"42744","uid":"9d1488fb-b4ab-4157-85c6-449eabd21318"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7dd93d350f32a149c45b09c240b7a22e2323c5563700b192f69d6c453081048e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-70efbbab-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bb242d84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-70efbbab\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bb242d84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-70efbbab\"]}],\"name\":\"26af48aaec34e183a09f9ec435e1fedc3c724fea2fe9bcc26c8b30dc41445ecb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-mt-70efbbab/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7dd93d350f32a149c45b09c240b7a22e2323c5563700b192f69d6c453081048e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-70efbbab-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bb242d84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-70efbbab\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bb242d84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-70efbbab\"]}],\"name\":\"36d9bcf1282e1ab53cadabe1a773a796c771ca06d2ad1b75b2e21ebe44e294b2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-mt-70efbbab/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7dd93d350f32a149c45b09c240b7a22e2323c5563700b192f69d6c453081048e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-70efbbab-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bb242d84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-70efbbab\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bb242d84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-70efbbab\"]}],\"name\":\"42156308c37622fdd8e2eb715b54f0c21bcf8649d71887cdea7da283b2ae66f9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-mt-70efbbab/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7dd93d350f32a149c45b09c240b7a22e2323c5563700b192f69d6c453081048e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-70efbbab-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bb242d84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-70efbbab\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bb242d84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-70efbbab\"]}],\"name\":\"92d75bf53e6d0363367aa1b3f3995cea648ed403432ffe1adad4b0d501d0a117\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-mt-70efbbab/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7dd93d350f32a149c45b09c240b7a22e2323c5563700b192f69d6c453081048e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-70efbbab-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bb242d84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-70efbbab\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bb242d84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-70efbbab\"]}],\"name\":\"a884fa8010063383518375ec0ae32640857fe5481d803fac9c3df28db0fb2c8b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-mt-70efbbab/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7dd93d350f32a149c45b09c240b7a22e2323c5563700b192f69d6c453081048e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-70efbbab-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bb242d84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-70efbbab\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bb242d84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-70efbbab\"]}],\"name\":\"c2151a73fa3d8b6b1f9d2d9f1c2150a1192007efb42808765003fa15a61e6274\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-mt-70efbbab/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7dd93d350f32a149c45b09c240b7a22e2323c5563700b192f69d6c453081048e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-70efbbab-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bb242d84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-70efbbab\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bb242d84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-70efbbab\"]}],\"name\":\"4b7f0d2029b173a051f4dd548163881d503549308a25515c70902b49af622b5d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-mt-70efbbab/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7dd93d350f32a149c45b09c240b7a22e2323c5563700b192f69d6c453081048e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-70efbbab-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bb242d84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-70efbbab\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bb242d84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-70efbbab\"]}],\"name\":\"cc9fff076b130fafb40e2886a2c9cf7dd95dd367bb85d7a53426853675381336\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-mt-70efbbab/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0a626bd77283731109bdf44eb675ae0af0d6ae927fd1d71365c621209aa60038\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-70efbbab-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bb242d84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-mt-70efbbab\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-70efbbab\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bb242d84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-mt-70efbbab\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-70efbbab\"]}],\"name\":\"b87eba9ba35eb6a53338cb9c1a5f04f8c65b27b2608950e94b52695b57960191\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e2ef1a6a441ba51300173a3d2652431c0c70f9fbe3dec378b60bf73345e7ed62\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-70efbbab-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bb242d84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-70efbbab\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bb242d84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-70efbbab\"]}],\"name\":\"1593e2c64df0faa2ebc6b10952fa9b82d3efee58762f93cc9465e571a728d1f8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-mt-70efbbab/models/facebook/opt-125m/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7423a2f76c00c27e0a8383b9e315e7f7063dd5642156172f597daf18b46fde33\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-70efbbab-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bb242d84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-70efbbab\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bb242d84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-70efbbab\"]}],\"name\":\"a2ad544462cdf5b554a98107f4c0fd7c534ac2ac647f0b2aa5ab3da7a249ac13\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-mt-70efbbab/models/facebook/opt-125m/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7adf1ca91bf336959a508540d878f5239ea90c05e08e3636aeaa69a6226a3003\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-70efbbab-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bb242d84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-70efbbab\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bb242d84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-70efbbab\"]}],\"name\":\"4e0db781e2e53c4888f6416aa3fae6a7179f3b69a2df03210baf374560be0c7e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"660283bab741313169e87794c6dfdd92b2fd87e67da62906cea103cd6b1b7218\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-70efbbab-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bb242d84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-70efbbab\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bb242d84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-70efbbab\"]}],\"name\":\"78183ffd5b459106dac6bab76c2d8256b7277ddce528b569caaac70c532f9a2b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-mt-70efbbab/models/facebook/opt-125m/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"86769b4cd589416a0961b23aa701cac08477d8ee25523565ff53094b12f68d12\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-70efbbab-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bb242d84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-70efbbab\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bb242d84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-70efbbab\"]}],\"name\":\"87b653e00c12c47291b3ad13cd1edc5962f5eacbe22dc6a22fd3fca81dcb32bb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-mt-70efbbab/models/facebook/opt-125m/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c8eb1936334744a56aa2274ce9d6f51ea168179c65f92874f3b8076be0207259\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-70efbbab-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bb242d84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-70efbbab\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bb242d84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-70efbbab\"]}],\"name\":\"8605d3a698c26e3b9d59d014f7721566c9b36fb05b8ffea44af31df6cf59deeb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cd0342f6c3ef93f58d95e760fb8ed9fa936a0168aa423e2db15cd0f43b6a534f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-70efbbab-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bb242d84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-70efbbab\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bb242d84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-70efbbab\"]}],\"name\":\"d54ad85af9aa2c95a75a3acfc7c45d1345d75f60ce760e8f7044856c841c5d2c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"686f86f63369549dfd81bff146f9663d1dd02886636e63f1ff5322994f99d220\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-70efbbab-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bb242d84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-70efbbab\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bb242d84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-70efbbab\"]}],\"name\":\"efeb7d9fae7f1673ede7843140c3d4d113c2e28a67a0c22c07a649dd45b780af\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8963f302f71d40b22b463a6588998e3c87fec7d53908554dfc99bbb66749350f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-70efbbab-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bb242d84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-70efbbab\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bb242d84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-70efbbab\"]}],\"name\":\"4d28341dedff12df328604e7e875c24d702a2cfab162029d4cec927521dfceb0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-mt-70efbbab/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9ea783f2033457fc0f2f52f4f6f7a87dacb7918d14fd2c49d89468a40d5ce2f5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-70efbbab-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bb242d84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-70efbbab\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bb242d84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-70efbbab\"]}],\"name\":\"5af4bc8b44c95f3915077694bafb4178b8e18facb0071e8a73e278900ec2278c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fd62a73690c4cdd37a87d21a98021e6dfaac4eaa6e8bb6637dd1d0128e2c74ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-70efbbab-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bb242d84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-mt-70efbbab\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-70efbbab\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bb242d84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-mt-70efbbab\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-70efbbab\"]}],\"name\":\"0730cd900d638778f9c32f3f7d9c5f420d734632bb8252b568315c5a9676d0d8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6f155f9c22fd9155424959d77e15b09e2e46420c024c9208fdcbaaf5989ef3ab\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-70efbbab-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bb242d84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-mt-70efbbab\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-70efbbab\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bb242d84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-mt-70efbbab\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-70efbbab\"]}],\"name\":\"c720b7f2d11b3dbb7b799bbebd973a4d4ec8c684155c16c46e1eda1185ff8837\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"31073c5c317c28e8c591480ae44909bd2739da3e04a508fefa3153f5dfff2bd7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-70efbbab-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bb242d84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-mt-70efbbab\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-70efbbab\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bb242d84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-mt-70efbbab\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-70efbbab\"]}],\"name\":\"64099bf2730414a6f288ff5b1ac6eeee51286fe6f193710bdd769df5c9ee2087\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"51d36c7f5f5d3ce8ca874f6f293be93ec6a5b3c79a267dd55f8e4240e4bb0e5c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-70efbbab-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bb242d84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-mt-70efbbab\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-70efbbab\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bb242d84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-mt-70efbbab\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-70efbbab\"]}],\"name\":\"50d37a806bd243094a3c969b2322245adf16563d4a39be9ea98b97e027900dd5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"81610c6024322aa440cb76b35caf0e21d85e94dd73885d1aff7f8f6ba84a448b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-70efbbab-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bb242d84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-mt-70efbbab\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-70efbbab\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bb242d84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-mt-70efbbab\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-70efbbab\"]}],\"name\":\"f8e7a3e592323f9939c7310e2c6057d3a35fc55047d6200c2567409a248d5fd1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f8da20627f0169e69426fd609be7867dca7c3ecdf4acafec00912ff7791bd2d6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-70efbbab-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bb242d84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-70efbbab\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bb242d84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-70efbbab\"]}],\"name\":\"d19934dec818f9e60b561d1195bb12b26f34fc933a450d4f376abcf5b66fb12a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-mt-70efbbab/models/facebook/opt-125m')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-mt-70efbbab"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-mt-70efbbab\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:32:08.825Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-a-d58d18","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-a-d58d18#rule-6"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"74d062ece16de6291b26a7c851ae9ad94daeb2b1658a78ecdd5b82eccb46f428","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["74d062ece16de6291b26a7c851ae9ad94daeb2b1658a78ecdd5b82eccb46f428"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-d58d18.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-d58d18.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"74d062ece16de6291b26a7c851ae9ad94daeb2b1658a78ecdd5b82eccb46f428\" already exists"}
{"level":"error","ts":"2026-11-02T21:32:08.894Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route#v1-chat-completions-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"7adf1ca91bf336959a508540d878f5239ea90c05e08e3636aeaa69a6226a3003","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["7adf1ca91bf336959a508540d878f5239ea90c05e08e3636aeaa69a6226a3003"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-70efbbab.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-70efbbab.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"7adf1ca91bf336959a508540d878f5239ea90c05e08e3636aeaa69a6226a3003\" already exists"}
{"level":"error","ts":"2026-11-02T21:32:08.968Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route#v1-responses-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"cd0342f6c3ef93f58d95e760fb8ed9fa936a0168aa423e2db15cd0f43b6a534f","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["cd0342f6c3ef93f58d95e760fb8ed9fa936a0168aa423e2db15cd0f43b6a534f"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-70efbbab.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-70efbbab.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"cd0342f6c3ef93f58d95e760fb8ed9fa936a0168aa423e2db15cd0f43b6a534f\" already exists"}
{"level":"error","ts":"2026-11-02T21:32:09.157Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-a-d58d18","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-a-d58d18#rule-4"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"dc3d84166c185e2e9efa4acd8b367890b979890c0c10a12a78bc3c2766786204","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["dc3d84166c185e2e9efa4acd8b367890b979890c0c10a12a78bc3c2766786204"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-d58d18.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-d58d18.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"dc3d84166c185e2e9efa4acd8b367890b979890c0c10a12a78bc3c2766786204\" already exists"}
{"level":"error","ts":"2026-11-02T21:32:09.227Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route#v1-completions-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"c8eb1936334744a56aa2274ce9d6f51ea168179c65f92874f3b8076be0207259","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["c8eb1936334744a56aa2274ce9d6f51ea168179c65f92874f3b8076be0207259"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-70efbbab.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-70efbbab.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"c8eb1936334744a56aa2274ce9d6f51ea168179c65f92874f3b8076be0207259\" already exists"}
{"level":"error","ts":"2026-11-02T21:32:09.296Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"e2ef1a6a441ba51300173a3d2652431c0c70f9fbe3dec378b60bf73345e7ed62","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["e2ef1a6a441ba51300173a3d2652431c0c70f9fbe3dec378b60bf73345e7ed62"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-70efbbab.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-70efbbab.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"e2ef1a6a441ba51300173a3d2652431c0c70f9fbe3dec378b60bf73345e7ed62\" already exists"}
{"level":"error","ts":"2026-11-02T21:32:09.309Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-api-a-d58d18","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"name":"kuadrant-e2e-api-a-d58d18","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-api-a-d58d18","uid":"368941ce-4790-45ac-9730-73738d519f4b"}]},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"74d062ece16de6291b26a7c851ae9ad94daeb2b1658a78ecdd5b82eccb46f428\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-api-a-d58d18-maas-auth\"]}],\"name\":\"c2d23f6abfa6ff38254f8a1b6d6773419115a502eb2a964431a0e62ec036716a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9f2a987a320b377df030200370c0b900f2bd70ff716b091c5a0e1f8be7be152c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-api-a-d58d18-maas-auth\"]}],\"name\":\"5afdaa06cc691cf90546df3e7af1dc97c98e6344bc43eb64e1ad7aa3e73ced41\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2d25f68febc8f320146ec2af3ab66dc3421f1ae543d7036c1df1ff1e50efad8a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-api-a-d58d18-maas-auth\"]}],\"name\":\"7973d64d21f50691efba7a97eeb25020a9f37fc3e66994bb2e2380f554591d44\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f182b2459abee81e600ea86232e1f3f945df5b76d4609a6c8de6416dfc6ea7fe\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-api-a-d58d18-maas-auth\"]}],\"name\":\"e979e258af2fd679cc505a88d618bd407f8bd5a4cf82cfd90b067fcc88d11355\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"dc3d84166c185e2e9efa4acd8b367890b979890c0c10a12a78bc3c2766786204\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-api-a-d58d18-maas-auth\"]}],\"name\":\"bbb9265ab1c721efce8dd012f40a867a7efb081beef0f1327f68331d9d4a47f1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7d0bb611039e8ebca8af5954d0b9e7821364096893f65af03c311314d484e757\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-api-a-d58d18-maas-auth\"]}],\"name\":\"548ef1d4683818a7548552bffb089c141ca9343f75b47849a7dd98fc961d46a1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-api-a-d58d18"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-e2e-api-a-d58d18\" already exists"}
{"level":"error","ts":"2026-11-02T21:32:09.363Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-a-d58d18","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-a-d58d18#rule-2"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"9f2a987a320b377df030200370c0b900f2bd70ff716b091c5a0e1f8be7be152c","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["9f2a987a320b377df030200370c0b900f2bd70ff716b091c5a0e1f8be7be152c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-d58d18.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-d58d18.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"9f2a987a320b377df030200370c0b900f2bd70ff716b091c5a0e1f8be7be152c\" already exists"}
{"level":"error","ts":"2026-11-02T21:32:09.430Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"8963f302f71d40b22b463a6588998e3c87fec7d53908554dfc99bbb66749350f","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["8963f302f71d40b22b463a6588998e3c87fec7d53908554dfc99bbb66749350f"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-70efbbab.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-70efbbab.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"8963f302f71d40b22b463a6588998e3c87fec7d53908554dfc99bbb66749350f\" already exists"}
{"level":"error","ts":"2026-11-02T21:32:09.503Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route#v1-catch-all-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"9ea783f2033457fc0f2f52f4f6f7a87dacb7918d14fd2c49d89468a40d5ce2f5","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["9ea783f2033457fc0f2f52f4f6f7a87dacb7918d14fd2c49d89468a40d5ce2f5"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-70efbbab.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-70efbbab.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"9ea783f2033457fc0f2f52f4f6f7a87dacb7918d14fd2c49d89468a40d5ce2f5\" already exists"}
{"level":"error","ts":"2026-11-02T21:32:09.572Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"f8da20627f0169e69426fd609be7867dca7c3ecdf4acafec00912ff7791bd2d6","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f8da20627f0169e69426fd609be7867dca7c3ecdf4acafec00912ff7791bd2d6"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-70efbbab.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-70efbbab.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"f8da20627f0169e69426fd609be7867dca7c3ecdf4acafec00912ff7791bd2d6\" already exists"}
{"level":"error","ts":"2026-11-02T21:32:09.642Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-api-a-d58d18-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-api-a-d58d18-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:32:09.918Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"maas-gateway-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"maas-gateway-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:32:10.056Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-mt-70efbbab-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-mt-70efbbab-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:32:10.411Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"maas-api-route-e2e-api-a-d58d18","namespace":"odh-ai-gateway-infra","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"maas-api-route-e2e-api-a-d58d18\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:32:10.536Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"e2e-lifecycle-model-70efbbab-kserve-route","namespace":"ai-tenant-e2e-mt-70efbbab","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"e2e-lifecycle-model-70efbbab-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:32:10.701Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-api-a-d58d18","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-api-a-d58d18\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:32:10.759Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-api-a-03ece2","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-api-a-03ece2\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:32:17.842Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","HTTPRoute","AuthPolicy","TokenRateLimitPolicy","EnvoyFilter","Limitador","Kuadrant","ConfigMap","Gateway"],"eventTypes":{"create":24,"update":25}}
{"level":"info","ts":"2026-11-02T21:32:18.040Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:32:18.060Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:32:20.435Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:32:20.445Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:32:20.663Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:32:20.869Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:32:20.869Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:32:23.390Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:32:23.400Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:32:23.400Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:32:23.423Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:32:23.423Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:32:23.433Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"error","ts":"2026-11-02T21:32:23.570Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:32:23.570Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:32:26.053Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:32:26.054Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T21:32:26.338Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-worker-w3-f51151","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-worker-w3-f51151\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:32:36.569Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","Gateway","Limitador","EnvoyFilter","AuthPolicy","HTTPRoute","AuthConfig","ConfigMap"],"eventTypes":{"create":10,"update":12}}
{"level":"info","ts":"2026-11-02T21:32:36.812Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:32:38.737Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:32:38.857Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:32:38.857Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:32:42.084Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:32:42.089Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:32:42.123Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:32:42.130Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:32:42.133Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:32:42.133Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:32:42.252Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:32:45.272Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:32:45.272Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:32:46.613Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway","AuthPolicy"],"eventTypes":{"create":1,"update":1}}
{"level":"info","ts":"2026-11-02T21:32:52.125Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:32:52.130Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:32:52.132Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:32:52.132Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:32:52.138Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:32:52.141Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-11-02T21:32:52.242Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:32:52.242Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T21:32:52.243Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-a-d58d18","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-a-d58d18#rule-1"},"creationTimestamp":"2026-11-02T21:32:01Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:32:01Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:32:02Z"}],"name":"7d0bb611039e8ebca8af5954d0b9e7821364096893f65af03c311314d484e757","namespace":"kuadrant-system","resourceVersion":"44183","uid":"d5a62dda-791e-48a8-92eb-5f2419a4d995"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["7d0bb611039e8ebca8af5954d0b9e7821364096893f65af03c311314d484e757"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-d58d18.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-d58d18.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:32:02Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:32:02Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["7d0bb611039e8ebca8af5954d0b9e7821364096893f65af03c311314d484e757"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"7d0bb611039e8ebca8af5954d0b9e7821364096893f65af03c311314d484e757\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:32:52.340Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-a-d58d18","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-a-d58d18#rule-2"},"creationTimestamp":"2026-11-02T21:32:00Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:32:00Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:32:01Z"}],"name":"9f2a987a320b377df030200370c0b900f2bd70ff716b091c5a0e1f8be7be152c","namespace":"kuadrant-system","resourceVersion":"44148","uid":"8773cc70-2e69-4253-a457-d9d43680a12d"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["9f2a987a320b377df030200370c0b900f2bd70ff716b091c5a0e1f8be7be152c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-d58d18.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-d58d18.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:32:01Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:32:01Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["9f2a987a320b377df030200370c0b900f2bd70ff716b091c5a0e1f8be7be152c"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"9f2a987a320b377df030200370c0b900f2bd70ff716b091c5a0e1f8be7be152c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:32:52.443Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-a-d58d18","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-a-d58d18#rule-5"},"creationTimestamp":"2026-11-02T21:32:01Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:32:01Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:32:01Z"}],"name":"2d25f68febc8f320146ec2af3ab66dc3421f1ae543d7036c1df1ff1e50efad8a","namespace":"kuadrant-system","resourceVersion":"44173","uid":"2873931e-76ac-402b-a260-5bde0626c393"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["2d25f68febc8f320146ec2af3ab66dc3421f1ae543d7036c1df1ff1e50efad8a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-d58d18.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-d58d18.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:32:01Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:32:01Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["2d25f68febc8f320146ec2af3ab66dc3421f1ae543d7036c1df1ff1e50efad8a"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"2d25f68febc8f320146ec2af3ab66dc3421f1ae543d7036c1df1ff1e50efad8a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:32:52.510Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route#v1-responses-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"a649343311197c716e0b6f502bb8ad21ecf4e207e16ffc6e0b74b1dc4f05f7fb","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a649343311197c716e0b6f502bb8ad21ecf4e207e16ffc6e0b74b1dc4f05f7fb"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-f51151.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-f51151.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"a649343311197c716e0b6f502bb8ad21ecf4e207e16ffc6e0b74b1dc4f05f7fb\" already exists"}
{"level":"error","ts":"2026-11-02T21:32:52.594Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route#v1-responses-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"cf25727b6a9419d97ed5dc9613d3b6a26e590c05f01b5c4038461accc96bc026","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["cf25727b6a9419d97ed5dc9613d3b6a26e590c05f01b5c4038461accc96bc026"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-f51151.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-f51151.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"cf25727b6a9419d97ed5dc9613d3b6a26e590c05f01b5c4038461accc96bc026\" already exists"}
{"level":"error","ts":"2026-11-02T21:32:52.664Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route#v1-catch-all-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"5d4b7dc290bd7cb2c0c574a9869b31b45107252e6aaf512691b5c665967d6821","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["5d4b7dc290bd7cb2c0c574a9869b31b45107252e6aaf512691b5c665967d6821"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-f51151.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-f51151.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"5d4b7dc290bd7cb2c0c574a9869b31b45107252e6aaf512691b5c665967d6821\" already exists"}
{"level":"error","ts":"2026-11-02T21:32:52.730Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-a-d58d18","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-a-d58d18#rule-3"},"creationTimestamp":"2026-11-02T21:32:00Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:32:00Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:32:01Z"}],"name":"f182b2459abee81e600ea86232e1f3f945df5b76d4609a6c8de6416dfc6ea7fe","namespace":"kuadrant-system","resourceVersion":"44142","uid":"941f7708-6ede-493a-8f40-e34bb86cb6c4"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f182b2459abee81e600ea86232e1f3f945df5b76d4609a6c8de6416dfc6ea7fe"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-d58d18.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-d58d18.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:32:01Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:32:01Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["f182b2459abee81e600ea86232e1f3f945df5b76d4609a6c8de6416dfc6ea7fe"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"f182b2459abee81e600ea86232e1f3f945df5b76d4609a6c8de6416dfc6ea7fe\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:32:52.799Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route#v1-messages-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"6610d72af8a18be17c09082b4389a248d739315be17e0e146375e82e8d76261d","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["6610d72af8a18be17c09082b4389a248d739315be17e0e146375e82e8d76261d"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-f51151.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-f51151.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"6610d72af8a18be17c09082b4389a248d739315be17e0e146375e82e8d76261d\" already exists"}
{"level":"error","ts":"2026-11-02T21:32:52.863Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-a-d58d18","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-a-d58d18#rule-4"},"creationTimestamp":"2026-11-02T21:32:01Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:32:01Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:32:03Z"}],"name":"dc3d84166c185e2e9efa4acd8b367890b979890c0c10a12a78bc3c2766786204","namespace":"kuadrant-system","resourceVersion":"44238","uid":"761e85e6-3981-4ea7-8f72-f949dc1b7e13"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["dc3d84166c185e2e9efa4acd8b367890b979890c0c10a12a78bc3c2766786204"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-d58d18.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-d58d18.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:32:03Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:32:03Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["dc3d84166c185e2e9efa4acd8b367890b979890c0c10a12a78bc3c2766786204"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"dc3d84166c185e2e9efa4acd8b367890b979890c0c10a12a78bc3c2766786204\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:32:52.930Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route#v1-completions-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"acbe19c11dc0fe08b370bbe647de6ecce77849e75c774c3e46f4a7af09e2861f","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["acbe19c11dc0fe08b370bbe647de6ecce77849e75c774c3e46f4a7af09e2861f"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-f51151.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-f51151.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"acbe19c11dc0fe08b370bbe647de6ecce77849e75c774c3e46f4a7af09e2861f\" already exists"}
{"level":"error","ts":"2026-11-02T21:32:53.041Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-worker-w3-f51151","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T21:21:31Z","generation":8,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"8871137c-7f6a-401d-a6db-2983aea5ba22\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:31:08Z"}],"name":"kuadrant-e2e-worker-w3-f51151","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-worker-w3-f51151","uid":"8871137c-7f6a-401d-a6db-2983aea5ba22"}],"resourceVersion":"42740","uid":"c24c0550-6758-4dca-8d2b-3fe32740d122"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a05d7e315cc7cde173ab18a777672d3a18ce0a96f8f52d505404dcf8d1e51c20\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"0e7c31c41adb0d3f9efc929ae631573fe0c783a2fa7edb7a4b135081c2969bbf\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6c73e108ce3d5ef8ece11651aca73aa00bd88530b6aba861d23ca7b6ff89ba5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"aedbd7ef0308fd9494e9a3a1386b732923d5d060acf5a188601898d4867d320f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7b56d8e34a0de188e49dc0ae60057e421eb8bc4643546e49b2fe810120869498\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"b6389ab82133347e2514a4ad1cbd9d34042edc9a4ad044714155dbb2aecf38d4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a942d85d233c0e2e8932f598b5b8c9b97eda0ae826b5a80a742559b36fa56979\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"85e7f37f931469abe1b396a1a44b52a8b72e6a4dc98ed0ebdd61e43f0486de13\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a05d7e315cc7cde173ab18a777672d3a18ce0a96f8f52d505404dcf8d1e51c20\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"ec8a1b6bbf984a67cda63e2d923bfa9d2d66a7537f676f6198c12cbca9103517\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6c73e108ce3d5ef8ece11651aca73aa00bd88530b6aba861d23ca7b6ff89ba5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"5c9b9ac2bc33c747eb54045ee2511e3c8b2ee9737a3f347afb75903f43d74fb7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7b56d8e34a0de188e49dc0ae60057e421eb8bc4643546e49b2fe810120869498\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"f82b9432930517e02d229f4fdbdd8b6700b061d5d333fe35b064a3bb85f58e76\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a942d85d233c0e2e8932f598b5b8c9b97eda0ae826b5a80a742559b36fa56979\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"6d321a24ed09abad642dee549f0c7cbf98ce40481beb85ca79bd3d4eeb89b77e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a05d7e315cc7cde173ab18a777672d3a18ce0a96f8f52d505404dcf8d1e51c20\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"a54bd689e670e5f8bbee0a66c2585a4d4adce9a5a7fc297449ee3b816a0c2695\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6c73e108ce3d5ef8ece11651aca73aa00bd88530b6aba861d23ca7b6ff89ba5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"ad845c31a125851bf4cc5ae7e83bb4a011cf98484d99780ab16df250ca9dd41c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7b56d8e34a0de188e49dc0ae60057e421eb8bc4643546e49b2fe810120869498\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"9eefe22cd9d7f4d324cc07e6422d998261fea96e9069bc938fe66a94e8c8cadb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a942d85d233c0e2e8932f598b5b8c9b97eda0ae826b5a80a742559b36fa56979\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"b00ec38cf5be980b160374be347b182afaa16e0dc99314a5e990f20cef6d57ed\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a05d7e315cc7cde173ab18a777672d3a18ce0a96f8f52d505404dcf8d1e51c20\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"6d5d9aca320022f0f8b70c3f9b34b5922adf537f5da717ec79924566febf6df1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6c73e108ce3d5ef8ece11651aca73aa00bd88530b6aba861d23ca7b6ff89ba5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"346e75cab49a1cf8ae89d90cfb32099256f44d7909e40cdc730e951946a411e2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7b56d8e34a0de188e49dc0ae60057e421eb8bc4643546e49b2fe810120869498\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"ae0a4172fa23a6e8857123675126f34bcaf4e08f94c05663e2913801fda46401\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a942d85d233c0e2e8932f598b5b8c9b97eda0ae826b5a80a742559b36fa56979\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"ee0931c3dc206732c58bab1add9bf2cb602a2eb21bfa9272c2df596197dceb3e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a05d7e315cc7cde173ab18a777672d3a18ce0a96f8f52d505404dcf8d1e51c20\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"3f6b6643d5731a355a44968b83b24169ff3e0c1b36737d8be7f9d42e1def7c3e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6c73e108ce3d5ef8ece11651aca73aa00bd88530b6aba861d23ca7b6ff89ba5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"cd8ab5f89e71494c8d176f9668b8ed279bd244e6f70d1a5c87603877b4b7182d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7b56d8e34a0de188e49dc0ae60057e421eb8bc4643546e49b2fe810120869498\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"09df06c068a0d1324c44679ca0c022e74cd18bae1497d0087fb2184f9401d63b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a942d85d233c0e2e8932f598b5b8c9b97eda0ae826b5a80a742559b36fa56979\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"821121f5584e938a01b323996203984576204f894f2c9f09f5ececcdc058373e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a05d7e315cc7cde173ab18a777672d3a18ce0a96f8f52d505404dcf8d1e51c20\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"e00f3dfbbce60a718137b415a42cbf1e65a7b226437cc4600d9fa76b264e3b4d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a05d7e315cc7cde173ab18a777672d3a18ce0a96f8f52d505404dcf8d1e51c20\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"7ddf0d6bdcfc6aa206cdc0919b1d5b7545c903aafbb0e16d393016b1a83bd29a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6c73e108ce3d5ef8ece11651aca73aa00bd88530b6aba861d23ca7b6ff89ba5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"fe3b37fdd5d3f9d3bdf7d03b186d964b283bfbe7d3ffa720457517666c3070a2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6c73e108ce3d5ef8ece11651aca73aa00bd88530b6aba861d23ca7b6ff89ba5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"7dd9491b4755b4900c5bc55b4dd9aff38f99899f0236e4d21bf7c94e5769cbb1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7b56d8e34a0de188e49dc0ae60057e421eb8bc4643546e49b2fe810120869498\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"fa5430186b33e56d19e4d2e0209b4f2215d17b488745cd8061eb5ecaf96ecafa\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7b56d8e34a0de188e49dc0ae60057e421eb8bc4643546e49b2fe810120869498\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"cd88af3d71345ad9b32dfae02550fa9bf6aa0cddfac2d0464a60cd90b9898d74\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a942d85d233c0e2e8932f598b5b8c9b97eda0ae826b5a80a742559b36fa56979\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"2182ac070ac99ffbeb246624e36aa202ce8c626bd38aaa3191f5e60a408bc782\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a942d85d233c0e2e8932f598b5b8c9b97eda0ae826b5a80a742559b36fa56979\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"97e41dd7c810563f2cac2a1c963d220c840d6b756c6c76b0cf97113387aab38b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a05d7e315cc7cde173ab18a777672d3a18ce0a96f8f52d505404dcf8d1e51c20\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"a00edc25239da061cd0457625d6046ede5f9d09507c78c2209e1e992795831c9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6c73e108ce3d5ef8ece11651aca73aa00bd88530b6aba861d23ca7b6ff89ba5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"fbd557cfa232fb43236e5864400cd1522fbf21d014450df4a714ea2d3608e863\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7b56d8e34a0de188e49dc0ae60057e421eb8bc4643546e49b2fe810120869498\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"f809ccd15563984c9befad8f50ee38613b9c34eda0af01f561e75be88cba33ab\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a942d85d233c0e2e8932f598b5b8c9b97eda0ae826b5a80a742559b36fa56979\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"749b6bc66485455bb3cc5a0d552c38935bb446a6be85e306d894e6cbb4d92c08\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b31ddb7ef02e35e9d172430b50a004a3047564232880010bd3e581bf0dc547f8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"a1ec0f0592798b3996117a17734b0936906621077ceec69c81d8fb77e89a142a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"75a5abd89bb4e6258c7f7c7be472e6131799539dbbb87686c1010afe2791e45e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"3ca8a6339da3e4298e514bea168ac30f6c718d158fa0efc5e0fd85f06754a528\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"72bb4e3923485ca35015ee8655bc43ee332eea77f2cd8effbd48b21828f89f80\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"879fe62fbbe8b0a130140cda7f546611c758fb8fa416f173d2b0cf3da17d7941\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ed162da516e04d5229dc1d49e1c785e9db374ba4ba028ecabbdccdcb33acd1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"b43372d2a0820427086903362809a4a0c757cd1d6f593ba48a755e5fb972575d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f9603ac54a5668b179c6ba3dcda3951e57253a5ad5ad80214b563f50337f3a9c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"7caf859dfb9739029a8c1b13adba06164610495beddbda8e01fd7b432b15f4c3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"775fdec32977b769224a6d9530e33a1b93a2948f54e3f459e979da99f7def4ea\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"5cebae68b5e59e34a98c9c038f83d877f079732894ec3403d349e0b7ae0c9099\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6ab1b21b6f75f2c1ef86f9bcf36a6c25244e88430832e3ac86a839cf10bb8dcd\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"15ecb8224cf6049c2e831c815cc4f0aed954432b967d01d55ea637294f3ea87e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8b2fbdc0f4b402fd19fb549b70da796c6867a52206fa0420df2d6debc0db70b7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"7cb303fae9824d31834d539772c1840fd2991481566b7d07635c9284c524ae4d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a649343311197c716e0b6f502bb8ad21ecf4e207e16ffc6e0b74b1dc4f05f7fb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"699e8723136e653d04a8800a9289a3543f733ebfd0f99efbedfd18d22de4c281\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a6267fc785126adca5b68df13f95ef1fa08e1d72b66fbff01b54f8d61edaf7ba\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"9a72bfcef40a8da2865b02b6123c023d9f4f17c11a2ff674e3ed24af23e468e2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a6d41f4e9f57ec1e6bb4423e49991033d85f00a2a3303e02b25d1eedb67be3c9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"ad4137b1e753fd100088742941c8aaee9eaddc158bbaf221eb0d7318bdb8dfb5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6610d72af8a18be17c09082b4389a248d739315be17e0e146375e82e8d76261d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"66a5afc61110ab52ae4b9c9d79944467f91c4a2bd7b954ed8f59e651c215c630\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aea6441051c6a7490e44d5f7bab0e4bf7cf461c9597675611789e8d9141a446c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"c871ffab27f7ed925d56fae005e70fd3716aab799f0484d7d44519e915491d11\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"be7879d2a6daa00da89abfe5895a77787208f1af5b8582c79c8dd2849ef7906c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"461ea56b8a105dbd1d386b531c80b5a86960df99b24b6f6668520921b280a609\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7f4456bc894bf7ab59ba02c25915a8db007a89ffdd1efcace437a7761c68b3f9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"aedfea0f1dceed2b1af07ebf6e7dbc55cdc958ea5a084291f6216a19f63eae8a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f23dfebb92a3f3d59997030cce08899533ec20be47590cd866dd896392db04de\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"f42d6cbc7a49b6c1c4f0668dc536500321a8f658d1ab1a3a8b2ad8c0a95b272c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c57cda59d33d438c637a64dce8619a9616880a275363557ccc83d2cbc4920e14\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"1a3df8e6f6ad36c3eb928970ca2e746005e16b25405fc6eb9f44977b07d56905\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"086314a2fc965880bf769a18d3353909b6a1e5544e7eb514174994ba24387652\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"8e63847006a8d1952318fe3b6d2707027991d1c00d7959d051b3baf72690aecf\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f1def6d908410a124665ecd632ae01e5ba977920643dab1a35d25277292bae55\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"1199947fd30f0d1dab3db5846b8d27e36b6284be94834b798e4004120ec52532\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"676709317386301aa762cc48b7aa0064bc03adc00abbddfda8d0294046751d34\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"8a51327014eb82d6df6700b3f79ae6010cc76b2ee750f56ac5cb49c5b6f975ed\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d8557b9861d48e5714a954e0a885ecc7e55e6b9f034fc9f24f4c5c2f6dafce5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"91c8ce1078dc4a26a7cb0af054981aa28b4768dcd87a9a167f98e9b4e4b60325\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d63de28626482cf5fa2aaf12cb9aa3def86d637d4c98f193819331c36fa73b21\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"fae01409c891b630fc644ebf1b8bc640438a1fc79de2b0750d34e2a6388d4ca6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f86615df74e8d3814df8817b06dc7578a4b0af0817397c5bdddb1daaaeb1df4e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"2d972852e655bb76327ea47e134854d589cf64538813171d00544a81dc138f4f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ca57331ce8d0c8497c210605ffe8878f757d572164898f4f870b89fcf2f9f1ed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"1ef135f8dcdcaa663d4184fa6364518f7001a744380301035f254e16acdad0b7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"06c1a51758821d18e14577dc995b939fe472579672223b3bf0c1a312b23f23c4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"a90d5652afa4bbc65c24ada88ebb0df97a9c759ab0004d0c85d28f7e4c012bb9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/premium-w3-f51151/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"acbe19c11dc0fe08b370bbe647de6ecce77849e75c774c3e46f4a7af09e2861f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"b1fa0497afe070203ab9c23aef75e896659b83c8305ca7a56664d1717528e732\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7b5f8cd8dfbddc7109fd206805e23a6ae21c18bf406c0001927759ff1a39122f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"64238089f4803f45c8353b0d5d05ac6a23d6a3647106591fdc2bd5299c0b0759\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fd143bc18213c3c4682bcced572bcf84c1cbc8cd87ea188e96c990f164fd5ade\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"3ede2f522e381a5e5b8affa5afed6ede7d3894cf263c247dca9b3f3f3ad4a676\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cf25727b6a9419d97ed5dc9613d3b6a26e590c05f01b5c4038461accc96bc026\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"fb213d7be796970427643a4a818af11356ba854b3a0477e3c48bc2ef3332c7d5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cb9167704c77a112808785ad099bc015c57786c61e7befec251b029ce378a0c6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"ef8b5b3a53f3de47fd70ccb56be2422e84d7fb1f10a03b64c032baca50a33c79\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9a4beabc5e6770b1db0aae064836730685e70fcacd601193f69aafe8156d41a4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"667e44e20cda74056b10928af7322c52f17d044dda1b5aded34df466201c3e4d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/premium-w3-f51151/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fdd358955bc325dacf4ae3d584d9dfaa236b2605d42014543bcddb868221d0fa\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"0a4335c7c536062bc1f3c4f55fad89ef387858062864c877a3014c384192a4f5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"91d11ef27666b7f1f85063266e00a4add2242586a1e8a4bac5447b3f4ec7925d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"26827917812d006281f7f7ba6e53d3573012708364624693432b2cbdd0f434b5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"79bf752ac34000e70b4860b3a87054e1aab2babf35019e7e24d203c82f5f1c70\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"e8683890d73b71f6556b533ec6f92b30804817a025abb3d3c716a89f9b3f85d9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"707f7a9a5bb373d466ca8ba9e6220842edd61bdf74768cdb8760aca4648a21b3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"b90f395e8ebaa67a3ab9ee2a967d88bbf981033415dedacddf2e76a8347bfd39\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/premium-w3-f51151/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a40304ff6b4a0f6c57da3d4a6bcc549a18c94ce2ed3356df2ce4c4621e7d5231\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"ff65bd9a43408c55f0593fcb41763d9030c7823704d875b6050eb2c39b500d75\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ab3c6da9622dba177dfaf10df58f987a09c5bd12e35f73cca3f03ce632140cd4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"9ec2510ba7c20be712eae31e88eb54985eedbb6ce61783804c05db0582107bc2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/premium-w3-f51151/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5d4b7dc290bd7cb2c0c574a9869b31b45107252e6aaf512691b5c665967d6821\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"f6fff5f3b2673f2810cddb2b65518e70b74aad58e6c27ef1faf828a9cdef8c14\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d896bcdf40d08e0bef242ce04aa58467e96c672450af890adda6941c53a574d3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"69bd1c4b3e1b36f5d5d62283b221b7026a4e53da339ac7c470f75cb4334435f6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"16bf1b94bcdc2b222ee7ef5dfdb45298f40e57fcf65f862a63a7b2d64b143143\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"ec2b739c69e9a51aedc6a2ee8ed6e7bbcb37f4eff66695b2c6d1bf4950a2ecb3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3fdafb69d9c72b7e3c78e50b30f01adec907957097c6a1e811ceff68d93d7c23\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"a31568314e38d20d12f5921c57463100edd3022d5f9f3c0b36033d9a4dee9193\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e11ba50523ae86c5c06c5b76176154ed9ba57c3ed13fa43133b1ac7249ce345f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"67192e2ead59827b5990f7b4cbc2aece4271402ddcdfaa76f7cf95d2d4552c43\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b6344fa6f672d55d2eb4fbf6449de24a41dbf664f8e9d3c01ecde50e9d46e233\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"3c429336b45d9712bfdb0d99ecd41baa0dde1570067b941b5927e1894931c254\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d1f3365185f5fcfe92899c5f49af1b579baab97128b8afee3eed4350859c3f14\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"2f17c508c987cffd0b45ebd164fcee3ad66819a39900f83fbeda518ccf619183\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"85124e62247f9234752fedfc382ba93d6f839dab53f49c16951446afa3e613aa\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"6d2c4320e5eae8e51596e1c62f1c7494e1c5f9cd5d374e73b3ddae65dd071a92\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"461f0fb3ed9e91195eaa488b65b6f04cb4bff62087edbcf0d4c2186d180ba0ab\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"994b30d96390325263d89c2da7554eadd9d4fd1811371afabaf057df68e19205\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d13670b5b1696edcb191c925fa86dd729eeb7447f2230e160d9cc03e0117604d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"f70585dfa8966b9748a8978bfdf51d589a9d85f553359b47bfa09ad8bb266b02\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"18b02d50add3a7c29ec6127eedab648f22d172b48224a97365a7798a612dcd01\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"1e0c9c02fbbf3d69df4286ba8224f5543dfc90c1df5aa687b5b6f1c00dce4d56\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3f0daf8882dbe2b0594c2bb310f151a319cec601c5028d24f0d4557684bfb5f1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"4d8ba792ec63f5d46b5589f993126734f136e3569a1b7639aaea8768dc2c0f57\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a8ad3ccfafcc25ea959dd98788332d9514ad2d762423f3039adff91a3381329f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"b159e4d34dc2a1f6fe05bc0d616c2ebb2d3306defc93bfb6d4035e2f842e1b91\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-worker-w3-f51151"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-worker-w3-f51151\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:32:53.059Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route#v1-messages-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"fdd358955bc325dacf4ae3d584d9dfaa236b2605d42014543bcddb868221d0fa","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["fdd358955bc325dacf4ae3d584d9dfaa236b2605d42014543bcddb868221d0fa"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-f51151.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-f51151.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"fdd358955bc325dacf4ae3d584d9dfaa236b2605d42014543bcddb868221d0fa\" already exists"}
{"level":"error","ts":"2026-11-02T21:32:53.140Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route#v1-chat-completions-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"d8557b9861d48e5714a954e0a885ecc7e55e6b9f034fc9f24f4c5c2f6dafce5e","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d8557b9861d48e5714a954e0a885ecc7e55e6b9f034fc9f24f4c5c2f6dafce5e"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-f51151.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-f51151.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"d8557b9861d48e5714a954e0a885ecc7e55e6b9f034fc9f24f4c5c2f6dafce5e\" already exists"}
{"level":"error","ts":"2026-11-02T21:32:53.211Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"a8ad3ccfafcc25ea959dd98788332d9514ad2d762423f3039adff91a3381329f","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a8ad3ccfafcc25ea959dd98788332d9514ad2d762423f3039adff91a3381329f"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-f51151.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-f51151.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"a8ad3ccfafcc25ea959dd98788332d9514ad2d762423f3039adff91a3381329f\" already exists"}
{"level":"error","ts":"2026-11-02T21:32:53.288Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route#v1-model-routing"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"a942d85d233c0e2e8932f598b5b8c9b97eda0ae826b5a80a742559b36fa56979","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a942d85d233c0e2e8932f598b5b8c9b97eda0ae826b5a80a742559b36fa56979"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-f51151.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-f51151.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"a942d85d233c0e2e8932f598b5b8c9b97eda0ae826b5a80a742559b36fa56979\" already exists"}
{"level":"error","ts":"2026-11-02T21:32:53.355Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"75a5abd89bb4e6258c7f7c7be472e6131799539dbbb87686c1010afe2791e45e","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["75a5abd89bb4e6258c7f7c7be472e6131799539dbbb87686c1010afe2791e45e"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-f51151.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-f51151.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"75a5abd89bb4e6258c7f7c7be472e6131799539dbbb87686c1010afe2791e45e\" already exists"}
{"level":"error","ts":"2026-11-02T21:32:53.422Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"086314a2fc965880bf769a18d3353909b6a1e5544e7eb514174994ba24387652","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["086314a2fc965880bf769a18d3353909b6a1e5544e7eb514174994ba24387652"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-f51151.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-f51151.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"086314a2fc965880bf769a18d3353909b6a1e5544e7eb514174994ba24387652\" already exists"}
{"level":"error","ts":"2026-11-02T21:32:53.484Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-a-d58d18","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-a-d58d18#rule-6"},"creationTimestamp":"2026-11-02T21:32:01Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:32:01Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:32:01Z"}],"name":"74d062ece16de6291b26a7c851ae9ad94daeb2b1658a78ecdd5b82eccb46f428","namespace":"kuadrant-system","resourceVersion":"44166","uid":"123f402c-3103-43f9-b693-34c101eeb8f0"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["74d062ece16de6291b26a7c851ae9ad94daeb2b1658a78ecdd5b82eccb46f428"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-d58d18.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-d58d18.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:32:01Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:32:01Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["74d062ece16de6291b26a7c851ae9ad94daeb2b1658a78ecdd5b82eccb46f428"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"74d062ece16de6291b26a7c851ae9ad94daeb2b1658a78ecdd5b82eccb46f428\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:32:53.554Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route#v1-completions-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"775fdec32977b769224a6d9530e33a1b93a2948f54e3f459e979da99f7def4ea","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["775fdec32977b769224a6d9530e33a1b93a2948f54e3f459e979da99f7def4ea"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-f51151.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w3-f51151.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"775fdec32977b769224a6d9530e33a1b93a2948f54e3f459e979da99f7def4ea\" already exists"}
{"level":"error","ts":"2026-11-02T21:32:53.774Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-worker-w3-f51151-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-worker-w3-f51151-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:32:53.844Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-mt-70efbbab-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-mt-70efbbab-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:32:54.117Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-api-a-03ece2-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-api-a-03ece2-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:32:54.179Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-api-a-03ece2","namespace":"openshift-ingress","uid":"3e4f55cf-c96f-4dbe-8ced-c7ad86867a7f","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-api-a-03ece2\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:32:54.181Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-api-a-d58d18-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-api-a-d58d18-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:32:54.836Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w3-f51151","namespace":"e2e-models-e2e-worker-w3-f51151","uid":"e3340067-224a-43ad-8020-ca9e00ead152","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w3-f51151\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:32:54.837Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:32:54.837Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T21:32:55.187Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"distinct-2-w3-f51151-kserve-route","namespace":"e2e-models-e2e-worker-w3-f51151","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"distinct-2-w3-f51151-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:33:02.544Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","AuthPolicy","ConfigMap","Gateway","HTTPRoute","TokenRateLimitPolicy","Limitador","EnvoyFilter"],"eventTypes":{"create":14,"update":16}}
{"level":"info","ts":"2026-11-02T21:33:02.859Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:33:04.767Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:33:04.956Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:33:04.956Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:33:07.745Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:33:07.745Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:33:07.755Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:33:07.757Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:33:07.763Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:33:07.763Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-02T21:33:07.860Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:33:07.860Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:33:11.174Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:33:11.174Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:33:18.967Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","ConfigMap","EnvoyFilter","TokenRateLimitPolicy","AuthPolicy","HTTPRoute","Limitador"],"eventTypes":{"update":36}}
{"level":"info","ts":"2026-11-02T21:33:19.248Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:33:20.354Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:33:20.455Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:33:20.455Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:33:23.637Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:33:23.646Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:33:23.646Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:33:23.656Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:33:23.656Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:33:23.663Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:33:23.771Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T21:33:25.972Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w3-f51151","namespace":"e2e-models-e2e-worker-w3-f51151","uid":"e3340067-224a-43ad-8020-ca9e00ead152","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w3-f51151\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:33:26.095Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:33:26.095Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:33:31Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-api-b-54a4b2","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-b-54a4b2","reconcileID":"d52b773c-cf8d-4717-ba46-a6d358a6a6d9","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-api-b-54a4b2","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:33:31Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-b-54a4b2","event":"CREATE"}
{"level":"info","ts":"2026-11-02T21:33:31Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:33:31Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-02T21:33:31Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-02T21:33:31Z","logger":"telemetry-policy-extension-controller","msg":"Failed to update status: resource might just be outdated"}
{"level":"info","ts":"2026-11-02T21:33:31Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:33:31Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-api-b-54a4b2","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-b-54a4b2","reconcileID":"8e86a1c7-38ba-40c7-81aa-bcd27350bc66","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-api-b-54a4b2","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:33:31Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-b-54a4b2","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T21:33:31Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:33:32Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-02T21:33:32Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-02T21:33:32Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:33:32Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-api-b-54a4b2","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-b-54a4b2","reconcileID":"f1a19e82-a7d7-4a3f-ba5f-ca56d1fcf1c8","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-api-b-54a4b2","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:33:32Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-b-54a4b2","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T21:33:32Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:33:33Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-02T21:33:33Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-02T21:33:33Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-02T21:33:33Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:33:36.921Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthPolicy","Gateway","Limitador","HTTPRoute","TokenRateLimitPolicy","ConfigMap"],"eventTypes":{"create":2,"update":6}}
{"level":"info","ts":"2026-11-02T21:33:37.183Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:33:39.046Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:33:39.263Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:33:39.263Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:33:42.637Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:33:42.645Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:33:42.652Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:33:42.657Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:33:42.664Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:33:42.664Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-02T21:33:42.804Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:33:42.804Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:33:45.412Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:33:45.412Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:33:46.728Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthPolicy","TokenRateLimitPolicy","Kuadrant"],"eventTypes":{"create":2,"update":1}}
{"level":"info","ts":"2026-11-02T21:33:46.878Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:33:46.893Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:33:49.272Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:33:49.656Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:33:49.859Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:33:49.860Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:33:49.860Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:33:52Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-api-b-bd96ef","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-b-bd96ef","reconcileID":"f6c8a595-2241-4dfd-89dd-7f8a29fdb721","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-api-b-bd96ef","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:33:52Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-b-bd96ef","event":"CREATE"}
{"level":"info","ts":"2026-11-02T21:33:52Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:33:52.949Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:33:52.957Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:33:52.959Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:33:52.959Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:33:52.963Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:33:52.964Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-11-02T21:33:53.050Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-api-b-54a4b2","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/ratelimit":"true"},"name":"kuadrant-ratelimiting-e2e-api-b-54a4b2","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-api-b-54a4b2","uid":"9f2564cf-89fd-4099-a8e8-89c5ce3b248a"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"limitador-limitador.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-ratelimit-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"limitador-limitador.kuadrant-system.svc.cluster.local","port_value":8081}}}}]}]},"name":"kuadrant-ratelimit-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-api-b-54a4b2"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-api-b-54a4b2\" already exists"}
{"level":"error","ts":"2026-11-02T21:33:53.050Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-api-b-54a4b2","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"kuadrant-auth-e2e-api-b-54a4b2","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-api-b-54a4b2","uid":"9f2564cf-89fd-4099-a8e8-89c5ce3b248a"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-auth-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local","port_value":50051}}}}]}]},"name":"kuadrant-auth-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-api-b-54a4b2"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-api-b-54a4b2\" already exists"}
{"level":"error","ts":"2026-11-02T21:33:53.068Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:33:53.068Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T21:33:53.075Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-b-54a4b2","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-b-54a4b2#rule-4"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"65e2f41e0492d235319025a9eee631c3136e990f62350e68194dae99d6abf9bb","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["65e2f41e0492d235319025a9eee631c3136e990f62350e68194dae99d6abf9bb"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-b-54a4b2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-b-54a4b2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"65e2f41e0492d235319025a9eee631c3136e990f62350e68194dae99d6abf9bb\" already exists"}
{"level":"error","ts":"2026-11-02T21:33:53.142Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-b-54a4b2","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-b-54a4b2#rule-3"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"7d2020bcb31505aed9ee28e7f3e3022b1d49395dd952574d8eafacc1a0d454a8","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["7d2020bcb31505aed9ee28e7f3e3022b1d49395dd952574d8eafacc1a0d454a8"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-b-54a4b2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-b-54a4b2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"7d2020bcb31505aed9ee28e7f3e3022b1d49395dd952574d8eafacc1a0d454a8\" already exists"}
{"level":"error","ts":"2026-11-02T21:33:53.227Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-b-54a4b2","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-b-54a4b2#rule-1"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"09c48f3bbf61b81b6866a2870046460c73cab2328d9906274a40af3d4cbf5ebf","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["09c48f3bbf61b81b6866a2870046460c73cab2328d9906274a40af3d4cbf5ebf"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-b-54a4b2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-b-54a4b2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"09c48f3bbf61b81b6866a2870046460c73cab2328d9906274a40af3d4cbf5ebf\" already exists"}
{"level":"error","ts":"2026-11-02T21:33:53.295Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-b-54a4b2","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-b-54a4b2#rule-6"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"87ed39693874a16861ddc73bd1bb9eda685d13b472210d75f0cca9747d27824b","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["87ed39693874a16861ddc73bd1bb9eda685d13b472210d75f0cca9747d27824b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-b-54a4b2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-b-54a4b2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"87ed39693874a16861ddc73bd1bb9eda685d13b472210d75f0cca9747d27824b\" already exists"}
{"level":"info","ts":"2026-11-02T21:33:53Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-02T21:33:53Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"error","ts":"2026-11-02T21:33:53.366Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-b-54a4b2","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-b-54a4b2#rule-5"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"4ab1fbe6391b1d89a8278686a76d16a41e95acbd110403f1ea225505889e8e81","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["4ab1fbe6391b1d89a8278686a76d16a41e95acbd110403f1ea225505889e8e81"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-b-54a4b2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-b-54a4b2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"4ab1fbe6391b1d89a8278686a76d16a41e95acbd110403f1ea225505889e8e81\" already exists"}
{"level":"info","ts":"2026-11-02T21:33:53Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:33:53Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-api-b-bd96ef","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-b-bd96ef","reconcileID":"e5c8b9db-fdbd-4445-833d-1315ca9a6ac2","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-api-b-bd96ef","namespace":"openshift-ingress"}
{"level":"error","ts":"2026-11-02T21:33:53.437Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-b-54a4b2","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-b-54a4b2#rule-2"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"a0e2a5a20b20758fb11fc6971890ab730da2be7e70d4d2b0565b932c28162203","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a0e2a5a20b20758fb11fc6971890ab730da2be7e70d4d2b0565b932c28162203"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-b-54a4b2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-b-54a4b2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"a0e2a5a20b20758fb11fc6971890ab730da2be7e70d4d2b0565b932c28162203\" already exists"}
{"level":"info","ts":"2026-11-02T21:33:53Z","logger":"telemetry-policy-extension-controller","msg":"Warning: Reconciler returned both a non-zero result and a non-nil error. The result will always be ignored if the error is non-nil and the non-nil error causes requeuing with exponential backoff. For more details, see: https://pkg.go.dev/sigs.k8s.io/controller-runtime/pkg/reconcile#Reconciler","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-api-b-bd96ef","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-b-bd96ef","reconcileID":"e5c8b9db-fdbd-4445-833d-1315ca9a6ac2"}
{"level":"error","ts":"2026-11-02T21:33:53Z","logger":"telemetry-policy-extension-controller","msg":"Reconciler error","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-api-b-bd96ef","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-b-bd96ef","reconcileID":"e5c8b9db-fdbd-4445-833d-1315ca9a6ac2","error":"Operation cannot be fulfilled on telemetrypolicies.extensions.kuadrant.io \"maas-telemetry-e2e-api-b-bd96ef\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:353\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-02T21:33:53Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-api-b-bd96ef","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-b-bd96ef","reconcileID":"23b253f9-658d-40c9-9626-3a9e6fdc8281","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-api-b-bd96ef","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:33:53Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-b-bd96ef","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T21:33:53Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-02T21:33:53.517Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-api-b-54a4b2","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"name":"kuadrant-e2e-api-b-54a4b2","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-api-b-54a4b2","uid":"9f2564cf-89fd-4099-a8e8-89c5ce3b248a"}]},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"87ed39693874a16861ddc73bd1bb9eda685d13b472210d75f0cca9747d27824b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-api-b-54a4b2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__047c6e65\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-api-b-54a4b2\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-api-b-54a4b2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__047c6e65\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-api-b-54a4b2\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-api-b-54a4b2\"]}],\"name\":\"a647cf558ee7a2c6a7743fe121fd94d5d6077cd49f00d43db9e869121ce89067\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a0e2a5a20b20758fb11fc6971890ab730da2be7e70d4d2b0565b932c28162203\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-api-b-54a4b2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__047c6e65\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-api-b-54a4b2\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-api-b-54a4b2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__047c6e65\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-api-b-54a4b2\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-api-b-54a4b2\"]}],\"name\":\"c2f707ab91405219ad17594db519b202e0961e94fa87c2bb6201a393186e2841\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4ab1fbe6391b1d89a8278686a76d16a41e95acbd110403f1ea225505889e8e81\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-api-b-54a4b2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__047c6e65\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-api-b-54a4b2\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-api-b-54a4b2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__047c6e65\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-api-b-54a4b2\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-api-b-54a4b2\"]}],\"name\":\"55e7be304b2d8e0a49bd73c8ee1afd3483f8146171055c923d0379e4f4d05eab\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7d2020bcb31505aed9ee28e7f3e3022b1d49395dd952574d8eafacc1a0d454a8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-api-b-54a4b2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__047c6e65\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-api-b-54a4b2\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-api-b-54a4b2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__047c6e65\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-api-b-54a4b2\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-api-b-54a4b2\"]}],\"name\":\"4758f6977b0a1a5778408516d01808009f8343a36f769b2659bf368bb38f3d83\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"65e2f41e0492d235319025a9eee631c3136e990f62350e68194dae99d6abf9bb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-api-b-54a4b2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__047c6e65\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-api-b-54a4b2\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-api-b-54a4b2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__047c6e65\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-api-b-54a4b2\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-api-b-54a4b2\"]}],\"name\":\"7db3c85054d7d5043b9a4e66058b0d80b2f7937454a7289b0daac3cd7fb3a086\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"09c48f3bbf61b81b6866a2870046460c73cab2328d9906274a40af3d4cbf5ebf\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-api-b-54a4b2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__047c6e65\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-api-b-54a4b2\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-api-b-54a4b2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__047c6e65\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-api-b-54a4b2\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-api-b-54a4b2\"]}],\"name\":\"b65262ba3433bd1690efba29f56b33dfdb763a7b420e0d6f55315d1bf9c1a1e1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-api-b-54a4b2"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-e2e-api-b-54a4b2\" already exists"}
{"level":"info","ts":"2026-11-02T21:33:53Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-02T21:33:53Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-02T21:33:53Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-02T21:33:53Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:33:53Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-b-bd96ef","event":"UNKNOWN"}
{"level":"info","ts":"2026-11-02T21:33:53Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-02T21:33:54.107Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-worker-w3-f51151","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T21:21:31Z","generation":10,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"8871137c-7f6a-401d-a6db-2983aea5ba22\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:33:08Z"}],"name":"kuadrant-e2e-worker-w3-f51151","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-worker-w3-f51151","uid":"8871137c-7f6a-401d-a6db-2983aea5ba22"}],"resourceVersion":"46079","uid":"c24c0550-6758-4dca-8d2b-3fe32740d122"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a05d7e315cc7cde173ab18a777672d3a18ce0a96f8f52d505404dcf8d1e51c20\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"0e7c31c41adb0d3f9efc929ae631573fe0c783a2fa7edb7a4b135081c2969bbf\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6c73e108ce3d5ef8ece11651aca73aa00bd88530b6aba861d23ca7b6ff89ba5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"aedbd7ef0308fd9494e9a3a1386b732923d5d060acf5a188601898d4867d320f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7b56d8e34a0de188e49dc0ae60057e421eb8bc4643546e49b2fe810120869498\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"b6389ab82133347e2514a4ad1cbd9d34042edc9a4ad044714155dbb2aecf38d4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a942d85d233c0e2e8932f598b5b8c9b97eda0ae826b5a80a742559b36fa56979\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"85e7f37f931469abe1b396a1a44b52a8b72e6a4dc98ed0ebdd61e43f0486de13\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a05d7e315cc7cde173ab18a777672d3a18ce0a96f8f52d505404dcf8d1e51c20\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"ec8a1b6bbf984a67cda63e2d923bfa9d2d66a7537f676f6198c12cbca9103517\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6c73e108ce3d5ef8ece11651aca73aa00bd88530b6aba861d23ca7b6ff89ba5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"5c9b9ac2bc33c747eb54045ee2511e3c8b2ee9737a3f347afb75903f43d74fb7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7b56d8e34a0de188e49dc0ae60057e421eb8bc4643546e49b2fe810120869498\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"f82b9432930517e02d229f4fdbdd8b6700b061d5d333fe35b064a3bb85f58e76\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a942d85d233c0e2e8932f598b5b8c9b97eda0ae826b5a80a742559b36fa56979\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"6d321a24ed09abad642dee549f0c7cbf98ce40481beb85ca79bd3d4eeb89b77e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a05d7e315cc7cde173ab18a777672d3a18ce0a96f8f52d505404dcf8d1e51c20\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"a54bd689e670e5f8bbee0a66c2585a4d4adce9a5a7fc297449ee3b816a0c2695\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6c73e108ce3d5ef8ece11651aca73aa00bd88530b6aba861d23ca7b6ff89ba5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"ad845c31a125851bf4cc5ae7e83bb4a011cf98484d99780ab16df250ca9dd41c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7b56d8e34a0de188e49dc0ae60057e421eb8bc4643546e49b2fe810120869498\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"9eefe22cd9d7f4d324cc07e6422d998261fea96e9069bc938fe66a94e8c8cadb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a942d85d233c0e2e8932f598b5b8c9b97eda0ae826b5a80a742559b36fa56979\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"b00ec38cf5be980b160374be347b182afaa16e0dc99314a5e990f20cef6d57ed\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a05d7e315cc7cde173ab18a777672d3a18ce0a96f8f52d505404dcf8d1e51c20\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"6d5d9aca320022f0f8b70c3f9b34b5922adf537f5da717ec79924566febf6df1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6c73e108ce3d5ef8ece11651aca73aa00bd88530b6aba861d23ca7b6ff89ba5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"346e75cab49a1cf8ae89d90cfb32099256f44d7909e40cdc730e951946a411e2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7b56d8e34a0de188e49dc0ae60057e421eb8bc4643546e49b2fe810120869498\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"ae0a4172fa23a6e8857123675126f34bcaf4e08f94c05663e2913801fda46401\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a942d85d233c0e2e8932f598b5b8c9b97eda0ae826b5a80a742559b36fa56979\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"ee0931c3dc206732c58bab1add9bf2cb602a2eb21bfa9272c2df596197dceb3e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a05d7e315cc7cde173ab18a777672d3a18ce0a96f8f52d505404dcf8d1e51c20\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"3f6b6643d5731a355a44968b83b24169ff3e0c1b36737d8be7f9d42e1def7c3e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6c73e108ce3d5ef8ece11651aca73aa00bd88530b6aba861d23ca7b6ff89ba5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"cd8ab5f89e71494c8d176f9668b8ed279bd244e6f70d1a5c87603877b4b7182d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7b56d8e34a0de188e49dc0ae60057e421eb8bc4643546e49b2fe810120869498\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"09df06c068a0d1324c44679ca0c022e74cd18bae1497d0087fb2184f9401d63b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a942d85d233c0e2e8932f598b5b8c9b97eda0ae826b5a80a742559b36fa56979\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"821121f5584e938a01b323996203984576204f894f2c9f09f5ececcdc058373e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a05d7e315cc7cde173ab18a777672d3a18ce0a96f8f52d505404dcf8d1e51c20\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"e00f3dfbbce60a718137b415a42cbf1e65a7b226437cc4600d9fa76b264e3b4d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a05d7e315cc7cde173ab18a777672d3a18ce0a96f8f52d505404dcf8d1e51c20\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"7ddf0d6bdcfc6aa206cdc0919b1d5b7545c903aafbb0e16d393016b1a83bd29a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6c73e108ce3d5ef8ece11651aca73aa00bd88530b6aba861d23ca7b6ff89ba5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"fe3b37fdd5d3f9d3bdf7d03b186d964b283bfbe7d3ffa720457517666c3070a2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6c73e108ce3d5ef8ece11651aca73aa00bd88530b6aba861d23ca7b6ff89ba5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"7dd9491b4755b4900c5bc55b4dd9aff38f99899f0236e4d21bf7c94e5769cbb1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7b56d8e34a0de188e49dc0ae60057e421eb8bc4643546e49b2fe810120869498\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"fa5430186b33e56d19e4d2e0209b4f2215d17b488745cd8061eb5ecaf96ecafa\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7b56d8e34a0de188e49dc0ae60057e421eb8bc4643546e49b2fe810120869498\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"cd88af3d71345ad9b32dfae02550fa9bf6aa0cddfac2d0464a60cd90b9898d74\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a942d85d233c0e2e8932f598b5b8c9b97eda0ae826b5a80a742559b36fa56979\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"2182ac070ac99ffbeb246624e36aa202ce8c626bd38aaa3191f5e60a408bc782\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a942d85d233c0e2e8932f598b5b8c9b97eda0ae826b5a80a742559b36fa56979\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"97e41dd7c810563f2cac2a1c963d220c840d6b756c6c76b0cf97113387aab38b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a05d7e315cc7cde173ab18a777672d3a18ce0a96f8f52d505404dcf8d1e51c20\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"a00edc25239da061cd0457625d6046ede5f9d09507c78c2209e1e992795831c9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6c73e108ce3d5ef8ece11651aca73aa00bd88530b6aba861d23ca7b6ff89ba5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"fbd557cfa232fb43236e5864400cd1522fbf21d014450df4a714ea2d3608e863\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7b56d8e34a0de188e49dc0ae60057e421eb8bc4643546e49b2fe810120869498\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"f809ccd15563984c9befad8f50ee38613b9c34eda0af01f561e75be88cba33ab\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a942d85d233c0e2e8932f598b5b8c9b97eda0ae826b5a80a742559b36fa56979\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"749b6bc66485455bb3cc5a0d552c38935bb446a6be85e306d894e6cbb4d92c08\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b31ddb7ef02e35e9d172430b50a004a3047564232880010bd3e581bf0dc547f8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"a1ec0f0592798b3996117a17734b0936906621077ceec69c81d8fb77e89a142a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"75a5abd89bb4e6258c7f7c7be472e6131799539dbbb87686c1010afe2791e45e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"3ca8a6339da3e4298e514bea168ac30f6c718d158fa0efc5e0fd85f06754a528\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"72bb4e3923485ca35015ee8655bc43ee332eea77f2cd8effbd48b21828f89f80\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"879fe62fbbe8b0a130140cda7f546611c758fb8fa416f173d2b0cf3da17d7941\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ed162da516e04d5229dc1d49e1c785e9db374ba4ba028ecabbdccdcb33acd1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"b43372d2a0820427086903362809a4a0c757cd1d6f593ba48a755e5fb972575d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f9603ac54a5668b179c6ba3dcda3951e57253a5ad5ad80214b563f50337f3a9c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"7caf859dfb9739029a8c1b13adba06164610495beddbda8e01fd7b432b15f4c3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"775fdec32977b769224a6d9530e33a1b93a2948f54e3f459e979da99f7def4ea\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"5cebae68b5e59e34a98c9c038f83d877f079732894ec3403d349e0b7ae0c9099\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6ab1b21b6f75f2c1ef86f9bcf36a6c25244e88430832e3ac86a839cf10bb8dcd\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"15ecb8224cf6049c2e831c815cc4f0aed954432b967d01d55ea637294f3ea87e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8b2fbdc0f4b402fd19fb549b70da796c6867a52206fa0420df2d6debc0db70b7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"7cb303fae9824d31834d539772c1840fd2991481566b7d07635c9284c524ae4d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a649343311197c716e0b6f502bb8ad21ecf4e207e16ffc6e0b74b1dc4f05f7fb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"699e8723136e653d04a8800a9289a3543f733ebfd0f99efbedfd18d22de4c281\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a6267fc785126adca5b68df13f95ef1fa08e1d72b66fbff01b54f8d61edaf7ba\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"9a72bfcef40a8da2865b02b6123c023d9f4f17c11a2ff674e3ed24af23e468e2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a6d41f4e9f57ec1e6bb4423e49991033d85f00a2a3303e02b25d1eedb67be3c9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"ad4137b1e753fd100088742941c8aaee9eaddc158bbaf221eb0d7318bdb8dfb5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6610d72af8a18be17c09082b4389a248d739315be17e0e146375e82e8d76261d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"66a5afc61110ab52ae4b9c9d79944467f91c4a2bd7b954ed8f59e651c215c630\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aea6441051c6a7490e44d5f7bab0e4bf7cf461c9597675611789e8d9141a446c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"c871ffab27f7ed925d56fae005e70fd3716aab799f0484d7d44519e915491d11\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"be7879d2a6daa00da89abfe5895a77787208f1af5b8582c79c8dd2849ef7906c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"461ea56b8a105dbd1d386b531c80b5a86960df99b24b6f6668520921b280a609\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7f4456bc894bf7ab59ba02c25915a8db007a89ffdd1efcace437a7761c68b3f9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"aedfea0f1dceed2b1af07ebf6e7dbc55cdc958ea5a084291f6216a19f63eae8a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f23dfebb92a3f3d59997030cce08899533ec20be47590cd866dd896392db04de\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"f42d6cbc7a49b6c1c4f0668dc536500321a8f658d1ab1a3a8b2ad8c0a95b272c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c57cda59d33d438c637a64dce8619a9616880a275363557ccc83d2cbc4920e14\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"1a3df8e6f6ad36c3eb928970ca2e746005e16b25405fc6eb9f44977b07d56905\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"086314a2fc965880bf769a18d3353909b6a1e5544e7eb514174994ba24387652\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"8e63847006a8d1952318fe3b6d2707027991d1c00d7959d051b3baf72690aecf\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f1def6d908410a124665ecd632ae01e5ba977920643dab1a35d25277292bae55\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"1199947fd30f0d1dab3db5846b8d27e36b6284be94834b798e4004120ec52532\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"676709317386301aa762cc48b7aa0064bc03adc00abbddfda8d0294046751d34\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"8a51327014eb82d6df6700b3f79ae6010cc76b2ee750f56ac5cb49c5b6f975ed\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d8557b9861d48e5714a954e0a885ecc7e55e6b9f034fc9f24f4c5c2f6dafce5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"91c8ce1078dc4a26a7cb0af054981aa28b4768dcd87a9a167f98e9b4e4b60325\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d63de28626482cf5fa2aaf12cb9aa3def86d637d4c98f193819331c36fa73b21\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"fae01409c891b630fc644ebf1b8bc640438a1fc79de2b0750d34e2a6388d4ca6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f86615df74e8d3814df8817b06dc7578a4b0af0817397c5bdddb1daaaeb1df4e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"2d972852e655bb76327ea47e134854d589cf64538813171d00544a81dc138f4f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ca57331ce8d0c8497c210605ffe8878f757d572164898f4f870b89fcf2f9f1ed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"1ef135f8dcdcaa663d4184fa6364518f7001a744380301035f254e16acdad0b7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"06c1a51758821d18e14577dc995b939fe472579672223b3bf0c1a312b23f23c4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"a90d5652afa4bbc65c24ada88ebb0df97a9c759ab0004d0c85d28f7e4c012bb9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/premium-w3-f51151/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"acbe19c11dc0fe08b370bbe647de6ecce77849e75c774c3e46f4a7af09e2861f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"b1fa0497afe070203ab9c23aef75e896659b83c8305ca7a56664d1717528e732\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7b5f8cd8dfbddc7109fd206805e23a6ae21c18bf406c0001927759ff1a39122f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"64238089f4803f45c8353b0d5d05ac6a23d6a3647106591fdc2bd5299c0b0759\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fd143bc18213c3c4682bcced572bcf84c1cbc8cd87ea188e96c990f164fd5ade\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"3ede2f522e381a5e5b8affa5afed6ede7d3894cf263c247dca9b3f3f3ad4a676\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cf25727b6a9419d97ed5dc9613d3b6a26e590c05f01b5c4038461accc96bc026\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"fb213d7be796970427643a4a818af11356ba854b3a0477e3c48bc2ef3332c7d5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cb9167704c77a112808785ad099bc015c57786c61e7befec251b029ce378a0c6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"ef8b5b3a53f3de47fd70ccb56be2422e84d7fb1f10a03b64c032baca50a33c79\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9a4beabc5e6770b1db0aae064836730685e70fcacd601193f69aafe8156d41a4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"667e44e20cda74056b10928af7322c52f17d044dda1b5aded34df466201c3e4d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/premium-w3-f51151/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fdd358955bc325dacf4ae3d584d9dfaa236b2605d42014543bcddb868221d0fa\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"0a4335c7c536062bc1f3c4f55fad89ef387858062864c877a3014c384192a4f5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"91d11ef27666b7f1f85063266e00a4add2242586a1e8a4bac5447b3f4ec7925d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"26827917812d006281f7f7ba6e53d3573012708364624693432b2cbdd0f434b5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"79bf752ac34000e70b4860b3a87054e1aab2babf35019e7e24d203c82f5f1c70\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"e8683890d73b71f6556b533ec6f92b30804817a025abb3d3c716a89f9b3f85d9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"707f7a9a5bb373d466ca8ba9e6220842edd61bdf74768cdb8760aca4648a21b3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"b90f395e8ebaa67a3ab9ee2a967d88bbf981033415dedacddf2e76a8347bfd39\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/premium-w3-f51151/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a40304ff6b4a0f6c57da3d4a6bcc549a18c94ce2ed3356df2ce4c4621e7d5231\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"ff65bd9a43408c55f0593fcb41763d9030c7823704d875b6050eb2c39b500d75\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ab3c6da9622dba177dfaf10df58f987a09c5bd12e35f73cca3f03ce632140cd4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"9ec2510ba7c20be712eae31e88eb54985eedbb6ce61783804c05db0582107bc2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/premium-w3-f51151/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5d4b7dc290bd7cb2c0c574a9869b31b45107252e6aaf512691b5c665967d6821\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"f6fff5f3b2673f2810cddb2b65518e70b74aad58e6c27ef1faf828a9cdef8c14\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d896bcdf40d08e0bef242ce04aa58467e96c672450af890adda6941c53a574d3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"69bd1c4b3e1b36f5d5d62283b221b7026a4e53da339ac7c470f75cb4334435f6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"16bf1b94bcdc2b222ee7ef5dfdb45298f40e57fcf65f862a63a7b2d64b143143\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"ec2b739c69e9a51aedc6a2ee8ed6e7bbcb37f4eff66695b2c6d1bf4950a2ecb3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3fdafb69d9c72b7e3c78e50b30f01adec907957097c6a1e811ceff68d93d7c23\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"a31568314e38d20d12f5921c57463100edd3022d5f9f3c0b36033d9a4dee9193\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e11ba50523ae86c5c06c5b76176154ed9ba57c3ed13fa43133b1ac7249ce345f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"67192e2ead59827b5990f7b4cbc2aece4271402ddcdfaa76f7cf95d2d4552c43\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b6344fa6f672d55d2eb4fbf6449de24a41dbf664f8e9d3c01ecde50e9d46e233\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"3c429336b45d9712bfdb0d99ecd41baa0dde1570067b941b5927e1894931c254\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d1f3365185f5fcfe92899c5f49af1b579baab97128b8afee3eed4350859c3f14\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"2f17c508c987cffd0b45ebd164fcee3ad66819a39900f83fbeda518ccf619183\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"85124e62247f9234752fedfc382ba93d6f839dab53f49c16951446afa3e613aa\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"6d2c4320e5eae8e51596e1c62f1c7494e1c5f9cd5d374e73b3ddae65dd071a92\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"461f0fb3ed9e91195eaa488b65b6f04cb4bff62087edbcf0d4c2186d180ba0ab\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"994b30d96390325263d89c2da7554eadd9d4fd1811371afabaf057df68e19205\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d13670b5b1696edcb191c925fa86dd729eeb7447f2230e160d9cc03e0117604d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"f70585dfa8966b9748a8978bfdf51d589a9d85f553359b47bfa09ad8bb266b02\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"18b02d50add3a7c29ec6127eedab648f22d172b48224a97365a7798a612dcd01\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"1e0c9c02fbbf3d69df4286ba8224f5543dfc90c1df5aa687b5b6f1c00dce4d56\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3f0daf8882dbe2b0594c2bb310f151a319cec601c5028d24f0d4557684bfb5f1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"4d8ba792ec63f5d46b5589f993126734f136e3569a1b7639aaea8768dc2c0f57\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a8ad3ccfafcc25ea959dd98788332d9514ad2d762423f3039adff91a3381329f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"b159e4d34dc2a1f6fe05bc0d616c2ebb2d3306defc93bfb6d4035e2f842e1b91\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-worker-w3-f51151"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-worker-w3-f51151\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:33:54.371Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w3-f51151","namespace":"e2e-models-e2e-worker-w3-f51151","uid":"e3340067-224a-43ad-8020-ca9e00ead152","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w3-f51151\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:33:54Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-02T21:33:54Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-02T21:33:54Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-02T21:33:54Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"error","ts":"2026-11-02T21:33:54.536Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-api-b-54a4b2-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-api-b-54a4b2-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:33:54.605Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"maas-gateway-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"maas-gateway-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:33:55.204Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-api-b-54a4b2","namespace":"openshift-ingress","uid":"fcd97d0d-de3f-43a8-a3a6-7c7840000a42","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-api-b-54a4b2\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:33:55.564Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:33:55.564Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T21:33:55.823Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-api-b-54a4b2","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-api-b-54a4b2\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:33:55.881Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-api-b-bd96ef","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-api-b-bd96ef\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:33:55.965Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"maas-api-route-e2e-api-b-54a4b2","namespace":"odh-ai-gateway-infra","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"maas-api-route-e2e-api-b-54a4b2\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:34:03.377Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["EnvoyFilter","Limitador","Gateway","AuthConfig","ConfigMap","TokenRateLimitPolicy","HTTPRoute","AuthPolicy","Kuadrant"],"eventTypes":{"create":12,"update":11}}
{"level":"info","ts":"2026-11-02T21:34:03.679Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:34:03.699Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:34:06.655Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:34:06.735Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:34:06.735Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:34:06.831Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:34:06.831Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:34:09.475Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:34:09.475Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:34:09.485Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:34:09.486Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:34:09.527Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:34:09.527Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:34:09.766Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:34:18.837Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:34:18.837Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:34:26.245Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","EnvoyFilter","TokenRateLimitPolicy","AuthPolicy","Gateway","Limitador","HTTPRoute","ConfigMap"],"eventTypes":{"create":9,"update":111}}
{"level":"info","ts":"2026-11-02T21:34:26.486Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:34:28.651Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:34:28.837Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:34:28.837Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:34:31.940Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:34:31.949Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:34:31.955Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-02T21:34:31.955Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:34:31.966Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:34:31.966Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:34:32.023Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:34:33Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-api-a-682116","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-a-682116","reconcileID":"d32b73f5-a1cf-4060-95bc-286586929633","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-api-a-682116","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:34:33Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-a-682116","event":"CREATE"}
{"level":"info","ts":"2026-11-02T21:34:33Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:34:33Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-02T21:34:33Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-02T21:34:33Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:34:33Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-api-a-682116","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-a-682116","reconcileID":"37cffa9d-8145-4e88-a0cb-25b9ba4715cd","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-api-a-682116","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:34:33Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-a-682116","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T21:34:33Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:34:34Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-02T21:34:34Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-02T21:34:34Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-02T21:34:34Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:34:34.676Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:34:34.676Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T21:34:35.548Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-api-a-682116","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-api-a-682116\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:34:45.617Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","ConfigMap","Limitador","Gateway","AuthPolicy","Kuadrant","HTTPRoute"],"eventTypes":{"create":3,"update":24}}
{"level":"info","ts":"2026-11-02T21:34:45.784Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:34:45.824Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:34:48.264Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:34:48.447Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:34:48.448Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:34:48.538Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:34:48.661Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:34:51.943Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:34:51.945Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:34:51.953Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:34:51.959Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:34:51.963Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:34:51.963Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:34:52.110Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T21:34:55.192Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-api-b-bd96ef-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-api-b-bd96ef-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:34:55.320Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-e2e-lifecycle-model-70efbbab","namespace":"ai-tenant-e2e-mt-70efbbab","uid":"05615236-a5a1-4039-84b9-41a252f2166a","error":"tokenratelimitpolicies.kuadrant.io \"maas-trlp-e2e-lifecycle-model-70efbbab\" not found"}
{"level":"info","ts":"2026-11-02T21:34:56.327Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:34:56.327Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:34:57.655Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthPolicy"],"eventTypes":{"update":2}}
{"level":"info","ts":"2026-11-02T21:35:02.501Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:35:02.530Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:35:02.530Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-02T21:35:02.584Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-api-a-682116","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"kuadrant-auth-e2e-api-a-682116","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-api-a-682116","uid":"22c363a3-4349-4e3f-b42a-be9b56d34fba"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-auth-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local","port_value":50051}}}}]}]},"name":"kuadrant-auth-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-api-a-682116"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-api-a-682116\" already exists"}
{"level":"error","ts":"2026-11-02T21:35:02.644Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-b-54a4b2","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-b-54a4b2#rule-3"},"creationTimestamp":"2026-11-02T21:33:42Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:33:42Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:33:43Z"}],"name":"7d2020bcb31505aed9ee28e7f3e3022b1d49395dd952574d8eafacc1a0d454a8","namespace":"kuadrant-system","resourceVersion":"47057","uid":"751ec661-b248-463e-8d8c-a83f233e79ec"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["7d2020bcb31505aed9ee28e7f3e3022b1d49395dd952574d8eafacc1a0d454a8"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-b-54a4b2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-b-54a4b2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:33:43Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:33:43Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["7d2020bcb31505aed9ee28e7f3e3022b1d49395dd952574d8eafacc1a0d454a8"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"7d2020bcb31505aed9ee28e7f3e3022b1d49395dd952574d8eafacc1a0d454a8\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:35:02.735Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-b-54a4b2","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-b-54a4b2#rule-1"},"creationTimestamp":"2026-11-02T21:33:43Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:33:43Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:33:43Z"}],"name":"09c48f3bbf61b81b6866a2870046460c73cab2328d9906274a40af3d4cbf5ebf","namespace":"kuadrant-system","resourceVersion":"47061","uid":"6ecd232c-cf3b-4643-ae22-bbac24140068"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["09c48f3bbf61b81b6866a2870046460c73cab2328d9906274a40af3d4cbf5ebf"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-b-54a4b2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-b-54a4b2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:33:43Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:33:43Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["09c48f3bbf61b81b6866a2870046460c73cab2328d9906274a40af3d4cbf5ebf"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"09c48f3bbf61b81b6866a2870046460c73cab2328d9906274a40af3d4cbf5ebf\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:35:02.823Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-a-682116","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-a-682116#rule-4"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"a12b83f55f68240e0a93f521386189139f7501b4fc78d20957e81d8280efc0fb","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a12b83f55f68240e0a93f521386189139f7501b4fc78d20957e81d8280efc0fb"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-682116.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-682116.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"a12b83f55f68240e0a93f521386189139f7501b4fc78d20957e81d8280efc0fb\" already exists"}
{"level":"error","ts":"2026-11-02T21:35:02.885Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-mt-70efbbab","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-mt-70efbbab#rule-4"},"creationTimestamp":"2026-11-02T21:31:07Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:33:08Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:33:08Z"}],"name":"51d36c7f5f5d3ce8ca874f6f293be93ec6a5b3c79a267dd55f8e4240e4bb0e5c","namespace":"kuadrant-system","resourceVersion":"46058","uid":"45c3dd68-3c0b-4084-a4a6-16c278b889d1"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["51d36c7f5f5d3ce8ca874f6f293be93ec6a5b3c79a267dd55f8e4240e4bb0e5c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-70efbbab.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-70efbbab.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:33:08Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:33:08Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["51d36c7f5f5d3ce8ca874f6f293be93ec6a5b3c79a267dd55f8e4240e4bb0e5c"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"51d36c7f5f5d3ce8ca874f6f293be93ec6a5b3c79a267dd55f8e4240e4bb0e5c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:35:02.949Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-02T21:32:02Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:33:08Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:33:08Z"}],"name":"7dd93d350f32a149c45b09c240b7a22e2323c5563700b192f69d6c453081048e","namespace":"kuadrant-system","resourceVersion":"46052","uid":"6aca3b8c-3f10-4c88-a838-2490a30749f6"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["7dd93d350f32a149c45b09c240b7a22e2323c5563700b192f69d6c453081048e"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-70efbbab.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-70efbbab.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:32:02Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:32:02Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["7dd93d350f32a149c45b09c240b7a22e2323c5563700b192f69d6c453081048e"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"7dd93d350f32a149c45b09c240b7a22e2323c5563700b192f69d6c453081048e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:35:03.012Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-02T21:32:00Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:33:09Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:33:09Z"}],"name":"f8da20627f0169e69426fd609be7867dca7c3ecdf4acafec00912ff7791bd2d6","namespace":"kuadrant-system","resourceVersion":"46129","uid":"9c3c9069-a075-4a73-ad9c-c3cfdf1680ae"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f8da20627f0169e69426fd609be7867dca7c3ecdf4acafec00912ff7791bd2d6"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-70efbbab.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-70efbbab.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:32:00Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:32:00Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["f8da20627f0169e69426fd609be7867dca7c3ecdf4acafec00912ff7791bd2d6"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"f8da20627f0169e69426fd609be7867dca7c3ecdf4acafec00912ff7791bd2d6\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:35:03.081Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-a-682116","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-a-682116#rule-3"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"0cf37756964dc9b18bb0db7f6da9769e4de3c0cc72414f0c2f85d93e4d2a7438","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["0cf37756964dc9b18bb0db7f6da9769e4de3c0cc72414f0c2f85d93e4d2a7438"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-682116.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-682116.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"0cf37756964dc9b18bb0db7f6da9769e4de3c0cc72414f0c2f85d93e4d2a7438\" already exists"}
{"level":"error","ts":"2026-11-02T21:35:03.145Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-02T21:32:01Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:33:09Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:33:09Z"}],"name":"9ea783f2033457fc0f2f52f4f6f7a87dacb7918d14fd2c49d89468a40d5ce2f5","namespace":"kuadrant-system","resourceVersion":"46109","uid":"4e2228c2-10fb-43cd-b324-304c93e56486"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["9ea783f2033457fc0f2f52f4f6f7a87dacb7918d14fd2c49d89468a40d5ce2f5"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-70efbbab.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-70efbbab.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:32:02Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:32:02Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["9ea783f2033457fc0f2f52f4f6f7a87dacb7918d14fd2c49d89468a40d5ce2f5"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"9ea783f2033457fc0f2f52f4f6f7a87dacb7918d14fd2c49d89468a40d5ce2f5\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:35:03.217Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-02T21:32:01Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:33:08Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:33:08Z"}],"name":"cd0342f6c3ef93f58d95e760fb8ed9fa936a0168aa423e2db15cd0f43b6a534f","namespace":"kuadrant-system","resourceVersion":"46046","uid":"9faefc73-963a-40df-b56a-396435931c25"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["cd0342f6c3ef93f58d95e760fb8ed9fa936a0168aa423e2db15cd0f43b6a534f"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-70efbbab.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-70efbbab.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:32:01Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:32:01Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["cd0342f6c3ef93f58d95e760fb8ed9fa936a0168aa423e2db15cd0f43b6a534f"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"cd0342f6c3ef93f58d95e760fb8ed9fa936a0168aa423e2db15cd0f43b6a534f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:35:03.285Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-a-682116","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-a-682116#rule-5"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"db50e23b7ab70237a8c459ccedfef510b8bf5836fa2ab59b3796864e9aa5e2cf","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["db50e23b7ab70237a8c459ccedfef510b8bf5836fa2ab59b3796864e9aa5e2cf"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-682116.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-682116.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"db50e23b7ab70237a8c459ccedfef510b8bf5836fa2ab59b3796864e9aa5e2cf\" already exists"}
{"level":"error","ts":"2026-11-02T21:35:03.347Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-a-d58d18","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-a-d58d18#rule-1"},"creationTimestamp":"2026-11-02T21:32:01Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:32:42Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:32:42Z"}],"name":"7d0bb611039e8ebca8af5954d0b9e7821364096893f65af03c311314d484e757","namespace":"kuadrant-system","resourceVersion":"45308","uid":"d5a62dda-791e-48a8-92eb-5f2419a4d995"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["7d0bb611039e8ebca8af5954d0b9e7821364096893f65af03c311314d484e757"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-d58d18.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-d58d18.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:32:02Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:32:02Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["7d0bb611039e8ebca8af5954d0b9e7821364096893f65af03c311314d484e757"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"7d0bb611039e8ebca8af5954d0b9e7821364096893f65af03c311314d484e757\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:35:03.412Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-mt-70efbbab","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-mt-70efbbab#rule-1"},"creationTimestamp":"2026-11-02T21:31:08Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:33:09Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:33:09Z"}],"name":"81610c6024322aa440cb76b35caf0e21d85e94dd73885d1aff7f8f6ba84a448b","namespace":"kuadrant-system","resourceVersion":"46135","uid":"5d844e40-1a03-4a3e-ab8a-e0e1397ef010"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["81610c6024322aa440cb76b35caf0e21d85e94dd73885d1aff7f8f6ba84a448b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-70efbbab.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-70efbbab.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:31:09Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:31:09Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["81610c6024322aa440cb76b35caf0e21d85e94dd73885d1aff7f8f6ba84a448b"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"81610c6024322aa440cb76b35caf0e21d85e94dd73885d1aff7f8f6ba84a448b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:35:03.476Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-02T21:32:01Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:33:08Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:33:09Z"}],"name":"686f86f63369549dfd81bff146f9663d1dd02886636e63f1ff5322994f99d220","namespace":"kuadrant-system","resourceVersion":"46089","uid":"06bea647-094b-40a9-8c3e-9588c774fd0a"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["686f86f63369549dfd81bff146f9663d1dd02886636e63f1ff5322994f99d220"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-70efbbab.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-70efbbab.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:33:09Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:33:09Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["686f86f63369549dfd81bff146f9663d1dd02886636e63f1ff5322994f99d220"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"686f86f63369549dfd81bff146f9663d1dd02886636e63f1ff5322994f99d220\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:35:03.510Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-api-a-682116","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"name":"kuadrant-e2e-api-a-682116","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-api-a-682116","uid":"22c363a3-4349-4e3f-b42a-be9b56d34fba"}]},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"16cd5f900135f37e691702577f23320ffda92658e1586c995028efcab5106bb9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-api-a-682116-maas-auth\"]}],\"name\":\"1d7c42edab0d564952666309116165f8fda736a2c5402498ee6007a02a6200f7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fdaba319a690936532fab62c3ebd16d3636d771c61603bf0d7a61cd58539e9de\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-api-a-682116-maas-auth\"]}],\"name\":\"b59fd8e439b814a2927fe8b6c3608ccdfa8e3f77b57b58f9d07dfe32f70a44ee\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"db50e23b7ab70237a8c459ccedfef510b8bf5836fa2ab59b3796864e9aa5e2cf\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-api-a-682116-maas-auth\"]}],\"name\":\"00aa55fd6fa2e78023c334fb3dbfb56be34dfab42d13f02ba2dcde88f5409286\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0cf37756964dc9b18bb0db7f6da9769e4de3c0cc72414f0c2f85d93e4d2a7438\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-api-a-682116-maas-auth\"]}],\"name\":\"112308dd5fc8ef74f4585193fce8705c90eb3365032789f0c5e2c91f09c1c503\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a12b83f55f68240e0a93f521386189139f7501b4fc78d20957e81d8280efc0fb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-api-a-682116-maas-auth\"]}],\"name\":\"b4a54b1f9f447633fa0feb20c2df9875852fa27e43e6f61b3952e964c58c5020\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f3d9da241fa5737556fbbd5d3c4359c0d189af14f25f7374e71efb158db203bf\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-api-a-682116-maas-auth\"]}],\"name\":\"a46cec6b337c8cdceeee4d4753698c78bf4ff9f84c3c47e3f3ddeae986b41f37\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-api-a-682116"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-e2e-api-a-682116\" already exists"}
{"level":"error","ts":"2026-11-02T21:35:03.541Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-02T21:32:00Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:33:08Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:33:08Z"}],"name":"7adf1ca91bf336959a508540d878f5239ea90c05e08e3636aeaa69a6226a3003","namespace":"kuadrant-system","resourceVersion":"46075","uid":"7d6e9b2f-3f67-4cbf-9607-7c8bdb885091"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["7adf1ca91bf336959a508540d878f5239ea90c05e08e3636aeaa69a6226a3003"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-70efbbab.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-70efbbab.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:32:01Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:32:01Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["7adf1ca91bf336959a508540d878f5239ea90c05e08e3636aeaa69a6226a3003"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"7adf1ca91bf336959a508540d878f5239ea90c05e08e3636aeaa69a6226a3003\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:35:03.604Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-mt-70efbbab","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-mt-70efbbab#rule-6"},"creationTimestamp":"2026-11-02T21:31:08Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:33:09Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:33:10Z"}],"name":"0a626bd77283731109bdf44eb675ae0af0d6ae927fd1d71365c621209aa60038","namespace":"kuadrant-system","resourceVersion":"46146","uid":"b57ab4e5-bcba-43eb-9318-73bff1af088c"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["0a626bd77283731109bdf44eb675ae0af0d6ae927fd1d71365c621209aa60038"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-70efbbab.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-70efbbab.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:31:08Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:31:08Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["0a626bd77283731109bdf44eb675ae0af0d6ae927fd1d71365c621209aa60038"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"0a626bd77283731109bdf44eb675ae0af0d6ae927fd1d71365c621209aa60038\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:35:03.667Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-mt-70efbbab","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-mt-70efbbab#rule-5"},"creationTimestamp":"2026-11-02T21:31:08Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:33:08Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:33:08Z"}],"name":"6f155f9c22fd9155424959d77e15b09e2e46420c024c9208fdcbaaf5989ef3ab","namespace":"kuadrant-system","resourceVersion":"46064","uid":"63c4ca1b-fc84-4172-9ede-5f985932eefb"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["6f155f9c22fd9155424959d77e15b09e2e46420c024c9208fdcbaaf5989ef3ab"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-70efbbab.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-70efbbab.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:33:08Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:33:08Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["6f155f9c22fd9155424959d77e15b09e2e46420c024c9208fdcbaaf5989ef3ab"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"6f155f9c22fd9155424959d77e15b09e2e46420c024c9208fdcbaaf5989ef3ab\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:35:03.729Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-02T21:32:01Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:33:09Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:33:09Z"}],"name":"8963f302f71d40b22b463a6588998e3c87fec7d53908554dfc99bbb66749350f","namespace":"kuadrant-system","resourceVersion":"46114","uid":"26f11efa-49cc-4064-80cc-a623970111b4"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["8963f302f71d40b22b463a6588998e3c87fec7d53908554dfc99bbb66749350f"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-70efbbab.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-70efbbab.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:32:01Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:32:01Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["8963f302f71d40b22b463a6588998e3c87fec7d53908554dfc99bbb66749350f"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"8963f302f71d40b22b463a6588998e3c87fec7d53908554dfc99bbb66749350f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:35:03.792Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-02T21:32:01Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:33:07Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:33:08Z"}],"name":"86769b4cd589416a0961b23aa701cac08477d8ee25523565ff53094b12f68d12","namespace":"kuadrant-system","resourceVersion":"46042","uid":"9ad5040f-95eb-41c2-ae80-1d133357c397"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["86769b4cd589416a0961b23aa701cac08477d8ee25523565ff53094b12f68d12"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-70efbbab.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-70efbbab.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:32:01Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:32:01Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["86769b4cd589416a0961b23aa701cac08477d8ee25523565ff53094b12f68d12"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"86769b4cd589416a0961b23aa701cac08477d8ee25523565ff53094b12f68d12\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:35:03.855Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-02T21:32:01Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:33:08Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:33:09Z"}],"name":"7423a2f76c00c27e0a8383b9e315e7f7063dd5642156172f597daf18b46fde33","namespace":"kuadrant-system","resourceVersion":"46123","uid":"d0bcbf18-fde4-439d-b9b4-1b3dc150295a"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["7423a2f76c00c27e0a8383b9e315e7f7063dd5642156172f597daf18b46fde33"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-70efbbab.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-70efbbab.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:33:09Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:33:09Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["7423a2f76c00c27e0a8383b9e315e7f7063dd5642156172f597daf18b46fde33"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"7423a2f76c00c27e0a8383b9e315e7f7063dd5642156172f597daf18b46fde33\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:35:03.917Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-mt-70efbbab","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-mt-70efbbab#rule-2"},"creationTimestamp":"2026-11-02T21:31:08Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:33:08Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:33:08Z"}],"name":"fd62a73690c4cdd37a87d21a98021e6dfaac4eaa6e8bb6637dd1d0128e2c74ec","namespace":"kuadrant-system","resourceVersion":"46049","uid":"b4fe3bf2-be77-42b9-8511-f0973f215b1e"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["fd62a73690c4cdd37a87d21a98021e6dfaac4eaa6e8bb6637dd1d0128e2c74ec"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-70efbbab.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-70efbbab.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:33:08Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:33:08Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["fd62a73690c4cdd37a87d21a98021e6dfaac4eaa6e8bb6637dd1d0128e2c74ec"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"fd62a73690c4cdd37a87d21a98021e6dfaac4eaa6e8bb6637dd1d0128e2c74ec\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:35:03.979Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-02T21:32:01Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:33:08Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:33:08Z"}],"name":"660283bab741313169e87794c6dfdd92b2fd87e67da62906cea103cd6b1b7218","namespace":"kuadrant-system","resourceVersion":"46070","uid":"194b78e9-7d92-4397-9c5c-f515a2afdae5"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["660283bab741313169e87794c6dfdd92b2fd87e67da62906cea103cd6b1b7218"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-70efbbab.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-70efbbab.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:32:01Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:32:01Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["660283bab741313169e87794c6dfdd92b2fd87e67da62906cea103cd6b1b7218"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"660283bab741313169e87794c6dfdd92b2fd87e67da62906cea103cd6b1b7218\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:35:04.044Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-mt-70efbbab","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-mt-70efbbab#rule-3"},"creationTimestamp":"2026-11-02T21:31:08Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:33:08Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:33:08Z"}],"name":"31073c5c317c28e8c591480ae44909bd2739da3e04a508fefa3153f5dfff2bd7","namespace":"kuadrant-system","resourceVersion":"46067","uid":"e455e9c9-17f0-4fd6-adb2-310dfc0012de"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["31073c5c317c28e8c591480ae44909bd2739da3e04a508fefa3153f5dfff2bd7"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-70efbbab.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-70efbbab.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:31:09Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:31:09Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["31073c5c317c28e8c591480ae44909bd2739da3e04a508fefa3153f5dfff2bd7"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"31073c5c317c28e8c591480ae44909bd2739da3e04a508fefa3153f5dfff2bd7\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:35:04.109Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-a-d58d18","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-a-d58d18#rule-2"},"creationTimestamp":"2026-11-02T21:32:00Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:32:43Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:32:44Z"}],"name":"9f2a987a320b377df030200370c0b900f2bd70ff716b091c5a0e1f8be7be152c","namespace":"kuadrant-system","resourceVersion":"45356","uid":"8773cc70-2e69-4253-a457-d9d43680a12d"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["9f2a987a320b377df030200370c0b900f2bd70ff716b091c5a0e1f8be7be152c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-d58d18.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-d58d18.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:32:01Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:32:01Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["9f2a987a320b377df030200370c0b900f2bd70ff716b091c5a0e1f8be7be152c"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"9f2a987a320b377df030200370c0b900f2bd70ff716b091c5a0e1f8be7be152c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:35:04.173Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-b-54a4b2","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-b-54a4b2#rule-5"},"creationTimestamp":"2026-11-02T21:33:43Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:33:43Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:33:43Z"}],"name":"4ab1fbe6391b1d89a8278686a76d16a41e95acbd110403f1ea225505889e8e81","namespace":"kuadrant-system","resourceVersion":"47063","uid":"e6b2d53b-09bd-4b2e-8eea-e6e521a838d2"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["4ab1fbe6391b1d89a8278686a76d16a41e95acbd110403f1ea225505889e8e81"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-b-54a4b2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-b-54a4b2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:33:43Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:33:43Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["4ab1fbe6391b1d89a8278686a76d16a41e95acbd110403f1ea225505889e8e81"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"4ab1fbe6391b1d89a8278686a76d16a41e95acbd110403f1ea225505889e8e81\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:35:04.237Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-a-d58d18","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-a-d58d18#rule-4"},"creationTimestamp":"2026-11-02T21:32:01Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:32:42Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:32:42Z"}],"name":"dc3d84166c185e2e9efa4acd8b367890b979890c0c10a12a78bc3c2766786204","namespace":"kuadrant-system","resourceVersion":"45288","uid":"761e85e6-3981-4ea7-8f72-f949dc1b7e13"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["dc3d84166c185e2e9efa4acd8b367890b979890c0c10a12a78bc3c2766786204"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-d58d18.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-d58d18.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:32:03Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:32:03Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["dc3d84166c185e2e9efa4acd8b367890b979890c0c10a12a78bc3c2766786204"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"dc3d84166c185e2e9efa4acd8b367890b979890c0c10a12a78bc3c2766786204\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:35:04.305Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-a-682116","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-a-682116#rule-1"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"f3d9da241fa5737556fbbd5d3c4359c0d189af14f25f7374e71efb158db203bf","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f3d9da241fa5737556fbbd5d3c4359c0d189af14f25f7374e71efb158db203bf"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-682116.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-682116.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"f3d9da241fa5737556fbbd5d3c4359c0d189af14f25f7374e71efb158db203bf\" already exists"}
{"level":"error","ts":"2026-11-02T21:35:04.369Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-a-d58d18","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-a-d58d18#rule-6"},"creationTimestamp":"2026-11-02T21:32:01Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:32:42Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:32:42Z"}],"name":"74d062ece16de6291b26a7c851ae9ad94daeb2b1658a78ecdd5b82eccb46f428","namespace":"kuadrant-system","resourceVersion":"45285","uid":"123f402c-3103-43f9-b693-34c101eeb8f0"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["74d062ece16de6291b26a7c851ae9ad94daeb2b1658a78ecdd5b82eccb46f428"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-d58d18.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-d58d18.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:32:01Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:32:01Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["74d062ece16de6291b26a7c851ae9ad94daeb2b1658a78ecdd5b82eccb46f428"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"74d062ece16de6291b26a7c851ae9ad94daeb2b1658a78ecdd5b82eccb46f428\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:35:04.433Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-b-54a4b2","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-b-54a4b2#rule-2"},"creationTimestamp":"2026-11-02T21:33:42Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:33:42Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:33:42Z"}],"name":"a0e2a5a20b20758fb11fc6971890ab730da2be7e70d4d2b0565b932c28162203","namespace":"kuadrant-system","resourceVersion":"47040","uid":"ae0c90bd-f418-437e-bede-aff920a29e20"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a0e2a5a20b20758fb11fc6971890ab730da2be7e70d4d2b0565b932c28162203"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-b-54a4b2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-b-54a4b2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:33:42Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:33:42Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["a0e2a5a20b20758fb11fc6971890ab730da2be7e70d4d2b0565b932c28162203"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a0e2a5a20b20758fb11fc6971890ab730da2be7e70d4d2b0565b932c28162203\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:35:04.495Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-a-d58d18","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-a-d58d18#rule-5"},"creationTimestamp":"2026-11-02T21:32:01Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:32:43Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:32:43Z"}],"name":"2d25f68febc8f320146ec2af3ab66dc3421f1ae543d7036c1df1ff1e50efad8a","namespace":"kuadrant-system","resourceVersion":"45335","uid":"2873931e-76ac-402b-a260-5bde0626c393"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["2d25f68febc8f320146ec2af3ab66dc3421f1ae543d7036c1df1ff1e50efad8a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-d58d18.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-d58d18.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:32:01Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:32:01Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["2d25f68febc8f320146ec2af3ab66dc3421f1ae543d7036c1df1ff1e50efad8a"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"2d25f68febc8f320146ec2af3ab66dc3421f1ae543d7036c1df1ff1e50efad8a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:35:04.558Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-02T21:32:01Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:33:08Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:33:08Z"}],"name":"c8eb1936334744a56aa2274ce9d6f51ea168179c65f92874f3b8076be0207259","namespace":"kuadrant-system","resourceVersion":"46061","uid":"9c8ea99f-16e4-4c06-893b-b6bd8bfd6b17"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["c8eb1936334744a56aa2274ce9d6f51ea168179c65f92874f3b8076be0207259"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-70efbbab.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-70efbbab.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:32:01Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:32:01Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["c8eb1936334744a56aa2274ce9d6f51ea168179c65f92874f3b8076be0207259"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"c8eb1936334744a56aa2274ce9d6f51ea168179c65f92874f3b8076be0207259\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:35:04.620Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-b-54a4b2","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-b-54a4b2#rule-6"},"creationTimestamp":"2026-11-02T21:33:43Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:33:43Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:33:43Z"}],"name":"87ed39693874a16861ddc73bd1bb9eda685d13b472210d75f0cca9747d27824b","namespace":"kuadrant-system","resourceVersion":"47071","uid":"ae6102b7-11da-42bf-8109-f6eef5b172af"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["87ed39693874a16861ddc73bd1bb9eda685d13b472210d75f0cca9747d27824b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-b-54a4b2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-b-54a4b2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:33:43Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:33:43Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["87ed39693874a16861ddc73bd1bb9eda685d13b472210d75f0cca9747d27824b"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"87ed39693874a16861ddc73bd1bb9eda685d13b472210d75f0cca9747d27824b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:35:04.690Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-a-682116","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-a-682116#rule-6"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"16cd5f900135f37e691702577f23320ffda92658e1586c995028efcab5106bb9","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["16cd5f900135f37e691702577f23320ffda92658e1586c995028efcab5106bb9"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-682116.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-682116.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"16cd5f900135f37e691702577f23320ffda92658e1586c995028efcab5106bb9\" already exists"}
{"level":"error","ts":"2026-11-02T21:35:04.757Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-02T21:32:00Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:33:09Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:33:10Z"}],"name":"e2ef1a6a441ba51300173a3d2652431c0c70f9fbe3dec378b60bf73345e7ed62","namespace":"kuadrant-system","resourceVersion":"46157","uid":"5e18ee81-27b9-476a-8b42-b5eac21b9202"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["e2ef1a6a441ba51300173a3d2652431c0c70f9fbe3dec378b60bf73345e7ed62"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-70efbbab.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-70efbbab.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:33:10Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:33:10Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["e2ef1a6a441ba51300173a3d2652431c0c70f9fbe3dec378b60bf73345e7ed62"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"e2ef1a6a441ba51300173a3d2652431c0c70f9fbe3dec378b60bf73345e7ed62\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:35:04.819Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-b-54a4b2","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-b-54a4b2#rule-4"},"creationTimestamp":"2026-11-02T21:33:42Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:33:42Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:33:43Z"}],"name":"65e2f41e0492d235319025a9eee631c3136e990f62350e68194dae99d6abf9bb","namespace":"kuadrant-system","resourceVersion":"47055","uid":"329068ae-b602-410d-892f-ea3e39fea52f"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["65e2f41e0492d235319025a9eee631c3136e990f62350e68194dae99d6abf9bb"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-b-54a4b2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-b-54a4b2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:33:43Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:33:43Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["65e2f41e0492d235319025a9eee631c3136e990f62350e68194dae99d6abf9bb"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"65e2f41e0492d235319025a9eee631c3136e990f62350e68194dae99d6abf9bb\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:35:04.883Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-a-d58d18","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-a-d58d18#rule-3"},"creationTimestamp":"2026-11-02T21:32:00Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:32:43Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:32:43Z"}],"name":"f182b2459abee81e600ea86232e1f3f945df5b76d4609a6c8de6416dfc6ea7fe","namespace":"kuadrant-system","resourceVersion":"45332","uid":"941f7708-6ede-493a-8f40-e34bb86cb6c4"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f182b2459abee81e600ea86232e1f3f945df5b76d4609a6c8de6416dfc6ea7fe"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-d58d18.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-d58d18.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:32:01Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:32:01Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["f182b2459abee81e600ea86232e1f3f945df5b76d4609a6c8de6416dfc6ea7fe"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"f182b2459abee81e600ea86232e1f3f945df5b76d4609a6c8de6416dfc6ea7fe\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:35:04.950Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-a-682116","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-a-682116#rule-2"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"fdaba319a690936532fab62c3ebd16d3636d771c61603bf0d7a61cd58539e9de","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["fdaba319a690936532fab62c3ebd16d3636d771c61603bf0d7a61cd58539e9de"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-682116.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-682116.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"fdaba319a690936532fab62c3ebd16d3636d771c61603bf0d7a61cd58539e9de\" already exists"}
{"level":"error","ts":"2026-11-02T21:35:05.264Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-mt-70efbbab-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-mt-70efbbab-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:35:05.328Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-api-b-bd96ef-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-api-b-bd96ef-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:35:05.391Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-api-a-682116-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-api-a-682116-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:35:05.521Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-api-b-54a4b2-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-api-b-54a4b2-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:35:05.804Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-api-a-03ece2-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-api-a-03ece2-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:35:05.868Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-api-a-d58d18-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-api-a-d58d18-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:35:05.972Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"maas-api-route-e2e-api-a-682116","namespace":"odh-ai-gateway-infra","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"maas-api-route-e2e-api-a-682116\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:35:06.050Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-api-a-682116","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-api-a-682116\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:35:06Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-api-a-d58d18","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-a-d58d18","reconcileID":"abe97be0-1489-4c08-81ed-9e2c948c70c2","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-api-a-d58d18","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:35:06Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-a-d58d18","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T21:35:06Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:35:06Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-11-02T21:35:06Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:35:07Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-11-02T21:35:07Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-api-a-d58d18","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-a-d58d18","reconcileID":"abe97be0-1489-4c08-81ed-9e2c948c70c2","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-api-a-d58d18","namespace":"openshift-ingress"}
{"level":"error","ts":"2026-11-02T21:35:07Z","logger":"telemetry-policy-extension-controller","msg":"Reconciler error","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-api-a-d58d18","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-a-d58d18","reconcileID":"d59eb6fb-1a58-4967-ba62-9822aeb49733","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-api-a-d58d18\" not found","stacktrace":"sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:353\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-02T21:35:07Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-a-d58d18","event":"DELETE"}
{"level":"info","ts":"2026-11-02T21:35:07Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-02T21:35:07Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-api-a-d58d18\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-02T21:35:07Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:35:13.802Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","TokenRateLimitPolicy","Gateway","EnvoyFilter","ConfigMap","AuthPolicy","Limitador","HTTPRoute","Kuadrant"],"eventTypes":{"create":9,"delete":3,"update":58}}
{"level":"info","ts":"2026-11-02T21:35:14.100Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:35:14.108Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:35:16.372Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:35:16.644Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:35:16.644Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:35:16.760Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:35:17.423Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:35:20.397Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:35:20.403Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:35:20.403Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:35:20.404Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:35:20.406Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:35:20.388Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-11-02T21:35:20.446Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to delete envoyfilter object","envoyfilter":"openshift-ingress/kuadrant-ratelimiting-e2e-api-a-d58d18","error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-api-a-d58d18\" not found"}
{"level":"error","ts":"2026-11-02T21:35:20.631Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to delete envoyfilter object","envoyfilter":"openshift-ingress/kuadrant-auth-e2e-api-a-d58d18","error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-api-a-d58d18\" not found"}
{"level":"error","ts":"2026-11-02T21:35:20.631Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:35:20.631Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T21:35:21.862Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to delete envoyfilter object","gateway":"openshift-ingress/e2e-api-a-d58d18","envoyfilter":"openshift-ingress/kuadrant-e2e-api-a-d58d18","error":"envoyfilters.networking.istio.io \"kuadrant-e2e-api-a-d58d18\" not found"}
{"level":"error","ts":"2026-11-02T21:35:22.639Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-api-b-54a4b2-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-api-b-54a4b2-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:35:22.789Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-api-a-d58d18-maas-auth","namespace":"openshift-ingress","error":"authpolicies.kuadrant.io \"e2e-api-a-d58d18-maas-auth\" not found"}
{"level":"info","ts":"2026-11-02T21:35:23.402Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:35:23.402Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T21:35:24.200Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-api-a-d58d18","error":"gateways.gateway.networking.k8s.io \"e2e-api-a-d58d18\" not found"}
{"level":"info","ts":"2026-11-02T21:35:29Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-api-a-03ece2","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-a-03ece2","reconcileID":"91c4a33f-55a9-4bea-8df7-fc1c246705ed","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-api-a-03ece2","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:35:29Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-a-03ece2","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T21:35:29Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:35:29Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-11-02T21:35:29Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:35:29Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-11-02T21:35:29Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-api-a-03ece2","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-a-03ece2","reconcileID":"91c4a33f-55a9-4bea-8df7-fc1c246705ed","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-api-a-03ece2","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:35:29Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-a-03ece2","event":"DELETE"}
{"level":"info","ts":"2026-11-02T21:35:29Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-02T21:35:29Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-api-a-03ece2\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-02T21:35:29Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:35:34.187Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","AuthConfig","AuthPolicy","EnvoyFilter","Limitador","ConfigMap","HTTPRoute","Gateway"],"eventTypes":{"delete":11,"update":23}}
{"level":"info","ts":"2026-11-02T21:35:34.396Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:35:36Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-mt-70efbbab","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-mt-70efbbab","reconcileID":"7aa909a4-9c22-4035-ac5b-73ab88fc39d3","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-mt-70efbbab","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:35:36Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-mt-70efbbab","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T21:35:36Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:35:36Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-11-02T21:35:36Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:35:36Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-11-02T21:35:36Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-mt-70efbbab","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-mt-70efbbab","reconcileID":"7aa909a4-9c22-4035-ac5b-73ab88fc39d3","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-mt-70efbbab","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:35:36Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-mt-70efbbab","event":"DELETE"}
{"level":"info","ts":"2026-11-02T21:35:36Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-02T21:35:36Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-mt-70efbbab\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-02T21:35:36Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:35:36.772Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:35:36.846Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:35:36.846Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:35:40.057Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:35:40.058Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:35:40.065Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:35:40.076Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:35:40.077Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:35:40.077Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-02T21:35:40.131Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to delete envoyfilter object","envoyfilter":"openshift-ingress/kuadrant-ratelimiting-e2e-api-a-03ece2","error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-api-a-03ece2\" not found"}
{"level":"error","ts":"2026-11-02T21:35:40.131Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to delete envoyfilter object","envoyfilter":"openshift-ingress/kuadrant-auth-e2e-api-a-03ece2","error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-api-a-03ece2\" not found"}
{"level":"info","ts":"2026-11-02T21:35:40.141Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T21:35:41.214Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to delete envoyfilter object","gateway":"openshift-ingress/e2e-api-a-03ece2","envoyfilter":"openshift-ingress/kuadrant-e2e-api-a-03ece2","error":"envoyfilters.networking.istio.io \"kuadrant-e2e-api-a-03ece2\" not found"}
{"level":"error","ts":"2026-11-02T21:35:41.651Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-api-b-bd96ef-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-api-b-bd96ef-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:35:41.927Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-mt-70efbbab-maas-auth","namespace":"openshift-ingress","error":"authpolicies.kuadrant.io \"e2e-mt-70efbbab-maas-auth\" not found"}
{"level":"error","ts":"2026-11-02T21:35:42.000Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-api-a-682116-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-api-a-682116-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:35:42.002Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-mt-70efbbab","namespace":"openshift-ingress","uid":"14042ff1-5307-4fa5-9158-c8cb35f4600f","error":"tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-mt-70efbbab\" not found"}
{"level":"info","ts":"2026-11-02T21:35:42.885Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:35:42.885Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T21:35:42.943Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-mt-70efbbab","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-mt-70efbbab\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:35:43.313Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-api-a-03ece2","error":"gateways.gateway.networking.k8s.io \"e2e-api-a-03ece2\" not found"}
{"level":"info","ts":"2026-11-02T21:35:44.141Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Kuadrant","Gateway","HTTPRoute","AuthPolicy","TokenRateLimitPolicy"],"eventTypes":{"delete":3,"update":2}}
{"level":"info","ts":"2026-11-02T21:35:44.289Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:35:44.309Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:35:47.235Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:35:47.238Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:35:47.353Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:35:47.564Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:35:47.564Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:35:50.565Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:35:50.572Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:35:50.645Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:35:50.655Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:35:50.661Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:35:50.661Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-02T21:35:50.752Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to delete envoyfilter object","envoyfilter":"openshift-ingress/kuadrant-auth-e2e-api-a-03ece2","error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-api-a-03ece2\" not found"}
{"level":"error","ts":"2026-11-02T21:35:50.752Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to delete envoyfilter object","envoyfilter":"openshift-ingress/kuadrant-ratelimiting-e2e-api-a-03ece2","error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-api-a-03ece2\" not found"}
{"level":"error","ts":"2026-11-02T21:35:50.759Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:35:50.759Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T21:35:50.824Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-b-54a4b2","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-b-54a4b2#rule-1"},"creationTimestamp":"2026-11-02T21:33:43Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:34:54Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:34:54Z"}],"name":"09c48f3bbf61b81b6866a2870046460c73cab2328d9906274a40af3d4cbf5ebf","namespace":"kuadrant-system","resourceVersion":"48809","uid":"6ecd232c-cf3b-4643-ae22-bbac24140068"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["09c48f3bbf61b81b6866a2870046460c73cab2328d9906274a40af3d4cbf5ebf"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-b-54a4b2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-b-54a4b2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:33:43Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:33:43Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["09c48f3bbf61b81b6866a2870046460c73cab2328d9906274a40af3d4cbf5ebf"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"09c48f3bbf61b81b6866a2870046460c73cab2328d9906274a40af3d4cbf5ebf\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:35:50.889Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-b-54a4b2","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-b-54a4b2#rule-2"},"creationTimestamp":"2026-11-02T21:33:42Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:34:54Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:34:54Z"}],"name":"a0e2a5a20b20758fb11fc6971890ab730da2be7e70d4d2b0565b932c28162203","namespace":"kuadrant-system","resourceVersion":"48825","uid":"ae0c90bd-f418-437e-bede-aff920a29e20"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a0e2a5a20b20758fb11fc6971890ab730da2be7e70d4d2b0565b932c28162203"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-b-54a4b2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-b-54a4b2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:33:42Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:33:42Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["a0e2a5a20b20758fb11fc6971890ab730da2be7e70d4d2b0565b932c28162203"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a0e2a5a20b20758fb11fc6971890ab730da2be7e70d4d2b0565b932c28162203\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:35:50.956Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-b-54a4b2","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-b-54a4b2#rule-4"},"creationTimestamp":"2026-11-02T21:33:42Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:34:53Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:34:54Z"}],"name":"65e2f41e0492d235319025a9eee631c3136e990f62350e68194dae99d6abf9bb","namespace":"kuadrant-system","resourceVersion":"48792","uid":"329068ae-b602-410d-892f-ea3e39fea52f"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["65e2f41e0492d235319025a9eee631c3136e990f62350e68194dae99d6abf9bb"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-b-54a4b2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-b-54a4b2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:33:43Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:33:43Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["65e2f41e0492d235319025a9eee631c3136e990f62350e68194dae99d6abf9bb"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"65e2f41e0492d235319025a9eee631c3136e990f62350e68194dae99d6abf9bb\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:35:51.027Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-b-54a4b2","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-b-54a4b2#rule-3"},"creationTimestamp":"2026-11-02T21:33:42Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:34:53Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:34:53Z"}],"name":"7d2020bcb31505aed9ee28e7f3e3022b1d49395dd952574d8eafacc1a0d454a8","namespace":"kuadrant-system","resourceVersion":"48778","uid":"751ec661-b248-463e-8d8c-a83f233e79ec"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["7d2020bcb31505aed9ee28e7f3e3022b1d49395dd952574d8eafacc1a0d454a8"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-b-54a4b2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-b-54a4b2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:33:43Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:33:43Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["7d2020bcb31505aed9ee28e7f3e3022b1d49395dd952574d8eafacc1a0d454a8"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"7d2020bcb31505aed9ee28e7f3e3022b1d49395dd952574d8eafacc1a0d454a8\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:35:51.095Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-b-54a4b2","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-b-54a4b2#rule-6"},"creationTimestamp":"2026-11-02T21:33:43Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:34:52Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:34:53Z"}],"name":"87ed39693874a16861ddc73bd1bb9eda685d13b472210d75f0cca9747d27824b","namespace":"kuadrant-system","resourceVersion":"48755","uid":"ae6102b7-11da-42bf-8109-f6eef5b172af"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["87ed39693874a16861ddc73bd1bb9eda685d13b472210d75f0cca9747d27824b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-b-54a4b2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-b-54a4b2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:33:43Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:33:43Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["87ed39693874a16861ddc73bd1bb9eda685d13b472210d75f0cca9747d27824b"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"87ed39693874a16861ddc73bd1bb9eda685d13b472210d75f0cca9747d27824b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:35:51.158Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-b-54a4b2","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-b-54a4b2#rule-5"},"creationTimestamp":"2026-11-02T21:33:43Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:34:53Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:34:54Z"}],"name":"4ab1fbe6391b1d89a8278686a76d16a41e95acbd110403f1ea225505889e8e81","namespace":"kuadrant-system","resourceVersion":"48799","uid":"e6b2d53b-09bd-4b2e-8eea-e6e521a838d2"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["4ab1fbe6391b1d89a8278686a76d16a41e95acbd110403f1ea225505889e8e81"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-b-54a4b2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-b-54a4b2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:33:43Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:33:43Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["4ab1fbe6391b1d89a8278686a76d16a41e95acbd110403f1ea225505889e8e81"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"4ab1fbe6391b1d89a8278686a76d16a41e95acbd110403f1ea225505889e8e81\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:35:51.225Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/16afca875e32182f76276c92362bad6be9ccc1b7d5c1a23012cb02c2c034a35d","error":"authconfigs.authorino.kuadrant.io \"16afca875e32182f76276c92362bad6be9ccc1b7d5c1a23012cb02c2c034a35d\" not found"}
{"level":"error","ts":"2026-11-02T21:35:51.284Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/a23280a2c27eb5cfa804bad6a249df44d076c314376cd3c6609504a3d063cd00","error":"authconfigs.authorino.kuadrant.io \"a23280a2c27eb5cfa804bad6a249df44d076c314376cd3c6609504a3d063cd00\" not found"}
{"level":"error","ts":"2026-11-02T21:35:51.339Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/2166134d345f7e7a4bb4a34bd968fa4e5105f9653341d5c227591881122eb8b9","error":"authconfigs.authorino.kuadrant.io \"2166134d345f7e7a4bb4a34bd968fa4e5105f9653341d5c227591881122eb8b9\" not found"}
{"level":"error","ts":"2026-11-02T21:35:51.394Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/98acaefbc60df582f7b6732bd1f571c581eefc3eacf311b900b1cc1cea827840","error":"authconfigs.authorino.kuadrant.io \"98acaefbc60df582f7b6732bd1f571c581eefc3eacf311b900b1cc1cea827840\" not found"}
{"level":"error","ts":"2026-11-02T21:35:51.448Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/baaadf4ad5748e27109b66d0139e4f1c590a4ab96eca9ec0f90f912bf81e3ffe","error":"authconfigs.authorino.kuadrant.io \"baaadf4ad5748e27109b66d0139e4f1c590a4ab96eca9ec0f90f912bf81e3ffe\" not found"}
{"level":"error","ts":"2026-11-02T21:35:51.503Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/95b79ab7efe16c1fc7f4795424dae3f3114cdbf669c083c1ba52950a6fd05738","error":"authconfigs.authorino.kuadrant.io \"95b79ab7efe16c1fc7f4795424dae3f3114cdbf669c083c1ba52950a6fd05738\" not found"}
{"level":"error","ts":"2026-11-02T21:35:51.714Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to delete envoyfilter object","gateway":"openshift-ingress/e2e-api-a-03ece2","envoyfilter":"openshift-ingress/kuadrant-e2e-api-a-03ece2","error":"envoyfilters.networking.istio.io \"kuadrant-e2e-api-a-03ece2\" not found"}
{"level":"error","ts":"2026-11-02T21:35:51.934Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-mt-70efbbab","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T21:31:08Z","generation":4,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"55b43ab2-2dfe-4712-81e7-9e7e015fa479\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:35:21Z"}],"name":"kuadrant-e2e-mt-70efbbab","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-mt-70efbbab","uid":"55b43ab2-2dfe-4712-81e7-9e7e015fa479"}],"resourceVersion":"49475","uid":"9d1488fb-b4ab-4157-85c6-449eabd21318"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7dd93d350f32a149c45b09c240b7a22e2323c5563700b192f69d6c453081048e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-70efbbab-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bb242d84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-70efbbab\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bb242d84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-70efbbab\"]}],\"name\":\"26af48aaec34e183a09f9ec435e1fedc3c724fea2fe9bcc26c8b30dc41445ecb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-mt-70efbbab/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7dd93d350f32a149c45b09c240b7a22e2323c5563700b192f69d6c453081048e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-70efbbab-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bb242d84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-70efbbab\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bb242d84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-70efbbab\"]}],\"name\":\"36d9bcf1282e1ab53cadabe1a773a796c771ca06d2ad1b75b2e21ebe44e294b2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-mt-70efbbab/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7dd93d350f32a149c45b09c240b7a22e2323c5563700b192f69d6c453081048e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-70efbbab-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bb242d84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-70efbbab\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bb242d84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-70efbbab\"]}],\"name\":\"42156308c37622fdd8e2eb715b54f0c21bcf8649d71887cdea7da283b2ae66f9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-mt-70efbbab/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7dd93d350f32a149c45b09c240b7a22e2323c5563700b192f69d6c453081048e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-70efbbab-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bb242d84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-70efbbab\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bb242d84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-70efbbab\"]}],\"name\":\"92d75bf53e6d0363367aa1b3f3995cea648ed403432ffe1adad4b0d501d0a117\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-mt-70efbbab/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7dd93d350f32a149c45b09c240b7a22e2323c5563700b192f69d6c453081048e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-70efbbab-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bb242d84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-70efbbab\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bb242d84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-70efbbab\"]}],\"name\":\"a884fa8010063383518375ec0ae32640857fe5481d803fac9c3df28db0fb2c8b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-mt-70efbbab/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7dd93d350f32a149c45b09c240b7a22e2323c5563700b192f69d6c453081048e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-70efbbab-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bb242d84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-70efbbab\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bb242d84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-70efbbab\"]}],\"name\":\"c2151a73fa3d8b6b1f9d2d9f1c2150a1192007efb42808765003fa15a61e6274\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-mt-70efbbab/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7dd93d350f32a149c45b09c240b7a22e2323c5563700b192f69d6c453081048e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-70efbbab-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bb242d84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-70efbbab\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bb242d84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-70efbbab\"]}],\"name\":\"4b7f0d2029b173a051f4dd548163881d503549308a25515c70902b49af622b5d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-mt-70efbbab/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7dd93d350f32a149c45b09c240b7a22e2323c5563700b192f69d6c453081048e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-70efbbab-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bb242d84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-70efbbab\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bb242d84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-70efbbab\"]}],\"name\":\"cc9fff076b130fafb40e2886a2c9cf7dd95dd367bb85d7a53426853675381336\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-mt-70efbbab/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0a626bd77283731109bdf44eb675ae0af0d6ae927fd1d71365c621209aa60038\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-70efbbab-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bb242d84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-mt-70efbbab\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-70efbbab\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bb242d84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-mt-70efbbab\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-70efbbab\"]}],\"name\":\"b87eba9ba35eb6a53338cb9c1a5f04f8c65b27b2608950e94b52695b57960191\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e2ef1a6a441ba51300173a3d2652431c0c70f9fbe3dec378b60bf73345e7ed62\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-70efbbab-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bb242d84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-70efbbab\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bb242d84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-70efbbab\"]}],\"name\":\"1593e2c64df0faa2ebc6b10952fa9b82d3efee58762f93cc9465e571a728d1f8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-mt-70efbbab/models/facebook/opt-125m/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7423a2f76c00c27e0a8383b9e315e7f7063dd5642156172f597daf18b46fde33\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-70efbbab-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bb242d84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-70efbbab\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bb242d84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-70efbbab\"]}],\"name\":\"a2ad544462cdf5b554a98107f4c0fd7c534ac2ac647f0b2aa5ab3da7a249ac13\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-mt-70efbbab/models/facebook/opt-125m/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7adf1ca91bf336959a508540d878f5239ea90c05e08e3636aeaa69a6226a3003\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-70efbbab-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bb242d84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-70efbbab\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bb242d84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-70efbbab\"]}],\"name\":\"4e0db781e2e53c4888f6416aa3fae6a7179f3b69a2df03210baf374560be0c7e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"660283bab741313169e87794c6dfdd92b2fd87e67da62906cea103cd6b1b7218\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-70efbbab-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bb242d84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-70efbbab\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bb242d84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-70efbbab\"]}],\"name\":\"78183ffd5b459106dac6bab76c2d8256b7277ddce528b569caaac70c532f9a2b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-mt-70efbbab/models/facebook/opt-125m/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"86769b4cd589416a0961b23aa701cac08477d8ee25523565ff53094b12f68d12\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-70efbbab-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bb242d84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-70efbbab\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bb242d84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-70efbbab\"]}],\"name\":\"87b653e00c12c47291b3ad13cd1edc5962f5eacbe22dc6a22fd3fca81dcb32bb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-mt-70efbbab/models/facebook/opt-125m/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c8eb1936334744a56aa2274ce9d6f51ea168179c65f92874f3b8076be0207259\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-70efbbab-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bb242d84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-70efbbab\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bb242d84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-70efbbab\"]}],\"name\":\"8605d3a698c26e3b9d59d014f7721566c9b36fb05b8ffea44af31df6cf59deeb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cd0342f6c3ef93f58d95e760fb8ed9fa936a0168aa423e2db15cd0f43b6a534f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-70efbbab-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bb242d84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-70efbbab\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bb242d84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-70efbbab\"]}],\"name\":\"d54ad85af9aa2c95a75a3acfc7c45d1345d75f60ce760e8f7044856c841c5d2c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"686f86f63369549dfd81bff146f9663d1dd02886636e63f1ff5322994f99d220\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-70efbbab-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bb242d84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-70efbbab\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bb242d84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-70efbbab\"]}],\"name\":\"efeb7d9fae7f1673ede7843140c3d4d113c2e28a67a0c22c07a649dd45b780af\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8963f302f71d40b22b463a6588998e3c87fec7d53908554dfc99bbb66749350f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-70efbbab-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bb242d84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-70efbbab\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bb242d84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-70efbbab\"]}],\"name\":\"4d28341dedff12df328604e7e875c24d702a2cfab162029d4cec927521dfceb0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-mt-70efbbab/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9ea783f2033457fc0f2f52f4f6f7a87dacb7918d14fd2c49d89468a40d5ce2f5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-70efbbab-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bb242d84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-70efbbab\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bb242d84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-70efbbab\"]}],\"name\":\"5af4bc8b44c95f3915077694bafb4178b8e18facb0071e8a73e278900ec2278c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fd62a73690c4cdd37a87d21a98021e6dfaac4eaa6e8bb6637dd1d0128e2c74ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-70efbbab-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bb242d84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-mt-70efbbab\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-70efbbab\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bb242d84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-mt-70efbbab\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-70efbbab\"]}],\"name\":\"0730cd900d638778f9c32f3f7d9c5f420d734632bb8252b568315c5a9676d0d8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6f155f9c22fd9155424959d77e15b09e2e46420c024c9208fdcbaaf5989ef3ab\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-70efbbab-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bb242d84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-mt-70efbbab\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-70efbbab\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bb242d84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-mt-70efbbab\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-70efbbab\"]}],\"name\":\"c720b7f2d11b3dbb7b799bbebd973a4d4ec8c684155c16c46e1eda1185ff8837\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"31073c5c317c28e8c591480ae44909bd2739da3e04a508fefa3153f5dfff2bd7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-70efbbab-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bb242d84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-mt-70efbbab\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-70efbbab\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bb242d84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-mt-70efbbab\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-70efbbab\"]}],\"name\":\"64099bf2730414a6f288ff5b1ac6eeee51286fe6f193710bdd769df5c9ee2087\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"51d36c7f5f5d3ce8ca874f6f293be93ec6a5b3c79a267dd55f8e4240e4bb0e5c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-70efbbab-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bb242d84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-mt-70efbbab\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-70efbbab\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bb242d84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-mt-70efbbab\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-70efbbab\"]}],\"name\":\"50d37a806bd243094a3c969b2322245adf16563d4a39be9ea98b97e027900dd5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"81610c6024322aa440cb76b35caf0e21d85e94dd73885d1aff7f8f6ba84a448b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-70efbbab-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bb242d84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-mt-70efbbab\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-70efbbab\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bb242d84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-mt-70efbbab\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-70efbbab\"]}],\"name\":\"f8e7a3e592323f9939c7310e2c6057d3a35fc55047d6200c2567409a248d5fd1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f8da20627f0169e69426fd609be7867dca7c3ecdf4acafec00912ff7791bd2d6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-70efbbab-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bb242d84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-70efbbab\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bb242d84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-mt-70efbbab/e2e-lifecycle-model-70efbbab-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-70efbbab\"]}],\"name\":\"d19934dec818f9e60b561d1195bb12b26f34fc933a450d4f376abcf5b66fb12a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-mt-70efbbab/models/facebook/opt-125m')\"]}}],\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-mt-70efbbab"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-mt-70efbbab\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:35:52.158Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-api-b-bd96ef-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-api-b-bd96ef-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:35:52.221Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-api-b-54a4b2-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-api-b-54a4b2-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:35:52.286Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-api-a-682116-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-api-a-682116-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:35:52.555Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-mt-70efbbab-maas-auth","namespace":"openshift-ingress","error":"authpolicies.kuadrant.io \"e2e-mt-70efbbab-maas-auth\" not found"}
{"level":"error","ts":"2026-11-02T21:35:52.679Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-mt-70efbbab","namespace":"openshift-ingress","uid":"14042ff1-5307-4fa5-9158-c8cb35f4600f","error":"tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-mt-70efbbab\" not found"}
{"level":"info","ts":"2026-11-02T21:35:53.355Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:35:53.355Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T21:35:53.988Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-api-a-03ece2","error":"gateways.gateway.networking.k8s.io \"e2e-api-a-03ece2\" not found"}
{"level":"error","ts":"2026-11-02T21:35:54.108Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-mt-70efbbab","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-mt-70efbbab\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:36:01.053Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","AuthPolicy","Limitador","Gateway","Kuadrant","AuthConfig","EnvoyFilter","HTTPRoute","TokenRateLimitPolicy"],"eventTypes":{"create":1,"delete":13,"update":14}}
{"level":"info","ts":"2026-11-02T21:36:01.428Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:36:01.448Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:36:03.666Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:36:03.931Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:36:03.954Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:36:04.056Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:36:04.056Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:36:07.059Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:36:07.063Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:36:07.069Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:36:07.069Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:36:07.070Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:36:07.070Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:36:07.241Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:36:08Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-api-b-54a4b2","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-b-54a4b2","reconcileID":"7b3d35c5-03c0-4ec7-a281-e29408506aaa","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-api-b-54a4b2","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:36:09Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-b-54a4b2","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T21:36:09Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:36:09Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-11-02T21:36:09Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:36:09Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-11-02T21:36:09Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-api-b-54a4b2","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-b-54a4b2","reconcileID":"7b3d35c5-03c0-4ec7-a281-e29408506aaa","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-api-b-54a4b2","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:36:09Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-b-54a4b2","event":"DELETE"}
{"level":"info","ts":"2026-11-02T21:36:09Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-02T21:36:09Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-api-b-54a4b2\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-02T21:36:09Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"error","ts":"2026-11-02T21:36:09.538Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-api-b-54a4b2","namespace":"openshift-ingress","uid":"fcd97d0d-de3f-43a8-a3a6-7c7840000a42","error":"tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-api-b-54a4b2\" not found"}
{"level":"error","ts":"2026-11-02T21:36:09.760Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"maas-gateway-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"maas-gateway-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:36:10.259Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-facebook-opt-125m-simulated","namespace":"llm","uid":"da8edb1a-ed61-454d-939f-fc7cd235d9fb","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-facebook-opt-125m-simulated\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:36:10.438Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:36:10.438Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T21:36:11.009Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-api-b-54a4b2","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-api-b-54a4b2\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:36:20.808Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","Kuadrant","AuthPolicy","Gateway","ConfigMap","HTTPRoute","Limitador","TokenRateLimitPolicy","EnvoyFilter"],"eventTypes":{"delete":28,"update":21}}
{"level":"info","ts":"2026-11-02T21:36:21.051Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:36:21.061Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:36:23.425Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:36:23.440Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:36:23.448Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:36:23.669Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:36:23.670Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:36:25Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-mt-70efbbab","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-mt-70efbbab","reconcileID":"db72b832-b0c2-4542-88da-90a6fecc970c","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-mt-70efbbab","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:36:25Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-mt-70efbbab","event":"CREATE"}
{"level":"info","ts":"2026-11-02T21:36:25Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:36:26Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-02T21:36:26Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-02T21:36:26.855Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:36:26.859Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:36:26.874Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:36:26Z","logger":"telemetry-policy-extension-controller","msg":"Failed to update status: resource might just be outdated"}
{"level":"info","ts":"2026-11-02T21:36:26Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:36:26Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-mt-70efbbab","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-mt-70efbbab","reconcileID":"78fd0338-fb16-4946-9a21-b5fc6d63ff43","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-mt-70efbbab","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:36:26.944Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:36:26.949Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:36:26.949Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:36:26Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-mt-70efbbab","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T21:36:26Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-02T21:36:27.031Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:36:27.031Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:36:27Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-02T21:36:27Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-02T21:36:27Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:36:27Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-mt-70efbbab","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-mt-70efbbab","reconcileID":"cc718bdb-626c-44ee-acfb-4e818bcef0ee","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-mt-70efbbab","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:36:27Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-mt-70efbbab","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T21:36:27Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:36:28Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-02T21:36:28Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-02T21:36:28Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-02T21:36:28Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:36:31Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-api-b-6606aa","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-b-6606aa","reconcileID":"2732e9b4-ca36-4f0b-84f8-a74ef9b4d12c","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-api-b-6606aa","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:36:31Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-b-6606aa","event":"CREATE"}
{"level":"info","ts":"2026-11-02T21:36:31Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:36:32Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-02T21:36:32Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-02T21:36:32Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:36:32Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-api-b-6606aa","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-b-6606aa","reconcileID":"7fa35025-3e3a-44e9-8e98-7d8bcbb3b02c","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-api-b-6606aa","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:36:32Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-b-6606aa","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T21:36:32Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:36:32Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-02T21:36:32Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-02T21:36:32Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-02T21:36:32Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:36:32Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-api-b-bd96ef","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-b-bd96ef","reconcileID":"af7dd01b-1695-4ad8-b992-f4fc26fe5f2a","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-api-b-bd96ef","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:36:32Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-b-bd96ef","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T21:36:32Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:36:32Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-11-02T21:36:32Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:36:32Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-11-02T21:36:32Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-api-b-bd96ef","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-b-bd96ef","reconcileID":"af7dd01b-1695-4ad8-b992-f4fc26fe5f2a","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-api-b-bd96ef","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:36:32Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-api-b-6606aa","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-b-6606aa","reconcileID":"59b88a51-5d96-4b6d-89d4-f312eb024e84","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-api-b-6606aa","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:36:32Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-b-6606aa","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T21:36:32Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:36:33Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-02T21:36:33Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-02T21:36:33Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-02T21:36:33Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:36:33Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-b-bd96ef","event":"DELETE"}
{"level":"info","ts":"2026-11-02T21:36:33Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-02T21:36:33Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-api-b-bd96ef\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-02T21:36:33Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"error","ts":"2026-11-02T21:36:35.224Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-api-b-bd96ef","namespace":"openshift-ingress","uid":"ce255142-508f-4858-a8e2-ef850cc62752","error":"tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-api-b-bd96ef\" not found"}
{"level":"info","ts":"2026-11-02T21:36:35.992Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:36:35.992Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T21:36:36.110Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-api-b-bd96ef","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-api-b-bd96ef\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:36:36.328Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-mt-70efbbab","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-mt-70efbbab\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:36:36.635Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-api-b-6606aa","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-api-b-6606aa\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:36:36.819Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-ipp-a-54e844","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-ipp-a-54e844\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:36:37.151Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway","TokenRateLimitPolicy"],"eventTypes":{"create":1,"update":1}}
{"level":"info","ts":"2026-11-02T21:36:42.028Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:36:42.031Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:36:42.035Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:36:42.035Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:36:42.038Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:36:42.038Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-11-02T21:36:42.142Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:36:42.142Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T21:36:42.146Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-02T21:18:49Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:18:49Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:34:14Z"}],"name":"54cd0149b818480305f3d0024b3c95629cafb641b48195d003b2b7006d5c6bcd","namespace":"kuadrant-system","resourceVersion":"47841","uid":"0502152b-1d9d-492f-bb61-0a9806d87310"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["54cd0149b818480305f3d0024b3c95629cafb641b48195d003b2b7006d5c6bcd"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:18:49Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:18:49Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["54cd0149b818480305f3d0024b3c95629cafb641b48195d003b2b7006d5c6bcd"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"54cd0149b818480305f3d0024b3c95629cafb641b48195d003b2b7006d5c6bcd\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:36:42.223Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-embedding-simulated-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-embedding-simulated-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-02T21:18:27Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:18:27Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:34:16Z"}],"name":"a9800464506c58f005016df354e160757732171ff4d19747202524955329b998","namespace":"kuadrant-system","resourceVersion":"47901","uid":"f6f9e98f-7883-4e00-aa33-65bc8f401c6b"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a9800464506c58f005016df354e160757732171ff4d19747202524955329b998"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:18:27Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:18:27Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["a9800464506c58f005016df354e160757732171ff4d19747202524955329b998"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a9800464506c58f005016df354e160757732171ff4d19747202524955329b998\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:36:42.323Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-02T21:18:31Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:18:31Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:34:14Z"}],"name":"2416d7b42d11a09d7152746be0e114f8fdc87d0fbd0efa9dec5b52b011082194","namespace":"kuadrant-system","resourceVersion":"47830","uid":"dca4432d-1e71-4b9a-b327-da52977476c8"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["2416d7b42d11a09d7152746be0e114f8fdc87d0fbd0efa9dec5b52b011082194"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:19:19Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:19:19Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["2416d7b42d11a09d7152746be0e114f8fdc87d0fbd0efa9dec5b52b011082194"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"2416d7b42d11a09d7152746be0e114f8fdc87d0fbd0efa9dec5b52b011082194\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:36:42.385Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-02T21:18:38Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:18:38Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:34:12Z"}],"name":"3167d3bf853032a93e8569019dcd3e5aa33af9cb580cf9ca138990567fc9d857","namespace":"kuadrant-system","resourceVersion":"47723","uid":"de8437b4-29c6-42d1-bbfa-ad2e23016891"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["3167d3bf853032a93e8569019dcd3e5aa33af9cb580cf9ca138990567fc9d857"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:18:39Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:18:39Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["3167d3bf853032a93e8569019dcd3e5aa33af9cb580cf9ca138990567fc9d857"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"3167d3bf853032a93e8569019dcd3e5aa33af9cb580cf9ca138990567fc9d857\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:36:42.449Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-02T21:18:31Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:18:31Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:34:11Z"}],"name":"d303c788902ad4467c7ae545d65cbef45564d1c0d56396c93057df3909461aa1","namespace":"kuadrant-system","resourceVersion":"47685","uid":"7521f93f-4074-4748-8dfc-7b8329156ff3"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d303c788902ad4467c7ae545d65cbef45564d1c0d56396c93057df3909461aa1"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:34:11Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:34:11Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["d303c788902ad4467c7ae545d65cbef45564d1c0d56396c93057df3909461aa1"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"d303c788902ad4467c7ae545d65cbef45564d1c0d56396c93057df3909461aa1\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:36:42.512Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-2-simulated-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-2-simulated-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-02T21:18:17Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:18:17Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:34:11Z"}],"name":"010adf02b2e7deb40c572f4729b6dd4619847c8e6344137326b72df28772fc1a","namespace":"kuadrant-system","resourceVersion":"47694","uid":"d59bd379-de22-4260-a63f-ca258b3bd69f"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["010adf02b2e7deb40c572f4729b6dd4619847c8e6344137326b72df28772fc1a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:19:17Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:19:17Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["010adf02b2e7deb40c572f4729b6dd4619847c8e6344137326b72df28772fc1a"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"010adf02b2e7deb40c572f4729b6dd4619847c8e6344137326b72df28772fc1a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:36:42.574Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-02T21:18:38Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:18:38Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:34:13Z"}],"name":"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce","namespace":"kuadrant-system","resourceVersion":"47785","uid":"214d0d20-7d9b-4385-aa4a-c6a227088314"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:18:38Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:18:38Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:36:42.636Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-02T21:18:48Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:18:48Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:34:14Z"}],"name":"aa7038625b8f43b0c002f79637065e5ab90468f50f998759d08f2c4640c07c04","namespace":"kuadrant-system","resourceVersion":"47818","uid":"bbed2434-8880-494c-80c3-f3902b031a86"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["aa7038625b8f43b0c002f79637065e5ab90468f50f998759d08f2c4640c07c04"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:18:48Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:18:48Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["aa7038625b8f43b0c002f79637065e5ab90468f50f998759d08f2c4640c07c04"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"aa7038625b8f43b0c002f79637065e5ab90468f50f998759d08f2c4640c07c04\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:36:42.698Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route#rule-5"},"creationTimestamp":"2026-11-02T21:16:03Z","generation":3,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:18:17Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:34:17Z"}],"name":"a82769ff87473da04c27497e160e9b4b1a5dd93578e0cf2342be8b2f06845269","namespace":"kuadrant-system","resourceVersion":"47958","uid":"39cbf22a-c6ff-4ae7-8f94-107ee05355b1"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a82769ff87473da04c27497e160e9b4b1a5dd93578e0cf2342be8b2f06845269"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:16:17Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:16:17Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["a82769ff87473da04c27497e160e9b4b1a5dd93578e0cf2342be8b2f06845269"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a82769ff87473da04c27497e160e9b4b1a5dd93578e0cf2342be8b2f06845269\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:36:42.734Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-api-b-bd96ef","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T21:34:10Z","generation":1,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"544dd783-aa47-4680-9104-ae4c9cf761d2\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:34:10Z"}],"name":"kuadrant-e2e-api-b-bd96ef","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-api-b-bd96ef","uid":"544dd783-aa47-4680-9104-ae4c9cf761d2"}],"resourceVersion":"47652","uid":"2ac6a390-b92d-4b18-b311-7bfd761815fa"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f6c91e0a66ef33c02cb034473b62e379c757e813fa07e158067e9984f93b02fd\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-api-b-bd96ef-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5d5e9f4b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-api-b-bd96ef\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-api-b-bd96ef\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5d5e9f4b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-api-b-bd96ef\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-api-b-bd96ef\"]}],\"name\":\"21791d02298b3e97a9a74c374b7ac21fa5caa1935c43c2526b7773203876a3f8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4b28cebc4926f05a50890ae00cafa0e65efc022ec74d0ba299306e2df61495bf\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-api-b-bd96ef-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5d5e9f4b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-api-b-bd96ef\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-api-b-bd96ef\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5d5e9f4b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-api-b-bd96ef\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-api-b-bd96ef\"]}],\"name\":\"f9b7e4b23a2f752364301ea14664ede5f1ef322bbd03df5b4cb3a34757e913ef\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f4597e65bb9fa4ff978b4762a0e2526c63d8289f3e5238b7b9c41a87f5af4ed0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-api-b-bd96ef-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5d5e9f4b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-api-b-bd96ef\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-api-b-bd96ef\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5d5e9f4b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-api-b-bd96ef\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-api-b-bd96ef\"]}],\"name\":\"031b61473c3996e5c1d438eb0aa542f1fa0d140af5e3c68de60412d534d3c650\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1d90d12b3b036e208ea0ecd2816f1ce98a306f893e1402f7774c06abbe6ab154\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-api-b-bd96ef-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5d5e9f4b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-api-b-bd96ef\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-api-b-bd96ef\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5d5e9f4b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-api-b-bd96ef\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-api-b-bd96ef\"]}],\"name\":\"5b0d39e4364ccd87e4b692502c7221e9c4d3eacd6a2f2fadf11a38528f12a3e7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"04c511e09ac7586bf19bb68c01ba6cf492f1ba2ef206814f85587213496a78e1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-api-b-bd96ef-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5d5e9f4b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-api-b-bd96ef\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-api-b-bd96ef\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5d5e9f4b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-api-b-bd96ef\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-api-b-bd96ef\"]}],\"name\":\"e2b71b1d3d60fb8775004dd2cda0f2b63cd69b3a4e0c4efdfa40d2902d17034c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ad864b90bd341f4e47f907ad590db4516fdb3f5ba2b624ad066777f82b14867d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-api-b-bd96ef-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5d5e9f4b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-api-b-bd96ef\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-api-b-bd96ef\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5d5e9f4b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-api-b-bd96ef\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-api-b-bd96ef\"]}],\"name\":\"1b923c1b68adfec88d8a480099fc59a05705e00dc5400eb25516203f69cead8c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}}],\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-api-b-bd96ef"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-e2e-api-b-bd96ef\" not found"}
{"level":"error","ts":"2026-11-02T21:36:42.760Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-02T21:18:21Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:18:21Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:34:14Z"}],"name":"cad6ab5a81a65fd4cb03a0fefdab5de82aa18c30a5b95078b1d05214b0606f40","namespace":"kuadrant-system","resourceVersion":"47828","uid":"ad7a5c7a-3f09-47be-8d53-f79bcd3bfd41"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["cad6ab5a81a65fd4cb03a0fefdab5de82aa18c30a5b95078b1d05214b0606f40"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:18:21Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:18:21Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["cad6ab5a81a65fd4cb03a0fefdab5de82aa18c30a5b95078b1d05214b0606f40"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"cad6ab5a81a65fd4cb03a0fefdab5de82aa18c30a5b95078b1d05214b0606f40\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:36:42.822Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-02T21:18:21Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:18:21Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:34:15Z"}],"name":"1704c6bc15d6f547acca888061680f2275f690cb79e5af6fee44747bcf278b95","namespace":"kuadrant-system","resourceVersion":"47862","uid":"0c1e6b62-dc00-4c2d-acdb-49434ea56239"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["1704c6bc15d6f547acca888061680f2275f690cb79e5af6fee44747bcf278b95"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:18:21Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:18:21Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["1704c6bc15d6f547acca888061680f2275f690cb79e5af6fee44747bcf278b95"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"1704c6bc15d6f547acca888061680f2275f690cb79e5af6fee44747bcf278b95\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:36:42.884Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-02T21:18:31Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:18:31Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:34:12Z"}],"name":"23672b974f0dbc05100a34c78d2b029e41f1d5a3752f3fcb52915f56db360e25","namespace":"kuadrant-system","resourceVersion":"47766","uid":"8464ab4b-fcc7-4b42-8fc7-5c7330242a1c"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["23672b974f0dbc05100a34c78d2b029e41f1d5a3752f3fcb52915f56db360e25"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:18:31Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:18:31Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["23672b974f0dbc05100a34c78d2b029e41f1d5a3752f3fcb52915f56db360e25"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"23672b974f0dbc05100a34c78d2b029e41f1d5a3752f3fcb52915f56db360e25\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:36:42.946Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-2-simulated-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-2-simulated-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-02T21:18:17Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:18:17Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:34:11Z"}],"name":"74b47f1aa1203aad58596cbaab10ae46e8fddd08ac49eb57a26bdba532d88e72","namespace":"kuadrant-system","resourceVersion":"47710","uid":"9a36249e-7376-46a4-b2d3-242b00d8f143"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["74b47f1aa1203aad58596cbaab10ae46e8fddd08ac49eb57a26bdba532d88e72"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:18:18Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:18:18Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["74b47f1aa1203aad58596cbaab10ae46e8fddd08ac49eb57a26bdba532d88e72"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"74b47f1aa1203aad58596cbaab10ae46e8fddd08ac49eb57a26bdba532d88e72\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:36:43.009Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route#rule-2"},"creationTimestamp":"2026-11-02T21:16:03Z","generation":3,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:18:16Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:34:15Z"}],"name":"5c6918972d1a7f8ad5201880b7d6d9c1191ca1f25376682f691def7868e3fd02","namespace":"kuadrant-system","resourceVersion":"47884","uid":"11d8aa0d-8ddd-4892-858b-e95eb780085e"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["5c6918972d1a7f8ad5201880b7d6d9c1191ca1f25376682f691def7868e3fd02"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:16:17Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:16:17Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["5c6918972d1a7f8ad5201880b7d6d9c1191ca1f25376682f691def7868e3fd02"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"5c6918972d1a7f8ad5201880b7d6d9c1191ca1f25376682f691def7868e3fd02\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:36:43.076Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-02T21:18:48Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:18:48Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:34:16Z"}],"name":"50c2058cf11e07a931b06ac4446a56eee86855f00badf26618abe486a7bdcfd7","namespace":"kuadrant-system","resourceVersion":"47916","uid":"de9d1cc9-14b7-409e-bb3a-aa08103ae0bc"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["50c2058cf11e07a931b06ac4446a56eee86855f00badf26618abe486a7bdcfd7"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:19:18Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:19:18Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["50c2058cf11e07a931b06ac4446a56eee86855f00badf26618abe486a7bdcfd7"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"50c2058cf11e07a931b06ac4446a56eee86855f00badf26618abe486a7bdcfd7\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:36:43.139Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-02T21:18:49Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:18:49Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:34:10Z"}],"name":"8274337fc3f0de48e5213819aeb4a46559c4f8b3428c1bae43c0d75207ef5264","namespace":"kuadrant-system","resourceVersion":"47657","uid":"c327b713-1cdf-45d8-a6fb-af24dc0f9100"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["8274337fc3f0de48e5213819aeb4a46559c4f8b3428c1bae43c0d75207ef5264"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:18:49Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:18:49Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["8274337fc3f0de48e5213819aeb4a46559c4f8b3428c1bae43c0d75207ef5264"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"8274337fc3f0de48e5213819aeb4a46559c4f8b3428c1bae43c0d75207ef5264\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:36:43.204Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route#rule-3"},"creationTimestamp":"2026-11-02T21:16:03Z","generation":3,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:18:17Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:34:11Z"}],"name":"06b05a8e4dd69bdc4f333ad9509ee8cad3c5c0f5dd48edbe94c1158b60f79ed3","namespace":"kuadrant-system","resourceVersion":"47672","uid":"0a3fd9fd-cbf8-4e06-8178-b81d7348efd7"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["06b05a8e4dd69bdc4f333ad9509ee8cad3c5c0f5dd48edbe94c1158b60f79ed3"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:16:16Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:16:16Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["06b05a8e4dd69bdc4f333ad9509ee8cad3c5c0f5dd48edbe94c1158b60f79ed3"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"06b05a8e4dd69bdc4f333ad9509ee8cad3c5c0f5dd48edbe94c1158b60f79ed3\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:36:43.267Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-embedding-simulated-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-embedding-simulated-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-02T21:18:26Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:18:26Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:34:10Z"}],"name":"105cf4dd91a8abf4a93abd65b255521c3d37b560b5d23f3ec59757b5b362fae6","namespace":"kuadrant-system","resourceVersion":"47655","uid":"e721320b-b0dd-48bb-9d6b-9a3cf2c2dc7a"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["105cf4dd91a8abf4a93abd65b255521c3d37b560b5d23f3ec59757b5b362fae6"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:19:19Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:19:19Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["105cf4dd91a8abf4a93abd65b255521c3d37b560b5d23f3ec59757b5b362fae6"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"105cf4dd91a8abf4a93abd65b255521c3d37b560b5d23f3ec59757b5b362fae6\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:36:43.329Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-02T21:18:38Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:18:38Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:34:12Z"}],"name":"92917da87eaba4f2684cd45947a3698434b99ff4ca6d3ddde51d6573aecb1600","namespace":"kuadrant-system","resourceVersion":"47712","uid":"f089c98c-5867-4541-b602-9c8b8b3f94b4"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["92917da87eaba4f2684cd45947a3698434b99ff4ca6d3ddde51d6573aecb1600"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:18:39Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:18:39Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["92917da87eaba4f2684cd45947a3698434b99ff4ca6d3ddde51d6573aecb1600"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"92917da87eaba4f2684cd45947a3698434b99ff4ca6d3ddde51d6573aecb1600\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:36:43.392Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-02T21:18:21Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:18:21Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:34:17Z"}],"name":"028a8b5bd5d4e690eebb2f20c5fd47cf0b3c6e2a3619ba9e55322bbca7b94cc3","namespace":"kuadrant-system","resourceVersion":"47961","uid":"9dc62010-cc65-401d-a4ad-ffc9902aab1a"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["028a8b5bd5d4e690eebb2f20c5fd47cf0b3c6e2a3619ba9e55322bbca7b94cc3"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:18:21Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:18:21Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["028a8b5bd5d4e690eebb2f20c5fd47cf0b3c6e2a3619ba9e55322bbca7b94cc3"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"028a8b5bd5d4e690eebb2f20c5fd47cf0b3c6e2a3619ba9e55322bbca7b94cc3\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:36:43.454Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-02T21:18:48Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:18:48Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:34:16Z"}],"name":"f9b535aed6243496a67741936e53a0d303bea1b872a06fb62f1f9c27150edc40","namespace":"kuadrant-system","resourceVersion":"47928","uid":"11fbb3b6-813e-42ac-8b1e-a16e089db4f5"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f9b535aed6243496a67741936e53a0d303bea1b872a06fb62f1f9c27150edc40"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:18:48Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:18:48Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["f9b535aed6243496a67741936e53a0d303bea1b872a06fb62f1f9c27150edc40"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"f9b535aed6243496a67741936e53a0d303bea1b872a06fb62f1f9c27150edc40\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:36:43.516Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-02T21:18:31Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:18:31Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:34:14Z"}],"name":"c82a1a3dc2ce54c0b664f79a2cd895a3c40f774b3694999badae8cedd328292e","namespace":"kuadrant-system","resourceVersion":"47807","uid":"c7a1b1d3-cccd-4fb1-8b6f-709e5202e78a"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["c82a1a3dc2ce54c0b664f79a2cd895a3c40f774b3694999badae8cedd328292e"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:18:31Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:18:31Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["c82a1a3dc2ce54c0b664f79a2cd895a3c40f774b3694999badae8cedd328292e"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"c82a1a3dc2ce54c0b664f79a2cd895a3c40f774b3694999badae8cedd328292e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:36:43.578Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-02T21:18:21Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:18:21Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:34:13Z"}],"name":"c4399a95e89654e5b2bb5fabe45bc947d11ccd1448ebf64c30b195b34f239d58","namespace":"kuadrant-system","resourceVersion":"47794","uid":"00dd952d-c2f0-4d46-ae0d-3a90b1246f0f"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["c4399a95e89654e5b2bb5fabe45bc947d11ccd1448ebf64c30b195b34f239d58"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:18:21Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:18:21Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["c4399a95e89654e5b2bb5fabe45bc947d11ccd1448ebf64c30b195b34f239d58"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"c4399a95e89654e5b2bb5fabe45bc947d11ccd1448ebf64c30b195b34f239d58\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:36:43.641Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-2-simulated-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-2-simulated-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-02T21:18:17Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:18:17Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:34:11Z"}],"name":"fac07f302f653115fda3d376325a268abaf66025ed0e4af73e88bea3f41fe933","namespace":"kuadrant-system","resourceVersion":"47707","uid":"fb8da4ca-ef70-459f-9cee-d8db6b6c7404"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["fac07f302f653115fda3d376325a268abaf66025ed0e4af73e88bea3f41fe933"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:18:17Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:18:17Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["fac07f302f653115fda3d376325a268abaf66025ed0e4af73e88bea3f41fe933"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"fac07f302f653115fda3d376325a268abaf66025ed0e4af73e88bea3f41fe933\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:36:43.704Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-02T21:18:39Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:18:39Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:34:16Z"}],"name":"94ddc5e77f082c32bebc7a36bcebf621518ebf303e83b9c540da1352d04e620b","namespace":"kuadrant-system","resourceVersion":"47936","uid":"a58039fc-701c-47fe-b574-32560eabeba1"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["94ddc5e77f082c32bebc7a36bcebf621518ebf303e83b9c540da1352d04e620b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:18:39Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:18:39Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["94ddc5e77f082c32bebc7a36bcebf621518ebf303e83b9c540da1352d04e620b"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"94ddc5e77f082c32bebc7a36bcebf621518ebf303e83b9c540da1352d04e620b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:36:43.766Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-02T21:18:39Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:18:39Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:34:14Z"}],"name":"cc1ffc2ee4e05618c28c108cac668c0c02eb8e658953439e47a733edab44a1a0","namespace":"kuadrant-system","resourceVersion":"47805","uid":"4dbe387c-9a2c-477c-8e7b-adf4e1e2c366"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["cc1ffc2ee4e05618c28c108cac668c0c02eb8e658953439e47a733edab44a1a0"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:18:39Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:18:39Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["cc1ffc2ee4e05618c28c108cac668c0c02eb8e658953439e47a733edab44a1a0"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"cc1ffc2ee4e05618c28c108cac668c0c02eb8e658953439e47a733edab44a1a0\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:36:43.828Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-02T21:18:21Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:18:21Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:34:11Z"}],"name":"d1d232e06f90d479cd9b802f24889e83af58c51cf54ba273d5e24dcb8a297688","namespace":"kuadrant-system","resourceVersion":"47682","uid":"58700c89-42ff-439b-b31f-db7a33d76650"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d1d232e06f90d479cd9b802f24889e83af58c51cf54ba273d5e24dcb8a297688"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:18:21Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:18:21Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["d1d232e06f90d479cd9b802f24889e83af58c51cf54ba273d5e24dcb8a297688"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"d1d232e06f90d479cd9b802f24889e83af58c51cf54ba273d5e24dcb8a297688\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:36:43.891Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-02T21:18:39Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:18:39Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:34:14Z"}],"name":"a8c8220ad6f1387002e262ace5db78a2c4bb39e5953306702a228215174f6796","namespace":"kuadrant-system","resourceVersion":"47837","uid":"7c5acab6-424a-4637-b109-0053b2a76119"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a8c8220ad6f1387002e262ace5db78a2c4bb39e5953306702a228215174f6796"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:19:17Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:19:17Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["a8c8220ad6f1387002e262ace5db78a2c4bb39e5953306702a228215174f6796"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a8c8220ad6f1387002e262ace5db78a2c4bb39e5953306702a228215174f6796\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:36:43.955Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-02T21:18:48Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:18:48Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:34:16Z"}],"name":"75612d85af2bae456dadd78163b2d2f9015c0a0bf4e20bcb8a555e6a5ab3b8c0","namespace":"kuadrant-system","resourceVersion":"47897","uid":"f4654ece-9841-4e26-a8a9-f3ec6fdc7a00"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["75612d85af2bae456dadd78163b2d2f9015c0a0bf4e20bcb8a555e6a5ab3b8c0"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:18:48Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:18:48Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["75612d85af2bae456dadd78163b2d2f9015c0a0bf4e20bcb8a555e6a5ab3b8c0"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"75612d85af2bae456dadd78163b2d2f9015c0a0bf4e20bcb8a555e6a5ab3b8c0\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:36:44.016Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-02T21:18:21Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:18:21Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:34:10Z"}],"name":"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668","namespace":"kuadrant-system","resourceVersion":"47645","uid":"1ea3e25e-e6b5-4d08-a5f2-d4913a2e97a5"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:19:19Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:19:19Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:36:44.078Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-02T21:18:40Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:18:40Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:34:16Z"}],"name":"3f23315aacd6e16f4ab41f96aeedc9549d1abdfc9476577a47d45d12875dec5a","namespace":"kuadrant-system","resourceVersion":"47907","uid":"f5e32c57-1a0d-435d-92aa-0ee98e8baeba"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["3f23315aacd6e16f4ab41f96aeedc9549d1abdfc9476577a47d45d12875dec5a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:18:40Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:18:40Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["3f23315aacd6e16f4ab41f96aeedc9549d1abdfc9476577a47d45d12875dec5a"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"3f23315aacd6e16f4ab41f96aeedc9549d1abdfc9476577a47d45d12875dec5a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:36:44.140Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-02T21:18:31Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:18:31Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:34:15Z"}],"name":"135ffad9bbcd33779a0b9a1c0dc5d5f547356be21489762803640aca855c728a","namespace":"kuadrant-system","resourceVersion":"47874","uid":"c3780164-c9ad-4e6a-b0c2-52b22bced4f7"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["135ffad9bbcd33779a0b9a1c0dc5d5f547356be21489762803640aca855c728a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:19:19Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:19:19Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["135ffad9bbcd33779a0b9a1c0dc5d5f547356be21489762803640aca855c728a"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"135ffad9bbcd33779a0b9a1c0dc5d5f547356be21489762803640aca855c728a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:36:44.203Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-02T21:18:39Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:18:39Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:34:17Z"}],"name":"54eea38241838159e47386cb814ad20fc30631ee8c42d57f0ff8da80fbbf62a0","namespace":"kuadrant-system","resourceVersion":"47949","uid":"d9223dea-d924-4405-9e2c-4f57e5726de8"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["54eea38241838159e47386cb814ad20fc30631ee8c42d57f0ff8da80fbbf62a0"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:18:39Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:18:39Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["54eea38241838159e47386cb814ad20fc30631ee8c42d57f0ff8da80fbbf62a0"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"54eea38241838159e47386cb814ad20fc30631ee8c42d57f0ff8da80fbbf62a0\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:36:44.266Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-embedding-simulated-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-embedding-simulated-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-02T21:18:26Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:18:26Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:34:16Z"}],"name":"2d4a2275e6cbab5c26d5c3cf2d75aa2776066390e5b66f5498b16b26bc596af7","namespace":"kuadrant-system","resourceVersion":"47934","uid":"c3ac65e6-4145-4da0-b26f-278381d5074b"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["2d4a2275e6cbab5c26d5c3cf2d75aa2776066390e5b66f5498b16b26bc596af7"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:18:27Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:18:27Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["2d4a2275e6cbab5c26d5c3cf2d75aa2776066390e5b66f5498b16b26bc596af7"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"2d4a2275e6cbab5c26d5c3cf2d75aa2776066390e5b66f5498b16b26bc596af7\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:36:44.328Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-embedding-simulated-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-embedding-simulated-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-02T21:18:27Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:18:27Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:34:11Z"}],"name":"ad8714d3b8aed2a9ffd68fbcf0288557e9c1c059c1b59ad3e9a09910b37fd61b","namespace":"kuadrant-system","resourceVersion":"47687","uid":"67233c6f-12ee-408b-9d10-e95973c9e911"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["ad8714d3b8aed2a9ffd68fbcf0288557e9c1c059c1b59ad3e9a09910b37fd61b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:18:28Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:18:28Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["ad8714d3b8aed2a9ffd68fbcf0288557e9c1c059c1b59ad3e9a09910b37fd61b"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"ad8714d3b8aed2a9ffd68fbcf0288557e9c1c059c1b59ad3e9a09910b37fd61b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:36:44.390Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-02T21:18:21Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:18:21Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:34:13Z"}],"name":"2f53b030326b8e1f5908c601aecd3fffcb6d08a8337d0bdc53ee1fc699a4cd71","namespace":"kuadrant-system","resourceVersion":"47801","uid":"3aaf392c-3146-4f82-b8e9-519ccf02d326"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["2f53b030326b8e1f5908c601aecd3fffcb6d08a8337d0bdc53ee1fc699a4cd71"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:18:21Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:18:21Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["2f53b030326b8e1f5908c601aecd3fffcb6d08a8337d0bdc53ee1fc699a4cd71"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"2f53b030326b8e1f5908c601aecd3fffcb6d08a8337d0bdc53ee1fc699a4cd71\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:36:44.452Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-02T21:18:39Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:18:39Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:34:12Z"}],"name":"ce7d381faee9ff949d68d825ffa1dcb9247dad19667ec59a8e91847320dacbe0","namespace":"kuadrant-system","resourceVersion":"47715","uid":"3282c010-eba7-4069-b458-e4a81b773586"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["ce7d381faee9ff949d68d825ffa1dcb9247dad19667ec59a8e91847320dacbe0"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:19:19Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:19:19Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["ce7d381faee9ff949d68d825ffa1dcb9247dad19667ec59a8e91847320dacbe0"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"ce7d381faee9ff949d68d825ffa1dcb9247dad19667ec59a8e91847320dacbe0\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:36:44.514Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-02T21:18:31Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:18:31Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:34:15Z"}],"name":"726a74c13fee356e859d9317271facbb60b066acbc5571de22d056f13c60878f","namespace":"kuadrant-system","resourceVersion":"47855","uid":"d0b642c8-7a95-495a-b0d2-9191c7bbc9eb"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["726a74c13fee356e859d9317271facbb60b066acbc5571de22d056f13c60878f"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:19:18Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:19:18Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["726a74c13fee356e859d9317271facbb60b066acbc5571de22d056f13c60878f"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"726a74c13fee356e859d9317271facbb60b066acbc5571de22d056f13c60878f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:36:44.580Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route#rule-1"},"creationTimestamp":"2026-11-02T21:16:03Z","generation":3,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:18:16Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:34:17Z"}],"name":"a7740f6e77d024a437502c023fb1d8939cb3cc2b9ed7f4073af7d779e19459eb","namespace":"kuadrant-system","resourceVersion":"47946","uid":"b27e2780-f07b-43fa-84a9-edcc72049032"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a7740f6e77d024a437502c023fb1d8939cb3cc2b9ed7f4073af7d779e19459eb"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:18:16Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:18:16Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["a7740f6e77d024a437502c023fb1d8939cb3cc2b9ed7f4073af7d779e19459eb"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a7740f6e77d024a437502c023fb1d8939cb3cc2b9ed7f4073af7d779e19459eb\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:36:44.643Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-02T21:18:49Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:18:49Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:34:11Z"}],"name":"f6df6bc14432fdc346191db86ee06e75c8090ed87a32c984493c837e97a10be6","namespace":"kuadrant-system","resourceVersion":"47679","uid":"d71ee8ab-248f-46ed-a17b-96ad3cd4cee8"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f6df6bc14432fdc346191db86ee06e75c8090ed87a32c984493c837e97a10be6"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:34:11Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:34:11Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["f6df6bc14432fdc346191db86ee06e75c8090ed87a32c984493c837e97a10be6"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"f6df6bc14432fdc346191db86ee06e75c8090ed87a32c984493c837e97a10be6\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:36:44.707Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-2-simulated-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-2-simulated-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-02T21:18:16Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:18:16Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:34:17Z"}],"name":"669658556fba0f45c2a82def2f57614416614ddf154ed8dc5f4f9188f10130f2","namespace":"kuadrant-system","resourceVersion":"47968","uid":"51e387c8-3ff5-4593-8714-ca56441125ed"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["669658556fba0f45c2a82def2f57614416614ddf154ed8dc5f4f9188f10130f2"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:18:17Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:18:17Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["669658556fba0f45c2a82def2f57614416614ddf154ed8dc5f4f9188f10130f2"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"669658556fba0f45c2a82def2f57614416614ddf154ed8dc5f4f9188f10130f2\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:36:44.770Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-02T21:18:49Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:18:49Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:34:17Z"}],"name":"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0","namespace":"kuadrant-system","resourceVersion":"47965","uid":"8c9443c9-f182-4677-85bf-323ad47fe3c9"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:19:19Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:19:19Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:36:44.835Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-02T21:18:39Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:18:39Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:34:17Z"}],"name":"a6a6232fd5656520e75d100c41add5f1637dde9705a4ec608bbb90b724c258a5","namespace":"kuadrant-system","resourceVersion":"47970","uid":"f1cd9b56-4a31-4ce1-b740-613be7e0159c"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a6a6232fd5656520e75d100c41add5f1637dde9705a4ec608bbb90b724c258a5"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:18:39Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:18:39Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["a6a6232fd5656520e75d100c41add5f1637dde9705a4ec608bbb90b724c258a5"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a6a6232fd5656520e75d100c41add5f1637dde9705a4ec608bbb90b724c258a5\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:36:44.897Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-2-simulated-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-2-simulated-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-02T21:18:16Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:18:16Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:34:17Z"}],"name":"67c67ce733de50e7b3d797bb248036b01badfe02e958f5f76af05b58a504989c","namespace":"kuadrant-system","resourceVersion":"47964","uid":"e420c302-9915-4089-bfe2-7a898cce5fa1"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["67c67ce733de50e7b3d797bb248036b01badfe02e958f5f76af05b58a504989c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:18:16Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:18:16Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["67c67ce733de50e7b3d797bb248036b01badfe02e958f5f76af05b58a504989c"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"67c67ce733de50e7b3d797bb248036b01badfe02e958f5f76af05b58a504989c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:36:44.960Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-02T21:18:21Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:18:21Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:34:14Z"}],"name":"4d18a96899c43d55ee63d2ae1a7a938c7e873d88b2fd95f06b2e3aae2c7f1c84","namespace":"kuadrant-system","resourceVersion":"47833","uid":"14a6542f-adae-4641-b133-a36e1c22c289"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["4d18a96899c43d55ee63d2ae1a7a938c7e873d88b2fd95f06b2e3aae2c7f1c84"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:18:21Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:18:21Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["4d18a96899c43d55ee63d2ae1a7a938c7e873d88b2fd95f06b2e3aae2c7f1c84"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"4d18a96899c43d55ee63d2ae1a7a938c7e873d88b2fd95f06b2e3aae2c7f1c84\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:36:45.022Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-02T21:18:49Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:18:49Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:34:13Z"}],"name":"f95805f0e9b755664735d898c1d644d571943be553204d3f86136bc35719ff13","namespace":"kuadrant-system","resourceVersion":"47787","uid":"25d13ab5-6706-4293-baf5-d681d17b9688"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f95805f0e9b755664735d898c1d644d571943be553204d3f86136bc35719ff13"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:34:13Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:34:13Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["f95805f0e9b755664735d898c1d644d571943be553204d3f86136bc35719ff13"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"f95805f0e9b755664735d898c1d644d571943be553204d3f86136bc35719ff13\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:36:45.088Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-02T21:18:48Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:18:48Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:34:17Z"}],"name":"99606c4eac496429be47144db9f3f48867815df12eb99d7be8073b767d7e44de","namespace":"kuadrant-system","resourceVersion":"47957","uid":"d6cb47d1-1dc7-42b6-8504-7d432068f40a"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["99606c4eac496429be47144db9f3f48867815df12eb99d7be8073b767d7e44de"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:34:17Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:34:17Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["99606c4eac496429be47144db9f3f48867815df12eb99d7be8073b767d7e44de"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"99606c4eac496429be47144db9f3f48867815df12eb99d7be8073b767d7e44de\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:36:45.155Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-02T21:18:21Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:18:21Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:34:12Z"}],"name":"8d5571efc1d304f5bcfc2ffb4ac6819154ba5556c29ce33416d460b887427984","namespace":"kuadrant-system","resourceVersion":"47764","uid":"3149db6f-9137-40bb-ac0a-71328c3f9cee"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["8d5571efc1d304f5bcfc2ffb4ac6819154ba5556c29ce33416d460b887427984"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:18:22Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:18:22Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["8d5571efc1d304f5bcfc2ffb4ac6819154ba5556c29ce33416d460b887427984"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"8d5571efc1d304f5bcfc2ffb4ac6819154ba5556c29ce33416d460b887427984\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:36:45.279Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-02T21:18:21Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:18:21Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:34:12Z"}],"name":"2ddbced6f2f51d410743da1d9db1257d0006d99f38986dd7cc7efd26620791ad","namespace":"kuadrant-system","resourceVersion":"47741","uid":"cd4dbfde-d07e-4a14-91a9-0670da25429a"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["2ddbced6f2f51d410743da1d9db1257d0006d99f38986dd7cc7efd26620791ad"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:19:18Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:19:18Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["2ddbced6f2f51d410743da1d9db1257d0006d99f38986dd7cc7efd26620791ad"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"2ddbced6f2f51d410743da1d9db1257d0006d99f38986dd7cc7efd26620791ad\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:36:45.343Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-02T21:18:40Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:18:40Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:34:12Z"}],"name":"d752a44ad8df3a50b5a1147110eb89039ed764e1fed197b1f77e0935c424a90b","namespace":"kuadrant-system","resourceVersion":"47751","uid":"ae9a13fe-d5e8-4fc6-b4ac-3d2d16f6c78b"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d752a44ad8df3a50b5a1147110eb89039ed764e1fed197b1f77e0935c424a90b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:18:40Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:18:40Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["d752a44ad8df3a50b5a1147110eb89039ed764e1fed197b1f77e0935c424a90b"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"d752a44ad8df3a50b5a1147110eb89039ed764e1fed197b1f77e0935c424a90b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:36:45.407Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-02T21:18:31Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:18:31Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:34:15Z"}],"name":"7c924aa2b37ea38067b4e69052d541ea2e7c86fbdaa79b19f9ea09e87adbe4ff","namespace":"kuadrant-system","resourceVersion":"47877","uid":"70f5f392-3df1-43dd-b512-1367e63f2541"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["7c924aa2b37ea38067b4e69052d541ea2e7c86fbdaa79b19f9ea09e87adbe4ff"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:19:18Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:19:18Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["7c924aa2b37ea38067b4e69052d541ea2e7c86fbdaa79b19f9ea09e87adbe4ff"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"7c924aa2b37ea38067b4e69052d541ea2e7c86fbdaa79b19f9ea09e87adbe4ff\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:36:45.470Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-02T21:18:48Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:18:48Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:34:12Z"}],"name":"e91aceffc2d4f6d6b120625bd3ca23781b74a1cae6cf1da26bda310bbed0ef07","namespace":"kuadrant-system","resourceVersion":"47717","uid":"65d58591-7795-4c35-af85-1b2c814c21e7"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["e91aceffc2d4f6d6b120625bd3ca23781b74a1cae6cf1da26bda310bbed0ef07"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:18:48Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:18:48Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["e91aceffc2d4f6d6b120625bd3ca23781b74a1cae6cf1da26bda310bbed0ef07"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"e91aceffc2d4f6d6b120625bd3ca23781b74a1cae6cf1da26bda310bbed0ef07\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:36:45.534Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-embedding-simulated-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-embedding-simulated-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-02T21:18:27Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:18:27Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:34:10Z"}],"name":"5d590119308c6f848b12dd3ecdfb1b06cc2fe172af702455c342075944a045ff","namespace":"kuadrant-system","resourceVersion":"47638","uid":"7dfcd152-bda8-4fc5-bf20-c55f443cef33"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["5d590119308c6f848b12dd3ecdfb1b06cc2fe172af702455c342075944a045ff"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:19:19Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:19:19Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["5d590119308c6f848b12dd3ecdfb1b06cc2fe172af702455c342075944a045ff"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"5d590119308c6f848b12dd3ecdfb1b06cc2fe172af702455c342075944a045ff\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:36:45.598Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-02T21:18:48Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:18:48Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:34:15Z"}],"name":"8d8c8aae1332bb0300ac2d65be9b8708fbfde6d4b5599ec52380cf1f70956045","namespace":"kuadrant-system","resourceVersion":"47882","uid":"0c073bfe-3acf-43c3-938f-7f8117dea42f"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["8d8c8aae1332bb0300ac2d65be9b8708fbfde6d4b5599ec52380cf1f70956045"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:18:49Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:18:49Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["8d8c8aae1332bb0300ac2d65be9b8708fbfde6d4b5599ec52380cf1f70956045"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"8d8c8aae1332bb0300ac2d65be9b8708fbfde6d4b5599ec52380cf1f70956045\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:36:45.665Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-02T21:18:48Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:18:48Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:34:16Z"}],"name":"a4493fc88328eba553ef36791fbf4706bffae04a1ac501d099b12309ebc85c6b","namespace":"kuadrant-system","resourceVersion":"47920","uid":"58f8e417-4e4e-42bc-a88d-38b8b56a4c80"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a4493fc88328eba553ef36791fbf4706bffae04a1ac501d099b12309ebc85c6b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:19:18Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:19:18Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["a4493fc88328eba553ef36791fbf4706bffae04a1ac501d099b12309ebc85c6b"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a4493fc88328eba553ef36791fbf4706bffae04a1ac501d099b12309ebc85c6b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:36:45.733Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-embedding-simulated-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-embedding-simulated-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-02T21:18:26Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:18:26Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:34:10Z"}],"name":"f9fa9cfc2b4e701183573419a92c79384cd30210289602f0115c75c5029d55aa","namespace":"kuadrant-system","resourceVersion":"47635","uid":"34368a78-ce64-4c38-a3d7-caaf25e6b83b"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f9fa9cfc2b4e701183573419a92c79384cd30210289602f0115c75c5029d55aa"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:18:27Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:18:27Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["f9fa9cfc2b4e701183573419a92c79384cd30210289602f0115c75c5029d55aa"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"f9fa9cfc2b4e701183573419a92c79384cd30210289602f0115c75c5029d55aa\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:36:45.795Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-02T21:18:49Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:18:49Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:34:16Z"}],"name":"2d953f7313807988e63546aa32431d96f77e6989c672f8ab42827c1c21918630","namespace":"kuadrant-system","resourceVersion":"47923","uid":"b738046d-ab13-49cc-aed5-7c740b8a58fd"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["2d953f7313807988e63546aa32431d96f77e6989c672f8ab42827c1c21918630"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:19:20Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:19:20Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["2d953f7313807988e63546aa32431d96f77e6989c672f8ab42827c1c21918630"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"2d953f7313807988e63546aa32431d96f77e6989c672f8ab42827c1c21918630\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:36:45.861Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-02T21:18:39Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:18:39Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:34:15Z"}],"name":"8d34bd12ba2030284fcb69127f53b8158bbdd4a1432bfe619165b4c2c96cc061","namespace":"kuadrant-system","resourceVersion":"47890","uid":"972c5e7d-6947-4552-85a1-5a6c0ed21173"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["8d34bd12ba2030284fcb69127f53b8158bbdd4a1432bfe619165b4c2c96cc061"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:19:18Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:19:18Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["8d34bd12ba2030284fcb69127f53b8158bbdd4a1432bfe619165b4c2c96cc061"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"8d34bd12ba2030284fcb69127f53b8158bbdd4a1432bfe619165b4c2c96cc061\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:36:45.924Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-02T21:18:31Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:18:31Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:34:13Z"}],"name":"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec","namespace":"kuadrant-system","resourceVersion":"47800","uid":"b970691b-aeab-4ab1-8c26-716a1d192d99"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:34:13Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:34:13Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:36:45.990Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-embedding-simulated-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-embedding-simulated-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-02T21:18:27Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:18:27Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:34:16Z"}],"name":"bfd36c5ed73eb81df97258ffa1aa36d8cbf6f3e7a8096c33ca4ff417be59d002","namespace":"kuadrant-system","resourceVersion":"47938","uid":"33d0d859-f2a7-4b2b-a6fb-da332a727697"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["bfd36c5ed73eb81df97258ffa1aa36d8cbf6f3e7a8096c33ca4ff417be59d002"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:18:27Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:18:27Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["bfd36c5ed73eb81df97258ffa1aa36d8cbf6f3e7a8096c33ca4ff417be59d002"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"bfd36c5ed73eb81df97258ffa1aa36d8cbf6f3e7a8096c33ca4ff417be59d002\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:36:46.054Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-embedding-simulated-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-embedding-simulated-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-02T21:18:26Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:18:26Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:34:17Z"}],"name":"80056c658070f49140955cb6eabdbd252857a614af6b0f2f2de7a1ab1cd47949","namespace":"kuadrant-system","resourceVersion":"47944","uid":"c5c390bf-e2ba-4432-9294-bc1e1d24c250"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["80056c658070f49140955cb6eabdbd252857a614af6b0f2f2de7a1ab1cd47949"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:19:19Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:19:19Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["80056c658070f49140955cb6eabdbd252857a614af6b0f2f2de7a1ab1cd47949"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"80056c658070f49140955cb6eabdbd252857a614af6b0f2f2de7a1ab1cd47949\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:36:46.117Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route#rule-6"},"creationTimestamp":"2026-11-02T21:16:03Z","generation":3,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:18:17Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:34:12Z"}],"name":"7def4ca304ff3869be64c2c02523fd9d2ff43465099dcd1124399f293eb4480f","namespace":"kuadrant-system","resourceVersion":"47748","uid":"a4896849-289b-4300-9ee8-e13530534d2a"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["7def4ca304ff3869be64c2c02523fd9d2ff43465099dcd1124399f293eb4480f"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:19:18Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:19:18Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["7def4ca304ff3869be64c2c02523fd9d2ff43465099dcd1124399f293eb4480f"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"7def4ca304ff3869be64c2c02523fd9d2ff43465099dcd1124399f293eb4480f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:36:46.182Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-02T21:18:31Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:18:31Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:34:14Z"}],"name":"0e042276580ed8976d8ad3afd87a71640025c28b9b48f5c88eb159ec9998209f","namespace":"kuadrant-system","resourceVersion":"47816","uid":"107c286d-68a8-4f57-846f-aa2ab62e698d"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["0e042276580ed8976d8ad3afd87a71640025c28b9b48f5c88eb159ec9998209f"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:18:31Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:18:31Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["0e042276580ed8976d8ad3afd87a71640025c28b9b48f5c88eb159ec9998209f"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"0e042276580ed8976d8ad3afd87a71640025c28b9b48f5c88eb159ec9998209f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:36:46.248Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-02T21:18:38Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:18:38Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:34:14Z"}],"name":"486615827938fa99814e929fe7dc62bc16f7563179fef855074eb73dc7ce4724","namespace":"kuadrant-system","resourceVersion":"47823","uid":"214125ca-42ba-4094-b605-6ce561e537ca"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["486615827938fa99814e929fe7dc62bc16f7563179fef855074eb73dc7ce4724"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:18:39Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:18:39Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["486615827938fa99814e929fe7dc62bc16f7563179fef855074eb73dc7ce4724"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"486615827938fa99814e929fe7dc62bc16f7563179fef855074eb73dc7ce4724\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:36:46.315Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-02T21:18:39Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:18:39Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:34:12Z"}],"name":"3386c5e86c72abcdab369776ccd7182024ab8681cbe497e81724868f101a3c0c","namespace":"kuadrant-system","resourceVersion":"47755","uid":"f21d9629-8bf6-47f9-85be-817ee7208229"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["3386c5e86c72abcdab369776ccd7182024ab8681cbe497e81724868f101a3c0c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:18:40Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:18:40Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["3386c5e86c72abcdab369776ccd7182024ab8681cbe497e81724868f101a3c0c"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"3386c5e86c72abcdab369776ccd7182024ab8681cbe497e81724868f101a3c0c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:36:46.378Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-embedding-simulated-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-embedding-simulated-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-02T21:18:27Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:18:27Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:34:10Z"}],"name":"0020c64019ffd1a0bdcc75e6441e6a30e6d8bb08f463f67bd2408a1e82b95b2a","namespace":"kuadrant-system","resourceVersion":"47623","uid":"9c300a5f-b9bf-4a8d-9e83-93143f3748ed"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["0020c64019ffd1a0bdcc75e6441e6a30e6d8bb08f463f67bd2408a1e82b95b2a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:34:10Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:34:10Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["0020c64019ffd1a0bdcc75e6441e6a30e6d8bb08f463f67bd2408a1e82b95b2a"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"0020c64019ffd1a0bdcc75e6441e6a30e6d8bb08f463f67bd2408a1e82b95b2a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:36:46.442Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-02T21:18:39Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:18:39Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:34:16Z"}],"name":"c5a685f2a5ebdef5f1dee488990c0798a45ddce399cf99e7d0c505a5f46c69ac","namespace":"kuadrant-system","resourceVersion":"47906","uid":"dfe561d7-5924-4cb8-8b77-3e8dc714e323"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["c5a685f2a5ebdef5f1dee488990c0798a45ddce399cf99e7d0c505a5f46c69ac"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:19:18Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:19:18Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["c5a685f2a5ebdef5f1dee488990c0798a45ddce399cf99e7d0c505a5f46c69ac"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"c5a685f2a5ebdef5f1dee488990c0798a45ddce399cf99e7d0c505a5f46c69ac\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:36:46.505Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-2-simulated-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-2-simulated-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-02T21:18:16Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:18:16Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:34:13Z"}],"name":"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96","namespace":"kuadrant-system","resourceVersion":"47789","uid":"3bd7e588-b2c0-4f88-ad6c-92c4a4f5a345"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:18:16Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:18:16Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:36:46.568Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-02T21:18:49Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:18:49Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:34:11Z"}],"name":"0e89fc4b75d3a5dd95fca2c4d8ae33c7826f05a8016c44eb39e28c3c1860fcfb","namespace":"kuadrant-system","resourceVersion":"47701","uid":"fb6659c8-fd81-45b1-ae33-089f73dc2054"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["0e89fc4b75d3a5dd95fca2c4d8ae33c7826f05a8016c44eb39e28c3c1860fcfb"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:19:19Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:19:19Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["0e89fc4b75d3a5dd95fca2c4d8ae33c7826f05a8016c44eb39e28c3c1860fcfb"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"0e89fc4b75d3a5dd95fca2c4d8ae33c7826f05a8016c44eb39e28c3c1860fcfb\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:36:46.632Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-02T21:18:49Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:18:49Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:34:13Z"}],"name":"d69b9c128f599c9ea1af84bb3e783ed71688baf6b3ad2b86f2b7183f9a4208b9","namespace":"kuadrant-system","resourceVersion":"47796","uid":"13bee5e7-c8df-4c6f-a232-b3a081875254"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d69b9c128f599c9ea1af84bb3e783ed71688baf6b3ad2b86f2b7183f9a4208b9"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:34:13Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:34:13Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["d69b9c128f599c9ea1af84bb3e783ed71688baf6b3ad2b86f2b7183f9a4208b9"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"d69b9c128f599c9ea1af84bb3e783ed71688baf6b3ad2b86f2b7183f9a4208b9\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:36:46.694Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-02T21:18:48Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:18:48Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:34:11Z"}],"name":"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c","namespace":"kuadrant-system","resourceVersion":"47677","uid":"bc14a61f-9404-4823-8949-3cba93b62894"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:19:18Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:19:18Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:36:46.756Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-2-simulated-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-2-simulated-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-02T21:18:17Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:18:17Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:34:14Z"}],"name":"6687eb3cec74c6c51428ce3f3d22d50ba269f59015d1bc8f185da49eb095534e","namespace":"kuadrant-system","resourceVersion":"47847","uid":"3da539ac-ddf5-4993-bbec-cea1d8e0b607"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["6687eb3cec74c6c51428ce3f3d22d50ba269f59015d1bc8f185da49eb095534e"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:18:17Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:18:17Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["6687eb3cec74c6c51428ce3f3d22d50ba269f59015d1bc8f185da49eb095534e"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"6687eb3cec74c6c51428ce3f3d22d50ba269f59015d1bc8f185da49eb095534e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:36:46.818Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-2-simulated-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-2-simulated-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-02T21:18:16Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:18:16Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:34:14Z"}],"name":"98ec9d74d07c88c1e6923ed1cbafd4c5b41bf1763b3a942282f964f72425ae57","namespace":"kuadrant-system","resourceVersion":"47814","uid":"e4861f95-ed6a-4e9b-a90e-286b8b37cd64"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["98ec9d74d07c88c1e6923ed1cbafd4c5b41bf1763b3a942282f964f72425ae57"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:19:19Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:19:19Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["98ec9d74d07c88c1e6923ed1cbafd4c5b41bf1763b3a942282f964f72425ae57"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"98ec9d74d07c88c1e6923ed1cbafd4c5b41bf1763b3a942282f964f72425ae57\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:36:46.880Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-2-simulated-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-2-simulated-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-02T21:18:17Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:18:17Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:34:13Z"}],"name":"a908063c86927e6bf07b7d793aad9f277ac3c2a8f5f5d468b116cb9e07929b14","namespace":"kuadrant-system","resourceVersion":"47798","uid":"957a9438-ed77-444c-a333-1526b1b744d3"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a908063c86927e6bf07b7d793aad9f277ac3c2a8f5f5d468b116cb9e07929b14"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:19:17Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:19:17Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["a908063c86927e6bf07b7d793aad9f277ac3c2a8f5f5d468b116cb9e07929b14"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a908063c86927e6bf07b7d793aad9f277ac3c2a8f5f5d468b116cb9e07929b14\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:36:46.941Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-02T21:18:39Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:18:39Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:34:12Z"}],"name":"68502d1c1143a647ad56f2759ea89a4c5b3c74a8054739f7e7ea9ba6535e3b74","namespace":"kuadrant-system","resourceVersion":"47720","uid":"63709ab4-6be0-4e14-9268-69177159cc65"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["68502d1c1143a647ad56f2759ea89a4c5b3c74a8054739f7e7ea9ba6535e3b74"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:18:40Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:18:40Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["68502d1c1143a647ad56f2759ea89a4c5b3c74a8054739f7e7ea9ba6535e3b74"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"68502d1c1143a647ad56f2759ea89a4c5b3c74a8054739f7e7ea9ba6535e3b74\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:36:47.003Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-02T21:18:21Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:18:21Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:34:17Z"}],"name":"bf65ad13397c94660867eb0205e06d1c9bebda4b019f632c0d0b8ef989930381","namespace":"kuadrant-system","resourceVersion":"47954","uid":"93912093-eaa2-4499-99a2-d89aa4b8d80d"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["bf65ad13397c94660867eb0205e06d1c9bebda4b019f632c0d0b8ef989930381"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:18:21Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:18:21Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["bf65ad13397c94660867eb0205e06d1c9bebda4b019f632c0d0b8ef989930381"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"bf65ad13397c94660867eb0205e06d1c9bebda4b019f632c0d0b8ef989930381\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:36:47.066Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-02T21:18:39Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:18:39Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:34:15Z"}],"name":"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455","namespace":"kuadrant-system","resourceVersion":"47880","uid":"59609df0-6834-4465-9d51-ef3cc66016e4"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:19:17Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:19:17Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:36:47.128Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-embedding-simulated-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-embedding-simulated-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-02T21:18:26Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:18:26Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:34:11Z"}],"name":"810f299b76daf089b33c92cfbe0445ab5cc89a48d38e36df0cc89ed6cd1fe8df","namespace":"kuadrant-system","resourceVersion":"47691","uid":"dafc8b3f-2b7d-4454-82b8-a2a6d3d92763"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["810f299b76daf089b33c92cfbe0445ab5cc89a48d38e36df0cc89ed6cd1fe8df"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:18:27Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:18:27Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["810f299b76daf089b33c92cfbe0445ab5cc89a48d38e36df0cc89ed6cd1fe8df"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"810f299b76daf089b33c92cfbe0445ab5cc89a48d38e36df0cc89ed6cd1fe8df\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:36:47.190Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-02T21:18:48Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:18:48Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:34:15Z"}],"name":"06165835c4461c0b16a2bc5bae936aff3c2f351edbef8aa378f1110874acedfc","namespace":"kuadrant-system","resourceVersion":"47858","uid":"af7b4f34-b762-421c-8955-bf4dad876336"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["06165835c4461c0b16a2bc5bae936aff3c2f351edbef8aa378f1110874acedfc"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:19:19Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:19:19Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["06165835c4461c0b16a2bc5bae936aff3c2f351edbef8aa378f1110874acedfc"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"06165835c4461c0b16a2bc5bae936aff3c2f351edbef8aa378f1110874acedfc\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:36:47.251Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-embedding-simulated-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-embedding-simulated-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-02T21:18:27Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:18:27Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:34:14Z"}],"name":"eaeb360b41b3f9e0bd6b247d4dae3eef1ffc3355d6e9408df3f8f71bc7f033b5","namespace":"kuadrant-system","resourceVersion":"47844","uid":"81b7d841-b540-4e73-8c65-7c4e6612cbf9"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["eaeb360b41b3f9e0bd6b247d4dae3eef1ffc3355d6e9408df3f8f71bc7f033b5"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:18:27Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:18:27Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["eaeb360b41b3f9e0bd6b247d4dae3eef1ffc3355d6e9408df3f8f71bc7f033b5"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"eaeb360b41b3f9e0bd6b247d4dae3eef1ffc3355d6e9408df3f8f71bc7f033b5\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:36:47.314Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route#rule-4"},"creationTimestamp":"2026-11-02T21:16:03Z","generation":3,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:18:17Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:34:15Z"}],"name":"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e","namespace":"kuadrant-system","resourceVersion":"47894","uid":"92701ca2-3dfa-402d-8b2c-3e09ecb2ea11"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:19:19Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:19:19Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:36:47.377Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-02T21:18:38Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:18:38Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:34:10Z"}],"name":"6565c4085b3917d5390fe1b0194fb3d8319f1d56b45867e3c68ff740b5c16ef3","namespace":"kuadrant-system","resourceVersion":"47632","uid":"f82393c1-5f1c-4802-b1a2-9277da9f1c19"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["6565c4085b3917d5390fe1b0194fb3d8319f1d56b45867e3c68ff740b5c16ef3"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:18:38Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:18:38Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["6565c4085b3917d5390fe1b0194fb3d8319f1d56b45867e3c68ff740b5c16ef3"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"6565c4085b3917d5390fe1b0194fb3d8319f1d56b45867e3c68ff740b5c16ef3\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:36:47.441Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-02T21:18:48Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:18:48Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:34:15Z"}],"name":"134a7a790ba665547ca14f80f917549f66ee5063fc41096471c0778399db6dd5","namespace":"kuadrant-system","resourceVersion":"47892","uid":"1b27e6b9-ccc6-4e12-8a61-c671706271cd"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["134a7a790ba665547ca14f80f917549f66ee5063fc41096471c0778399db6dd5"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:34:15Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:34:15Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["134a7a790ba665547ca14f80f917549f66ee5063fc41096471c0778399db6dd5"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"134a7a790ba665547ca14f80f917549f66ee5063fc41096471c0778399db6dd5\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:36:47.506Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-02T21:18:39Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:18:39Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:34:17Z"}],"name":"0829dbf2b5dc0900de272826295adf351de381b46fa6fba00b896213530780f6","namespace":"kuadrant-system","resourceVersion":"47962","uid":"0b814b73-0e6c-457e-b018-77f53c7fc590"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["0829dbf2b5dc0900de272826295adf351de381b46fa6fba00b896213530780f6"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:19:18Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:19:18Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["0829dbf2b5dc0900de272826295adf351de381b46fa6fba00b896213530780f6"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"0829dbf2b5dc0900de272826295adf351de381b46fa6fba00b896213530780f6\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:36:47.570Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-embedding-simulated-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-embedding-simulated-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-02T21:18:27Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:18:27Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:34:10Z"}],"name":"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e","namespace":"kuadrant-system","resourceVersion":"47653","uid":"5c8c5582-a46f-48f1-bd3c-8ecdbc99ff42"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:19:17Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:19:17Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:36:47.632Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-02T21:18:38Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:18:38Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:34:12Z"}],"name":"5e4821ff903ad6ca2e1c42162432e34d8b0a2a78052961e753d36b742193432f","namespace":"kuadrant-system","resourceVersion":"47736","uid":"da957b52-9188-4192-a0f2-de72febcdd38"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["5e4821ff903ad6ca2e1c42162432e34d8b0a2a78052961e753d36b742193432f"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:19:19Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:19:19Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["5e4821ff903ad6ca2e1c42162432e34d8b0a2a78052961e753d36b742193432f"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"5e4821ff903ad6ca2e1c42162432e34d8b0a2a78052961e753d36b742193432f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:36:47.694Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-02T21:18:21Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:18:21Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:34:11Z"}],"name":"17002b7f0c8e62582ad262d9c2b8b038ee7f2a9327fe34f21fd4f47134b7b8cf","namespace":"kuadrant-system","resourceVersion":"47675","uid":"ca2e1742-8adc-44a1-8d25-bd844ad1bcab"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["17002b7f0c8e62582ad262d9c2b8b038ee7f2a9327fe34f21fd4f47134b7b8cf"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:19:18Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:19:18Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["17002b7f0c8e62582ad262d9c2b8b038ee7f2a9327fe34f21fd4f47134b7b8cf"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"17002b7f0c8e62582ad262d9c2b8b038ee7f2a9327fe34f21fd4f47134b7b8cf\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:36:47.756Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-2-simulated-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-2-simulated-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-02T21:18:17Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:18:17Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:34:10Z"}],"name":"a402d1681ab35bace735c19b1d084a86eb3d741d4e1c14371cfdaa55d22c3ebe","namespace":"kuadrant-system","resourceVersion":"47625","uid":"52b71f16-5b7b-4195-a89e-cd6a461067dc"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a402d1681ab35bace735c19b1d084a86eb3d741d4e1c14371cfdaa55d22c3ebe"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:19:17Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:19:17Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["a402d1681ab35bace735c19b1d084a86eb3d741d4e1c14371cfdaa55d22c3ebe"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a402d1681ab35bace735c19b1d084a86eb3d741d4e1c14371cfdaa55d22c3ebe\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:36:47.818Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-02T21:18:31Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:18:31Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:34:17Z"}],"name":"4f800155f293f82eeaf5fd6a9553c0a1bee90f47a295bba8d7a04b3f11faea33","namespace":"kuadrant-system","resourceVersion":"47960","uid":"2c4af3f9-f598-4a6c-a301-b71e2082acaa"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["4f800155f293f82eeaf5fd6a9553c0a1bee90f47a295bba8d7a04b3f11faea33"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:18:31Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:18:31Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["4f800155f293f82eeaf5fd6a9553c0a1bee90f47a295bba8d7a04b3f11faea33"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"4f800155f293f82eeaf5fd6a9553c0a1bee90f47a295bba8d7a04b3f11faea33\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:36:47.883Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-02T21:18:48Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:18:48Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:34:14Z"}],"name":"3083301b5359be118f04faaefcd72fd127f2297a3374ef7231b59a59a31b405c","namespace":"kuadrant-system","resourceVersion":"47850","uid":"5afbfc99-d75d-4a37-b31c-c7756d5bc7ac"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["3083301b5359be118f04faaefcd72fd127f2297a3374ef7231b59a59a31b405c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:19:19Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:19:19Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["3083301b5359be118f04faaefcd72fd127f2297a3374ef7231b59a59a31b405c"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"3083301b5359be118f04faaefcd72fd127f2297a3374ef7231b59a59a31b405c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:36:47.945Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-02T21:18:31Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:18:31Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:34:10Z"}],"name":"75fd86e2a4870af5fd78f2ad7aa2a9d79aff977b3678d81954b1e207a9315f2c","namespace":"kuadrant-system","resourceVersion":"47650","uid":"e083d534-231a-42e3-b214-9a8de2773576"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["75fd86e2a4870af5fd78f2ad7aa2a9d79aff977b3678d81954b1e207a9315f2c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:19:19Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:19:19Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["75fd86e2a4870af5fd78f2ad7aa2a9d79aff977b3678d81954b1e207a9315f2c"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"75fd86e2a4870af5fd78f2ad7aa2a9d79aff977b3678d81954b1e207a9315f2c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:36:48.007Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-02T21:18:38Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:18:38Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:34:17Z"}],"name":"e5f81c7f7812462ebef000c68dc043013159f22201d2eeecf05c220e809f96ed","namespace":"kuadrant-system","resourceVersion":"47967","uid":"817bb8d6-da9d-4dd2-bd9e-34b731410642"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["e5f81c7f7812462ebef000c68dc043013159f22201d2eeecf05c220e809f96ed"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:18:39Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:18:39Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["e5f81c7f7812462ebef000c68dc043013159f22201d2eeecf05c220e809f96ed"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"e5f81c7f7812462ebef000c68dc043013159f22201d2eeecf05c220e809f96ed\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:36:48.069Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-02T21:18:38Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:18:38Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:34:15Z"}],"name":"0913a452a02695c6681f1037232199b40b64236fed4d29cdbb41561695826340","namespace":"kuadrant-system","resourceVersion":"47887","uid":"233e732a-3129-4d24-a654-aa4a94b616ec"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["0913a452a02695c6681f1037232199b40b64236fed4d29cdbb41561695826340"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:19:18Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:19:18Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["0913a452a02695c6681f1037232199b40b64236fed4d29cdbb41561695826340"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"0913a452a02695c6681f1037232199b40b64236fed4d29cdbb41561695826340\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:36:48.133Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-02T21:18:49Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:18:49Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:34:10Z"}],"name":"de97dd5d45c6eb12b4a1112ed1f362d8544427428d2249a399e26ba069d6aadb","namespace":"kuadrant-system","resourceVersion":"47660","uid":"947a2dde-5efe-4b41-a559-c49149ecb7ff"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["de97dd5d45c6eb12b4a1112ed1f362d8544427428d2249a399e26ba069d6aadb"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:18:49Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:18:49Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["de97dd5d45c6eb12b4a1112ed1f362d8544427428d2249a399e26ba069d6aadb"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"de97dd5d45c6eb12b4a1112ed1f362d8544427428d2249a399e26ba069d6aadb\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:36:48.195Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-02T21:18:48Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:18:48Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:34:10Z"}],"name":"1e077a716d89a43572a3c16e8d0b0436816baa48a2ea227603701f10cad6d6f4","namespace":"kuadrant-system","resourceVersion":"47642","uid":"13421850-0cba-4578-882d-5e70335a29e6"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["1e077a716d89a43572a3c16e8d0b0436816baa48a2ea227603701f10cad6d6f4"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:18:48Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:18:48Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["1e077a716d89a43572a3c16e8d0b0436816baa48a2ea227603701f10cad6d6f4"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"1e077a716d89a43572a3c16e8d0b0436816baa48a2ea227603701f10cad6d6f4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:36:48.258Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-02T21:18:31Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:18:31Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:34:13Z"}],"name":"596921ddc7ba8523386263c5cffcbd6ad9b6a385318ed7e24f72be06f36fc398","namespace":"kuadrant-system","resourceVersion":"47803","uid":"e8225d03-0c84-4de9-b550-3d9f9f1ec089"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["596921ddc7ba8523386263c5cffcbd6ad9b6a385318ed7e24f72be06f36fc398"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:19:17Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:19:17Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["596921ddc7ba8523386263c5cffcbd6ad9b6a385318ed7e24f72be06f36fc398"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"596921ddc7ba8523386263c5cffcbd6ad9b6a385318ed7e24f72be06f36fc398\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:36:48.321Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-02T21:18:39Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:18:39Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:34:13Z"}],"name":"dc061bec60bd28b1c132bf30965b4810124429576337bcc4a6030617600d1714","namespace":"kuadrant-system","resourceVersion":"47792","uid":"5f74c226-33a3-4e04-adc3-a29cc8c718dd"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["dc061bec60bd28b1c132bf30965b4810124429576337bcc4a6030617600d1714"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:34:13Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:34:13Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["dc061bec60bd28b1c132bf30965b4810124429576337bcc4a6030617600d1714"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"dc061bec60bd28b1c132bf30965b4810124429576337bcc4a6030617600d1714\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:36:48.383Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-2-simulated-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-2-simulated-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-02T21:18:17Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:18:17Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:34:16Z"}],"name":"9e75e9fd02f51c2f043b145c5d6b82e95f1447b388ee529262aea27a6a2774ef","namespace":"kuadrant-system","resourceVersion":"47899","uid":"b93d340e-64c4-40b2-8396-2392e938aa5f"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["9e75e9fd02f51c2f043b145c5d6b82e95f1447b388ee529262aea27a6a2774ef"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:18:17Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:18:17Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["9e75e9fd02f51c2f043b145c5d6b82e95f1447b388ee529262aea27a6a2774ef"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"9e75e9fd02f51c2f043b145c5d6b82e95f1447b388ee529262aea27a6a2774ef\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:36:48.449Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-02T21:18:49Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:18:49Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:34:17Z"}],"name":"ab505bdf28287fe00099987c1bde2c2f297c40c792a7f6cb5fbfa5adc44754d3","namespace":"kuadrant-system","resourceVersion":"47942","uid":"08a412f0-c481-428d-b90b-d528efffcf47"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["ab505bdf28287fe00099987c1bde2c2f297c40c792a7f6cb5fbfa5adc44754d3"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:19:18Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:19:18Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["ab505bdf28287fe00099987c1bde2c2f297c40c792a7f6cb5fbfa5adc44754d3"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"ab505bdf28287fe00099987c1bde2c2f297c40c792a7f6cb5fbfa5adc44754d3\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:36:48.512Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-2-simulated-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-2-simulated-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-02T21:18:16Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:18:16Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:34:12Z"}],"name":"a91faccafad197e2a4065ce3d12a052ac484d2e8fb2fc9265ee48f02b28e6dce","namespace":"kuadrant-system","resourceVersion":"47732","uid":"4cc5ed8f-00de-4c7e-be3a-12c0a62618f8"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a91faccafad197e2a4065ce3d12a052ac484d2e8fb2fc9265ee48f02b28e6dce"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:18:16Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:18:16Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["a91faccafad197e2a4065ce3d12a052ac484d2e8fb2fc9265ee48f02b28e6dce"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a91faccafad197e2a4065ce3d12a052ac484d2e8fb2fc9265ee48f02b28e6dce\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:36:48.576Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-02T21:18:49Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:18:49Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:34:10Z"}],"name":"dd89509e97b96670685602ae2d08749226db8693944d2c6f868af9d3e0a5feb5","namespace":"kuadrant-system","resourceVersion":"47628","uid":"a26fa170-07c3-485e-a718-34a17e58d302"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["dd89509e97b96670685602ae2d08749226db8693944d2c6f868af9d3e0a5feb5"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:34:10Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:34:10Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["dd89509e97b96670685602ae2d08749226db8693944d2c6f868af9d3e0a5feb5"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"dd89509e97b96670685602ae2d08749226db8693944d2c6f868af9d3e0a5feb5\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:36:48.641Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-02T21:18:39Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:18:39Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:34:16Z"}],"name":"319e246831bdaf5e765e63d5511b516594fd2b64527850e2ddabd2a4a85532ea","namespace":"kuadrant-system","resourceVersion":"47913","uid":"f1da8ca3-152e-476b-a1bb-96a91bcea0e3"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["319e246831bdaf5e765e63d5511b516594fd2b64527850e2ddabd2a4a85532ea"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:18:40Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:18:40Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["319e246831bdaf5e765e63d5511b516594fd2b64527850e2ddabd2a4a85532ea"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"319e246831bdaf5e765e63d5511b516594fd2b64527850e2ddabd2a4a85532ea\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:36:48.698Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/a0e2a5a20b20758fb11fc6971890ab730da2be7e70d4d2b0565b932c28162203","error":"authconfigs.authorino.kuadrant.io \"a0e2a5a20b20758fb11fc6971890ab730da2be7e70d4d2b0565b932c28162203\" not found"}
{"level":"error","ts":"2026-11-02T21:36:48.753Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/65e2f41e0492d235319025a9eee631c3136e990f62350e68194dae99d6abf9bb","error":"authconfigs.authorino.kuadrant.io \"65e2f41e0492d235319025a9eee631c3136e990f62350e68194dae99d6abf9bb\" not found"}
{"level":"error","ts":"2026-11-02T21:36:48.807Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/4ab1fbe6391b1d89a8278686a76d16a41e95acbd110403f1ea225505889e8e81","error":"authconfigs.authorino.kuadrant.io \"4ab1fbe6391b1d89a8278686a76d16a41e95acbd110403f1ea225505889e8e81\" not found"}
{"level":"error","ts":"2026-11-02T21:36:48.862Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/87ed39693874a16861ddc73bd1bb9eda685d13b472210d75f0cca9747d27824b","error":"authconfigs.authorino.kuadrant.io \"87ed39693874a16861ddc73bd1bb9eda685d13b472210d75f0cca9747d27824b\" not found"}
{"level":"error","ts":"2026-11-02T21:36:48.917Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/7d2020bcb31505aed9ee28e7f3e3022b1d49395dd952574d8eafacc1a0d454a8","error":"authconfigs.authorino.kuadrant.io \"7d2020bcb31505aed9ee28e7f3e3022b1d49395dd952574d8eafacc1a0d454a8\" not found"}
{"level":"error","ts":"2026-11-02T21:36:48.971Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/09c48f3bbf61b81b6866a2870046460c73cab2328d9906274a40af3d4cbf5ebf","error":"authconfigs.authorino.kuadrant.io \"09c48f3bbf61b81b6866a2870046460c73cab2328d9906274a40af3d4cbf5ebf\" not found"}
{"level":"error","ts":"2026-11-02T21:36:49.182Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"maas-gateway-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"maas-gateway-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:36:49.242Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-api-b-bd96ef-maas-auth","namespace":"openshift-ingress","error":"authpolicies.kuadrant.io \"e2e-api-b-bd96ef-maas-auth\" not found"}
{"level":"error","ts":"2026-11-02T21:36:49.327Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-facebook-opt-125m-simulated","namespace":"llm","uid":"da8edb1a-ed61-454d-939f-fc7cd235d9fb","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-facebook-opt-125m-simulated\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:36:49.378Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-api-a-682116-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-api-a-682116-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:36:49.801Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-api-b-bd96ef","namespace":"openshift-ingress","uid":"ce255142-508f-4858-a8e2-ef850cc62752","error":"tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-api-b-bd96ef\" not found"}
{"level":"info","ts":"2026-11-02T21:36:50.157Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:36:50.157Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T21:36:50.217Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-mt-70efbbab","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-mt-70efbbab\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:36:50.334Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-api-b-6606aa","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-api-b-6606aa\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:36:50.578Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-api-b-bd96ef","error":"gateways.gateway.networking.k8s.io \"e2e-api-b-bd96ef\" not found"}
{"level":"error","ts":"2026-11-02T21:36:50.696Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-ipp-a-54e844","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-ipp-a-54e844\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:36:57.284Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","Gateway","HTTPRoute","AuthPolicy","TokenRateLimitPolicy","ConfigMap","Kuadrant","Limitador","EnvoyFilter"],"eventTypes":{"create":7,"delete":13,"update":111}}
{"level":"info","ts":"2026-11-02T21:36:57.499Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:36:57.546Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:36:59.363Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:36:59.857Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:36:59.948Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:37:00.058Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:37:00.058Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:37:02.745Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:37:02.748Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:37:02.758Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:37:02.762Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:37:02.770Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:37:02.770Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:37:02.923Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:37:06.273Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:37:06.273Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:37:14Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ipp-a-54e844","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-a-54e844","reconcileID":"60c86f96-ef70-4bc1-8c6e-dce4e362f954","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-ipp-a-54e844","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:37:15Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-a-54e844","event":"CREATE"}
{"level":"info","ts":"2026-11-02T21:37:15Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:37:15Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-02T21:37:15Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-02T21:37:15Z","logger":"telemetry-policy-extension-controller","msg":"Failed to update status: resource might just be outdated"}
{"level":"info","ts":"2026-11-02T21:37:15Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:37:15Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ipp-a-54e844","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-a-54e844","reconcileID":"6e2f425d-be2a-4a16-8535-e373bc54f21c","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-ipp-a-54e844","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:37:15Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-a-54e844","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T21:37:15Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:37:16Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-02T21:37:16Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-02T21:37:16Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:37:16Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ipp-a-54e844","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-a-54e844","reconcileID":"a7724185-0eb5-428c-9744-6f5ba1c0109c","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-ipp-a-54e844","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:37:16Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-a-54e844","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T21:37:16Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:37:16Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-02T21:37:16Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-02T21:37:16Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-02T21:37:16Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:37:17.349Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","Gateway","EnvoyFilter","AuthPolicy","HTTPRoute","Limitador","TokenRateLimitPolicy","ConfigMap"],"eventTypes":{"create":30,"delete":6,"update":12}}
{"level":"info","ts":"2026-11-02T21:37:17.551Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:37:19.961Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:37:20.125Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:37:20.125Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:37:24.074Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:37:24.082Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-02T21:37:24.082Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:37:24.074Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:37:24.086Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:37:24.086Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:37:24.086Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:37:26.514Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:37:26.514Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:37:27.803Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthPolicy","Kuadrant","HTTPRoute","Gateway"],"eventTypes":{"create":3,"update":2}}
{"level":"info","ts":"2026-11-02T21:37:27.999Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:37:28.020Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:37:30.442Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:37:30.643Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:37:30.643Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:37:30.648Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:37:30.823Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:37:34.425Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:37:34.443Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:37:34.444Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:37:34.454Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-02T21:37:34.454Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:37:34.461Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:37:34.461Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-02T21:37:34.570Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-ipp-a-54e844","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"kuadrant-auth-e2e-ipp-a-54e844","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-ipp-a-54e844","uid":"715412b4-5bc7-424f-a629-38760fca5559"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-auth-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local","port_value":50051}}}}]}]},"name":"kuadrant-auth-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-ipp-a-54e844"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-ipp-a-54e844\" already exists"}
{"level":"error","ts":"2026-11-02T21:37:34.577Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-54e844","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-54e844#rule-1"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"281b4de3d8a080a3c91b6babf36d294972f47bd01f1f21b44b97bf7c287cfdc5","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["281b4de3d8a080a3c91b6babf36d294972f47bd01f1f21b44b97bf7c287cfdc5"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-a-54e844.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-a-54e844.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"281b4de3d8a080a3c91b6babf36d294972f47bd01f1f21b44b97bf7c287cfdc5\" already exists"}
{"level":"error","ts":"2026-11-02T21:37:34.649Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-54e844","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-54e844#rule-3"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"a0181e531d0504643a09c194738cf17e43653ff05004b16a290f03d2f49f4c36","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a0181e531d0504643a09c194738cf17e43653ff05004b16a290f03d2f49f4c36"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-a-54e844.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-a-54e844.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"a0181e531d0504643a09c194738cf17e43653ff05004b16a290f03d2f49f4c36\" already exists"}
{"level":"error","ts":"2026-11-02T21:37:34.739Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-54e844","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-54e844#rule-5"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"c4f927f10bbe3cb7e4809e339baf54b1e0de51027b86f4974b63cdbe60408702","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["c4f927f10bbe3cb7e4809e339baf54b1e0de51027b86f4974b63cdbe60408702"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-a-54e844.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-a-54e844.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"c4f927f10bbe3cb7e4809e339baf54b1e0de51027b86f4974b63cdbe60408702\" already exists"}
{"level":"error","ts":"2026-11-02T21:37:34.809Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-54e844","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-54e844#rule-2"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"213d4e6e34493b57241b2950569fcc83525960a427eb933d1683c23e1b87d2d5","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["213d4e6e34493b57241b2950569fcc83525960a427eb933d1683c23e1b87d2d5"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-a-54e844.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-a-54e844.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"213d4e6e34493b57241b2950569fcc83525960a427eb933d1683c23e1b87d2d5\" already exists"}
{"level":"error","ts":"2026-11-02T21:37:34.878Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-54e844","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-54e844#rule-4"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"f08b1ef1b7782590808229cbb9bc4109562583c8b47bdd9fb309c82522ce918f","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f08b1ef1b7782590808229cbb9bc4109562583c8b47bdd9fb309c82522ce918f"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-a-54e844.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-a-54e844.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"f08b1ef1b7782590808229cbb9bc4109562583c8b47bdd9fb309c82522ce918f\" already exists"}
{"level":"error","ts":"2026-11-02T21:37:34.960Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-54e844","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-54e844#rule-6"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"33e15e11b867dd9bc38ad28a8f4a100d47666621d3babd049806979aaed1ab15","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["33e15e11b867dd9bc38ad28a8f4a100d47666621d3babd049806979aaed1ab15"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-a-54e844.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-a-54e844.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"33e15e11b867dd9bc38ad28a8f4a100d47666621d3babd049806979aaed1ab15\" already exists"}
{"level":"error","ts":"2026-11-02T21:37:35.253Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-ipp-a-54e844","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"name":"kuadrant-e2e-ipp-a-54e844","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-ipp-a-54e844","uid":"715412b4-5bc7-424f-a629-38760fca5559"}]},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"33e15e11b867dd9bc38ad28a8f4a100d47666621d3babd049806979aaed1ab15\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-a-54e844-maas-auth\"]}],\"name\":\"01dd9c88d2412105658205ee7d2093b984b2c3ef8f9608fe2d5945c249633477\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"213d4e6e34493b57241b2950569fcc83525960a427eb933d1683c23e1b87d2d5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-a-54e844-maas-auth\"]}],\"name\":\"d68b7b8e5b264638388a765c9d3ce6c01e8521f757cf14efc67e5a132c89d17a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c4f927f10bbe3cb7e4809e339baf54b1e0de51027b86f4974b63cdbe60408702\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-a-54e844-maas-auth\"]}],\"name\":\"333b2f3db25ad17201eb5fb344b91d36e18392006ff990d9930f791041231240\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a0181e531d0504643a09c194738cf17e43653ff05004b16a290f03d2f49f4c36\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-a-54e844-maas-auth\"]}],\"name\":\"b57b0b0cfadd359bb68b9f7ec016ecfdd0acce2496065c14bec3aa4eaea7b933\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f08b1ef1b7782590808229cbb9bc4109562583c8b47bdd9fb309c82522ce918f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-a-54e844-maas-auth\"]}],\"name\":\"fd842fe55caa350e7d324310969cf2be3d4616a625e48cab1f8d23a287065d83\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"281b4de3d8a080a3c91b6babf36d294972f47bd01f1f21b44b97bf7c287cfdc5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-a-54e844-maas-auth\"]}],\"name\":\"b21c57ecc75bc97fecfece1f7c9b3cad886102ec3beac5ac6846a3d6cc744bd1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-ipp-a-54e844"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-e2e-ipp-a-54e844\" already exists"}
{"level":"error","ts":"2026-11-02T21:37:35.792Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w0-0c9014","namespace":"e2e-models-e2e-worker-w0-0c9014","uid":"4f647df6-1d5b-433b-b4fc-1279ff1755f7","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w0-0c9014\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:37:35.852Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w0-0c9014","namespace":"e2e-models-e2e-worker-w0-0c9014","uid":"dcb5a0e4-7049-4ddc-91de-e14d55b09789","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w0-0c9014\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:37:35.910Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-simulated-simulated-premium","namespace":"llm","uid":"447993be-3c57-4e68-8ffa-6fc998a39c77","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-simulated-simulated-premium\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:37:35.968Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w4-d6cb38","namespace":"e2e-models-e2e-worker-w4-d6cb38","uid":"486176e6-7786-40c4-9ce0-6f4a68b408b2","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w4-d6cb38\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:37:36.027Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w3-f51151","namespace":"e2e-models-e2e-worker-w3-f51151","uid":"e3340067-224a-43ad-8020-ca9e00ead152","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w3-f51151\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:37:36.070Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-mt-70efbbab-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-mt-70efbbab-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:37:36.148Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w1-5f765a","namespace":"e2e-models-e2e-worker-w1-5f765a","uid":"7188eadc-9748-4be8-a5e2-d904cf5b6130","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w1-5f765a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:37:36.266Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w1-5f765a","namespace":"e2e-models-e2e-worker-w1-5f765a","uid":"9c852546-ee7c-4e72-855c-111315f7bf82","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w1-5f765a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:37:36.291Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-api-b-6606aa-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-api-b-6606aa-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:37:36.450Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w4-d6cb38","namespace":"e2e-models-e2e-worker-w4-d6cb38","uid":"0d3ebd35-5005-4ee4-a055-ff95546e3673","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w4-d6cb38\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:37:36.500Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-ipp-a-54e844-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-ipp-a-54e844-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:37:36.569Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-mt-70efbbab","namespace":"openshift-ingress","uid":"eed92508-a570-4b35-b099-fab18746dd49","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-mt-70efbbab\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:37:36.631Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-api-b-6606aa","namespace":"openshift-ingress","uid":"719a28d4-953c-4296-8e03-2a8a6fe26d37","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-api-b-6606aa\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:37:36.693Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-facebook-opt-125m-simulated","namespace":"llm","uid":"da8edb1a-ed61-454d-939f-fc7cd235d9fb","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-facebook-opt-125m-simulated\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:37:36.751Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w2-6fa533","namespace":"e2e-models-e2e-worker-w2-6fa533","uid":"3a128bb2-de88-49aa-ab9e-c8626107a077","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w2-6fa533\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:37:36.809Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-api-a-682116","namespace":"openshift-ingress","uid":"2ae344bf-be41-4b0b-beda-604ae44b2d25","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-api-a-682116\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:37:36.867Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w3-f51151","namespace":"e2e-models-e2e-worker-w3-f51151","uid":"c78aa03a-e3ca-4797-8a09-ab0d9cd88148","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w3-f51151\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:37:36.928Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w2-6fa533","namespace":"e2e-models-e2e-worker-w2-6fa533","uid":"2ff73667-c2c3-4579-9503-b6ca098f1021","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w2-6fa533\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:37:36.989Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:37:36.989Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T21:37:37.095Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"maas-api-route-e2e-ipp-a-54e844","namespace":"odh-ai-gateway-infra","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"maas-api-route-e2e-ipp-a-54e844\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:37:37.671Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-ipp-a-54e844","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-ipp-a-54e844\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:37:42Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ipp-a-15253e","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-a-15253e","reconcileID":"ae3873e0-1d23-4c7e-a802-d990e7be2127","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-ipp-a-15253e","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:37:43Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-a-15253e","event":"CREATE"}
{"level":"info","ts":"2026-11-02T21:37:43Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:37:43Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-02T21:37:43Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-02T21:37:43Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:37:43Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ipp-a-15253e","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-a-15253e","reconcileID":"6959f274-edb5-4bec-b44b-34f02b66499c","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-ipp-a-15253e","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:37:43Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-a-15253e","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T21:37:43Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:37:44Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-02T21:37:44Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-02T21:37:44Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-02T21:37:44Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:37:47.971Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Kuadrant","AuthConfig","TokenRateLimitPolicy","ConfigMap","AuthPolicy","Gateway","Limitador","EnvoyFilter","HTTPRoute"],"eventTypes":{"create":10,"update":24}}
{"level":"info","ts":"2026-11-02T21:37:48.170Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:37:48.190Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:37:50.563Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:37:50.567Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:37:50.738Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:37:50.738Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:37:50.833Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:37:53.927Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:37:53.931Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:37:53.931Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:37:53.933Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:37:53.911Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:37:53.936Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:37:54.135Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:37:56.883Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:37:56.883Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:37:58.051Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway","TokenRateLimitPolicy","HTTPRoute","Kuadrant","AuthPolicy"],"eventTypes":{"create":2,"update":3}}
{"level":"info","ts":"2026-11-02T21:37:58.247Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:37:58.280Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:37:59Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-api-a-682116","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-a-682116","reconcileID":"06b4230d-f7fa-4298-9e07-3c58c6fe105a","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-api-a-682116","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:37:59Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-a-682116","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T21:37:59Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:37:59Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-11-02T21:37:59Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:38:00Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-11-02T21:38:00Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-api-a-682116","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-a-682116","reconcileID":"06b4230d-f7fa-4298-9e07-3c58c6fe105a","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-api-a-682116","namespace":"openshift-ingress"}
{"level":"error","ts":"2026-11-02T21:38:00Z","logger":"telemetry-policy-extension-controller","msg":"Reconciler error","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-api-a-682116","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-a-682116","reconcileID":"a92914ea-9c42-4e8c-8c19-12ef7cb99b45","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-api-a-682116\" not found","stacktrace":"sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:353\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-02T21:38:00Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-a-682116","event":"DELETE"}
{"level":"info","ts":"2026-11-02T21:38:00Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-02T21:38:00Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-api-a-682116\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-02T21:38:00Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:38:01.241Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:38:01.331Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:38:01.549Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:38:01.549Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:38:01.734Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:38:04.565Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:38:04.575Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:38:04.623Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:38:04.624Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:38:04.624Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:38:04.629Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"error","ts":"2026-11-02T21:38:04.629Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-ipp-a-54e844","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/ratelimit":"true"},"name":"kuadrant-ratelimiting-e2e-ipp-a-54e844","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-ipp-a-54e844","uid":"715412b4-5bc7-424f-a629-38760fca5559"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"limitador-limitador.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-ratelimit-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"limitador-limitador.kuadrant-system.svc.cluster.local","port_value":8081}}}}]}]},"name":"kuadrant-ratelimit-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-ipp-a-54e844"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-ipp-a-54e844\" already exists"}
{"level":"error","ts":"2026-11-02T21:38:04.630Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-ipp-a-15253e","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"kuadrant-auth-e2e-ipp-a-15253e","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-ipp-a-15253e","uid":"3a4d024f-32bf-4fee-b6e8-2a1e6701668c"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-auth-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local","port_value":50051}}}}]}]},"name":"kuadrant-auth-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-ipp-a-15253e"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-ipp-a-15253e\" already exists"}
{"level":"error","ts":"2026-11-02T21:38:04.690Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-a-682116","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-a-682116#rule-5"},"creationTimestamp":"2026-11-02T21:34:54Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:36:07Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:36:07Z"}],"name":"db50e23b7ab70237a8c459ccedfef510b8bf5836fa2ab59b3796864e9aa5e2cf","namespace":"kuadrant-system","resourceVersion":"50914","uid":"9bd386d1-ab29-49f6-9b68-b61210c4be43"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["db50e23b7ab70237a8c459ccedfef510b8bf5836fa2ab59b3796864e9aa5e2cf"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-682116.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-682116.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:34:54Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:34:54Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["db50e23b7ab70237a8c459ccedfef510b8bf5836fa2ab59b3796864e9aa5e2cf"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"db50e23b7ab70237a8c459ccedfef510b8bf5836fa2ab59b3796864e9aa5e2cf\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:38:04.735Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:38:04.735Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T21:38:04.735Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-ipp-a-15253e","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/ratelimit":"true"},"name":"kuadrant-ratelimiting-e2e-ipp-a-15253e","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-ipp-a-15253e","uid":"3a4d024f-32bf-4fee-b6e8-2a1e6701668c"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"limitador-limitador.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-ratelimit-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"limitador-limitador.kuadrant-system.svc.cluster.local","port_value":8081}}}}]}]},"name":"kuadrant-ratelimit-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-ipp-a-15253e"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-ipp-a-15253e\" already exists"}
{"level":"error","ts":"2026-11-02T21:38:04.757Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-15253e","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-15253e#rule-2"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"1a02d37b4a6a46c1c934bc01fe493a684b5edfa1ff612d557252bec0500db39a","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["1a02d37b4a6a46c1c934bc01fe493a684b5edfa1ff612d557252bec0500db39a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-a-15253e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-a-15253e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"1a02d37b4a6a46c1c934bc01fe493a684b5edfa1ff612d557252bec0500db39a\" already exists"}
{"level":"error","ts":"2026-11-02T21:38:04.824Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-15253e","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-15253e#rule-1"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"08e42ab17cbf96c8e376cbd7311a3f69335b9ca4d010e0f3f637c7e4737037ab","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["08e42ab17cbf96c8e376cbd7311a3f69335b9ca4d010e0f3f637c7e4737037ab"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-a-15253e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-a-15253e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"08e42ab17cbf96c8e376cbd7311a3f69335b9ca4d010e0f3f637c7e4737037ab\" already exists"}
{"level":"error","ts":"2026-11-02T21:38:04.890Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-a-682116","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-a-682116#rule-1"},"creationTimestamp":"2026-11-02T21:34:53Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:36:07Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:36:07Z"}],"name":"f3d9da241fa5737556fbbd5d3c4359c0d189af14f25f7374e71efb158db203bf","namespace":"kuadrant-system","resourceVersion":"50909","uid":"7eac129f-51ad-4f46-8a8c-cc4c6900c36d"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f3d9da241fa5737556fbbd5d3c4359c0d189af14f25f7374e71efb158db203bf"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-682116.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-682116.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:34:53Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:34:53Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["f3d9da241fa5737556fbbd5d3c4359c0d189af14f25f7374e71efb158db203bf"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"f3d9da241fa5737556fbbd5d3c4359c0d189af14f25f7374e71efb158db203bf\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:38:04.960Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-a-682116","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-a-682116#rule-6"},"creationTimestamp":"2026-11-02T21:34:52Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:36:07Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:36:07Z"}],"name":"16cd5f900135f37e691702577f23320ffda92658e1586c995028efcab5106bb9","namespace":"kuadrant-system","resourceVersion":"50920","uid":"3ad33118-b411-4458-90a6-e63c9d951cb4"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["16cd5f900135f37e691702577f23320ffda92658e1586c995028efcab5106bb9"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-682116.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-682116.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:34:52Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:34:52Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["16cd5f900135f37e691702577f23320ffda92658e1586c995028efcab5106bb9"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"16cd5f900135f37e691702577f23320ffda92658e1586c995028efcab5106bb9\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:38:05.030Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-b-6606aa","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-b-6606aa#rule-2"},"creationTimestamp":"2026-11-02T21:37:04Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:37:04Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:37:04Z"}],"name":"19d95d89530737bb6b46cdf5102f7dbee7faaa6803d8c27fd312ec690f67e917","namespace":"kuadrant-system","resourceVersion":"52878","uid":"a85bbaf2-9192-4ed3-9597-c432344621c3"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["19d95d89530737bb6b46cdf5102f7dbee7faaa6803d8c27fd312ec690f67e917"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-b-6606aa.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-b-6606aa.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:37:04Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:37:04Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["19d95d89530737bb6b46cdf5102f7dbee7faaa6803d8c27fd312ec690f67e917"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"19d95d89530737bb6b46cdf5102f7dbee7faaa6803d8c27fd312ec690f67e917\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:38:05.032Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-ipp-a-54e844","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T21:37:24Z","generation":1,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"715412b4-5bc7-424f-a629-38760fca5559\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:37:24Z"}],"name":"kuadrant-e2e-ipp-a-54e844","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-ipp-a-54e844","uid":"715412b4-5bc7-424f-a629-38760fca5559"}],"resourceVersion":"53572","uid":"98f6d0c5-1a9a-4c36-8e4d-5f569fa9b2ed"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"33e15e11b867dd9bc38ad28a8f4a100d47666621d3babd049806979aaed1ab15\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-a-54e844-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a309939a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-54e844\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-54e844\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a309939a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-54e844\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-54e844\"]}],\"name\":\"01dd9c88d2412105658205ee7d2093b984b2c3ef8f9608fe2d5945c249633477\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"213d4e6e34493b57241b2950569fcc83525960a427eb933d1683c23e1b87d2d5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-a-54e844-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a309939a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-54e844\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-54e844\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a309939a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-54e844\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-54e844\"]}],\"name\":\"d68b7b8e5b264638388a765c9d3ce6c01e8521f757cf14efc67e5a132c89d17a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c4f927f10bbe3cb7e4809e339baf54b1e0de51027b86f4974b63cdbe60408702\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-a-54e844-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a309939a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-54e844\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-54e844\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a309939a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-54e844\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-54e844\"]}],\"name\":\"333b2f3db25ad17201eb5fb344b91d36e18392006ff990d9930f791041231240\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a0181e531d0504643a09c194738cf17e43653ff05004b16a290f03d2f49f4c36\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-a-54e844-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a309939a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-54e844\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-54e844\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a309939a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-54e844\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-54e844\"]}],\"name\":\"b57b0b0cfadd359bb68b9f7ec016ecfdd0acce2496065c14bec3aa4eaea7b933\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f08b1ef1b7782590808229cbb9bc4109562583c8b47bdd9fb309c82522ce918f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-a-54e844-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a309939a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-54e844\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-54e844\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a309939a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-54e844\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-54e844\"]}],\"name\":\"fd842fe55caa350e7d324310969cf2be3d4616a625e48cab1f8d23a287065d83\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"281b4de3d8a080a3c91b6babf36d294972f47bd01f1f21b44b97bf7c287cfdc5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-a-54e844-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a309939a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-54e844\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-54e844\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a309939a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-54e844\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-54e844\"]}],\"name\":\"b21c57ecc75bc97fecfece1f7c9b3cad886102ec3beac5ac6846a3d6cc744bd1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-ipp-a-54e844"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-ipp-a-54e844\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:38:05.094Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-a-682116","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-a-682116#rule-3"},"creationTimestamp":"2026-11-02T21:34:52Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:36:07Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:36:07Z"}],"name":"0cf37756964dc9b18bb0db7f6da9769e4de3c0cc72414f0c2f85d93e4d2a7438","namespace":"kuadrant-system","resourceVersion":"50911","uid":"83ab8416-fe16-4373-815a-9259555def7c"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["0cf37756964dc9b18bb0db7f6da9769e4de3c0cc72414f0c2f85d93e4d2a7438"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-682116.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-682116.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:34:53Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:34:53Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["0cf37756964dc9b18bb0db7f6da9769e4de3c0cc72414f0c2f85d93e4d2a7438"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"0cf37756964dc9b18bb0db7f6da9769e4de3c0cc72414f0c2f85d93e4d2a7438\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:38:05.161Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-b-6606aa","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-b-6606aa#rule-5"},"creationTimestamp":"2026-11-02T21:37:03Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:37:03Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:37:03Z"}],"name":"66d9739b04263cd8ab438ff81d1e8f9e2c42908f557dea2000a7f53abd3abda6","namespace":"kuadrant-system","resourceVersion":"52843","uid":"45b8a79e-183a-4e9e-af6d-7064d37bd6b1"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["66d9739b04263cd8ab438ff81d1e8f9e2c42908f557dea2000a7f53abd3abda6"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-b-6606aa.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-b-6606aa.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:37:03Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:37:03Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["66d9739b04263cd8ab438ff81d1e8f9e2c42908f557dea2000a7f53abd3abda6"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"66d9739b04263cd8ab438ff81d1e8f9e2c42908f557dea2000a7f53abd3abda6\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:38:05.227Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-b-6606aa","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-b-6606aa#rule-6"},"creationTimestamp":"2026-11-02T21:37:03Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:37:03Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:37:04Z"}],"name":"0ff71d62b1ff17bf42d720344c2f01301678e1babe4f98f658748ba00bf5fa0c","namespace":"kuadrant-system","resourceVersion":"52863","uid":"cce3e928-6b53-4661-b1a0-c0f82877038a"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["0ff71d62b1ff17bf42d720344c2f01301678e1babe4f98f658748ba00bf5fa0c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-b-6606aa.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-b-6606aa.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:37:04Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:37:04Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["0ff71d62b1ff17bf42d720344c2f01301678e1babe4f98f658748ba00bf5fa0c"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"0ff71d62b1ff17bf42d720344c2f01301678e1babe4f98f658748ba00bf5fa0c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:38:05.294Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-15253e","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-15253e#rule-5"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"04b357832e46c3de2ace6cc7e52929da5c1fba0dde72dbfdfc7d533c2903151d","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["04b357832e46c3de2ace6cc7e52929da5c1fba0dde72dbfdfc7d533c2903151d"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-a-15253e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-a-15253e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"04b357832e46c3de2ace6cc7e52929da5c1fba0dde72dbfdfc7d533c2903151d\" already exists"}
{"level":"error","ts":"2026-11-02T21:38:05.361Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-a-682116","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-a-682116#rule-2"},"creationTimestamp":"2026-11-02T21:34:54Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:36:07Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:36:07Z"}],"name":"fdaba319a690936532fab62c3ebd16d3636d771c61603bf0d7a61cd58539e9de","namespace":"kuadrant-system","resourceVersion":"50897","uid":"d6b5c0fe-2f67-4400-b9c9-8dfcd083ade5"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["fdaba319a690936532fab62c3ebd16d3636d771c61603bf0d7a61cd58539e9de"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-682116.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-682116.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:34:54Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:34:54Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["fdaba319a690936532fab62c3ebd16d3636d771c61603bf0d7a61cd58539e9de"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"fdaba319a690936532fab62c3ebd16d3636d771c61603bf0d7a61cd58539e9de\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:38:05.424Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-b-6606aa","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-b-6606aa#rule-4"},"creationTimestamp":"2026-11-02T21:37:04Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:37:04Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:37:05Z"}],"name":"1167cc91b979294c523b213273707a67cfd06bd7fb839f6d173f0f9690be4172","namespace":"kuadrant-system","resourceVersion":"52896","uid":"a62e02cc-560d-423f-a9a6-a5c9125c386a"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["1167cc91b979294c523b213273707a67cfd06bd7fb839f6d173f0f9690be4172"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-b-6606aa.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-b-6606aa.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:37:05Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:37:05Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["1167cc91b979294c523b213273707a67cfd06bd7fb839f6d173f0f9690be4172"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"1167cc91b979294c523b213273707a67cfd06bd7fb839f6d173f0f9690be4172\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:38:05.491Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-15253e","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-15253e#rule-6"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"00f59d7451e61295cd0230a6b7a8ab76c246b47ee0a15b7e294d0d200eba9031","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["00f59d7451e61295cd0230a6b7a8ab76c246b47ee0a15b7e294d0d200eba9031"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-a-15253e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-a-15253e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"00f59d7451e61295cd0230a6b7a8ab76c246b47ee0a15b7e294d0d200eba9031\" already exists"}
{"level":"error","ts":"2026-11-02T21:38:05.554Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-b-6606aa","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-b-6606aa#rule-1"},"creationTimestamp":"2026-11-02T21:37:03Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:37:03Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:37:04Z"}],"name":"fd5344b8ac24eaa6a10100c9a9986783f297c93e75e644f00a46f1821c50b192","namespace":"kuadrant-system","resourceVersion":"52871","uid":"86dd11ce-94ef-4207-81e8-2611f1914fb8"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["fd5344b8ac24eaa6a10100c9a9986783f297c93e75e644f00a46f1821c50b192"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-b-6606aa.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-b-6606aa.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:37:04Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:37:04Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["fd5344b8ac24eaa6a10100c9a9986783f297c93e75e644f00a46f1821c50b192"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"fd5344b8ac24eaa6a10100c9a9986783f297c93e75e644f00a46f1821c50b192\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:38:05.636Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-15253e","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-15253e#rule-3"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"d76093039d48df45b00344ef57af7d23a93c3afec85dba375992202ded1972f7","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d76093039d48df45b00344ef57af7d23a93c3afec85dba375992202ded1972f7"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-a-15253e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-a-15253e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"d76093039d48df45b00344ef57af7d23a93c3afec85dba375992202ded1972f7\" already exists"}
{"level":"error","ts":"2026-11-02T21:38:05.703Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-15253e","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-15253e#rule-4"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"d7ce8a0a8b4a4918ca9d4d6f6cfe98322e930a07107ca11d0899f718ca87d5fb","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d7ce8a0a8b4a4918ca9d4d6f6cfe98322e930a07107ca11d0899f718ca87d5fb"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-a-15253e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-a-15253e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"d7ce8a0a8b4a4918ca9d4d6f6cfe98322e930a07107ca11d0899f718ca87d5fb\" already exists"}
{"level":"error","ts":"2026-11-02T21:38:05.770Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-b-6606aa","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-b-6606aa#rule-3"},"creationTimestamp":"2026-11-02T21:37:04Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:37:04Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:37:04Z"}],"name":"61c8b167ecda537a686f05fb992a429748c1cc771260218a86b1647347016ecf","namespace":"kuadrant-system","resourceVersion":"52873","uid":"3d1307f2-e814-405b-80d6-2f1294691dab"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["61c8b167ecda537a686f05fb992a429748c1cc771260218a86b1647347016ecf"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-b-6606aa.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-b-6606aa.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:37:04Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:37:04Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["61c8b167ecda537a686f05fb992a429748c1cc771260218a86b1647347016ecf"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"61c8b167ecda537a686f05fb992a429748c1cc771260218a86b1647347016ecf\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:38:05.864Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-a-682116","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-a-682116#rule-4"},"creationTimestamp":"2026-11-02T21:34:53Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:36:07Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:36:07Z"}],"name":"a12b83f55f68240e0a93f521386189139f7501b4fc78d20957e81d8280efc0fb","namespace":"kuadrant-system","resourceVersion":"50922","uid":"d38c47bf-e2a2-410c-aad8-2def45ba488c"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a12b83f55f68240e0a93f521386189139f7501b4fc78d20957e81d8280efc0fb"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-682116.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-a-682116.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:34:53Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:34:53Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["a12b83f55f68240e0a93f521386189139f7501b4fc78d20957e81d8280efc0fb"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a12b83f55f68240e0a93f521386189139f7501b4fc78d20957e81d8280efc0fb\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:38:05.877Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-ipp-a-15253e","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"name":"kuadrant-e2e-ipp-a-15253e","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-ipp-a-15253e","uid":"3a4d024f-32bf-4fee-b6e8-2a1e6701668c"}]},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"00f59d7451e61295cd0230a6b7a8ab76c246b47ee0a15b7e294d0d200eba9031\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-a-15253e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__2f24f661\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-15253e\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-15253e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__2f24f661\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-15253e\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-15253e\"]}],\"name\":\"f406711f29f7997bc7be4d4eab5791896095e71a2dc5c599281efb8d729504d6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1a02d37b4a6a46c1c934bc01fe493a684b5edfa1ff612d557252bec0500db39a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-a-15253e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__2f24f661\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-15253e\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-15253e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__2f24f661\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-15253e\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-15253e\"]}],\"name\":\"d453ca24fad5237683de77a9632397d710d5cf27ee28365b55d588e8ee14ef48\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"04b357832e46c3de2ace6cc7e52929da5c1fba0dde72dbfdfc7d533c2903151d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-a-15253e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__2f24f661\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-15253e\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-15253e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__2f24f661\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-15253e\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-15253e\"]}],\"name\":\"ecd18c82ffe681a56898f3f9a741f9867392fe31fe55face2e8bb5a930c5ecdc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d76093039d48df45b00344ef57af7d23a93c3afec85dba375992202ded1972f7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-a-15253e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__2f24f661\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-15253e\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-15253e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__2f24f661\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-15253e\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-15253e\"]}],\"name\":\"1796753d0ecfba270de187ed46703aa289ebb6e91290f093a14309fe5e70ec39\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d7ce8a0a8b4a4918ca9d4d6f6cfe98322e930a07107ca11d0899f718ca87d5fb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-a-15253e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__2f24f661\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-15253e\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-15253e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__2f24f661\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-15253e\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-15253e\"]}],\"name\":\"b02d1777ac6d19bbc5305977977065589c176bf1d91a609645625cfb34a8057e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"08e42ab17cbf96c8e376cbd7311a3f69335b9ca4d010e0f3f637c7e4737037ab\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-a-15253e-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__2f24f661\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-15253e\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-15253e\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__2f24f661\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-15253e\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-15253e\"]}],\"name\":\"61008a1b5fb3b475fbb001cc013b2352d9c69d1f3c0da9f6c934d6e84dc8c6a7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-ipp-a-15253e"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-e2e-ipp-a-15253e\" already exists"}
{"level":"error","ts":"2026-11-02T21:38:05.935Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w0-0c9014","namespace":"e2e-models-e2e-worker-w0-0c9014","uid":"4f647df6-1d5b-433b-b4fc-1279ff1755f7","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w0-0c9014\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:38:06.008Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-api-b-6606aa-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-api-b-6606aa-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:38:06.054Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w1-5f765a","namespace":"e2e-models-e2e-worker-w1-5f765a","uid":"9c852546-ee7c-4e72-855c-111315f7bf82","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w1-5f765a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:38:06.112Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w2-6fa533","namespace":"e2e-models-e2e-worker-w2-6fa533","uid":"3a128bb2-de88-49aa-ab9e-c8626107a077","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w2-6fa533\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:38:06.170Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w0-0c9014","namespace":"e2e-models-e2e-worker-w0-0c9014","uid":"dcb5a0e4-7049-4ddc-91de-e14d55b09789","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w0-0c9014\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:38:06.229Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w4-d6cb38","namespace":"e2e-models-e2e-worker-w4-d6cb38","uid":"0d3ebd35-5005-4ee4-a055-ff95546e3673","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w4-d6cb38\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:38:06.350Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w3-f51151","namespace":"e2e-models-e2e-worker-w3-f51151","uid":"e3340067-224a-43ad-8020-ca9e00ead152","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w3-f51151\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:38:06.409Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w1-5f765a","namespace":"e2e-models-e2e-worker-w1-5f765a","uid":"7188eadc-9748-4be8-a5e2-d904cf5b6130","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w1-5f765a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:38:06.439Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-ipp-a-54e844-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-ipp-a-54e844-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:38:06.506Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-ipp-a-15253e-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-ipp-a-15253e-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:38:06.535Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-simulated-simulated-premium","namespace":"llm","uid":"447993be-3c57-4e68-8ffa-6fc998a39c77","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-simulated-simulated-premium\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:38:06.568Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-api-a-682116-maas-auth","namespace":"openshift-ingress","error":"authpolicies.kuadrant.io \"e2e-api-a-682116-maas-auth\" not found"}
{"level":"error","ts":"2026-11-02T21:38:06.595Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-facebook-opt-125m-simulated","namespace":"llm","uid":"da8edb1a-ed61-454d-939f-fc7cd235d9fb","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-facebook-opt-125m-simulated\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:38:06.653Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w3-f51151","namespace":"e2e-models-e2e-worker-w3-f51151","uid":"c78aa03a-e3ca-4797-8a09-ab0d9cd88148","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w3-f51151\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:38:06.772Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w2-6fa533","namespace":"e2e-models-e2e-worker-w2-6fa533","uid":"2ff73667-c2c3-4579-9503-b6ca098f1021","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w2-6fa533\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:38:06.889Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w4-d6cb38","namespace":"e2e-models-e2e-worker-w4-d6cb38","uid":"486176e6-7786-40c4-9ce0-6f4a68b408b2","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w4-d6cb38\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:38:06.946Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-api-a-682116","namespace":"openshift-ingress","uid":"2ae344bf-be41-4b0b-beda-604ae44b2d25","error":"tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-api-a-682116\" not found"}
{"level":"error","ts":"2026-11-02T21:38:07.023Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-ipp-a-54e844","namespace":"openshift-ingress","uid":"b32a7504-b428-4788-91df-217356ebe33c","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-ipp-a-54e844\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:38:07.141Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-ipp-a-15253e","namespace":"openshift-ingress","uid":"79cea698-ef77-4328-8e5e-94fb3112db27","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-ipp-a-15253e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:38:07.200Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-mt-70efbbab","namespace":"openshift-ingress","uid":"eed92508-a570-4b35-b099-fab18746dd49","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-mt-70efbbab\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:38:07.258Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-api-b-6606aa","namespace":"openshift-ingress","uid":"719a28d4-953c-4296-8e03-2a8a6fe26d37","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-api-b-6606aa\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:38:07.259Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:38:07.259Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T21:38:07.328Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"maas-api-route-e2e-ipp-a-54e844","namespace":"odh-ai-gateway-infra","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"maas-api-route-e2e-ipp-a-54e844\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:38:07.495Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-api-a-682116","error":"gateways.gateway.networking.k8s.io \"e2e-api-a-682116\" not found"}
{"level":"error","ts":"2026-11-02T21:38:07.511Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"maas-api-route-e2e-ipp-a-15253e","namespace":"odh-ai-gateway-infra","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"maas-api-route-e2e-ipp-a-15253e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:38:07.725Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-ipp-a-15253e","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-ipp-a-15253e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:38:07.909Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-ipp-a-54e844","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-ipp-a-54e844\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:38:18.160Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","AuthConfig","HTTPRoute","EnvoyFilter","AuthPolicy","Limitador","Gateway","ConfigMap","Kuadrant"],"eventTypes":{"create":10,"delete":7,"update":39}}
{"level":"info","ts":"2026-11-02T21:38:18.304Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:38:18.325Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:38:20.969Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:38:21.337Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:38:21.467Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:38:21.468Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:38:21.468Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:38:22Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ipp-a-7d3617","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-a-7d3617","reconcileID":"ca438a92-b510-47f4-a9b2-5b6ec6c65f9a","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-ipp-a-7d3617","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:38:22Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-a-7d3617","event":"CREATE"}
{"level":"info","ts":"2026-11-02T21:38:22Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:38:23Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-02T21:38:23Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-02T21:38:23Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:38:23Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-api-b-6606aa","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-b-6606aa","reconcileID":"f5029e86-ddab-40b2-be30-a97d4005e584","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-api-b-6606aa","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:38:23Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-b-6606aa","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T21:38:23Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:38:23Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-11-02T21:38:23Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:38:23Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-11-02T21:38:23Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-api-b-6606aa","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-b-6606aa","reconcileID":"f5029e86-ddab-40b2-be30-a97d4005e584","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-api-b-6606aa","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:38:23Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ipp-a-7d3617","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-a-7d3617","reconcileID":"3b8024d5-a67d-4f0e-8cb4-04215a943c56","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-ipp-a-7d3617","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:38:23Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-a-7d3617","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T21:38:23Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:38:24.638Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:38:24.638Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:38:24.645Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:38:24.648Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:38:24.652Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:38:24.652Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:38:24.824Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:38:24Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-02T21:38:24Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-02T21:38:24Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-02T21:38:24Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:38:24Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-api-b-6606aa","event":"DELETE"}
{"level":"info","ts":"2026-11-02T21:38:24Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-02T21:38:24Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-api-b-6606aa\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-02T21:38:24Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"error","ts":"2026-11-02T21:38:26.923Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-api-b-6606aa-maas-auth","namespace":"openshift-ingress","error":"authpolicies.kuadrant.io \"e2e-api-b-6606aa-maas-auth\" not found"}
{"level":"error","ts":"2026-11-02T21:38:27.576Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-api-b-6606aa","namespace":"openshift-ingress","uid":"719a28d4-953c-4296-8e03-2a8a6fe26d37","error":"tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-api-b-6606aa\" not found"}
{"level":"info","ts":"2026-11-02T21:38:27.700Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:38:27.700Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T21:38:27.995Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-ipp-a-7d3617","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-ipp-a-7d3617\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:38:28.178Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-mt-70efbbab","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-mt-70efbbab\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:38:28.417Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-api-b-6606aa","error":"gateways.gateway.networking.k8s.io \"e2e-api-b-6606aa\" not found"}
{"level":"info","ts":"2026-11-02T21:38:29.065Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthPolicy","HTTPRoute"],"eventTypes":{"delete":1,"update":1}}
{"level":"info","ts":"2026-11-02T21:38:33.545Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:38:33.549Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:38:33.556Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:38:33.558Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:38:33.563Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:38:33.563Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-02T21:38:33.660Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:38:33.660Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T21:38:33.662Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-b-6606aa","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-b-6606aa#rule-6"},"creationTimestamp":"2026-11-02T21:37:03Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:37:54Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:37:54Z"}],"name":"0ff71d62b1ff17bf42d720344c2f01301678e1babe4f98f658748ba00bf5fa0c","namespace":"kuadrant-system","resourceVersion":"54312","uid":"cce3e928-6b53-4661-b1a0-c0f82877038a"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["0ff71d62b1ff17bf42d720344c2f01301678e1babe4f98f658748ba00bf5fa0c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-b-6606aa.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-b-6606aa.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:37:04Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:37:04Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["0ff71d62b1ff17bf42d720344c2f01301678e1babe4f98f658748ba00bf5fa0c"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"0ff71d62b1ff17bf42d720344c2f01301678e1babe4f98f658748ba00bf5fa0c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:38:33.728Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-b-6606aa","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-b-6606aa#rule-5"},"creationTimestamp":"2026-11-02T21:37:03Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:37:55Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:37:55Z"}],"name":"66d9739b04263cd8ab438ff81d1e8f9e2c42908f557dea2000a7f53abd3abda6","namespace":"kuadrant-system","resourceVersion":"54371","uid":"45b8a79e-183a-4e9e-af6d-7064d37bd6b1"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["66d9739b04263cd8ab438ff81d1e8f9e2c42908f557dea2000a7f53abd3abda6"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-b-6606aa.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-b-6606aa.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:37:03Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:37:03Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["66d9739b04263cd8ab438ff81d1e8f9e2c42908f557dea2000a7f53abd3abda6"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"66d9739b04263cd8ab438ff81d1e8f9e2c42908f557dea2000a7f53abd3abda6\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:38:33.791Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-b-6606aa","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-b-6606aa#rule-4"},"creationTimestamp":"2026-11-02T21:37:04Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:37:55Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:37:55Z"}],"name":"1167cc91b979294c523b213273707a67cfd06bd7fb839f6d173f0f9690be4172","namespace":"kuadrant-system","resourceVersion":"54365","uid":"a62e02cc-560d-423f-a9a6-a5c9125c386a"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["1167cc91b979294c523b213273707a67cfd06bd7fb839f6d173f0f9690be4172"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-b-6606aa.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-b-6606aa.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:37:05Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:37:05Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["1167cc91b979294c523b213273707a67cfd06bd7fb839f6d173f0f9690be4172"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"1167cc91b979294c523b213273707a67cfd06bd7fb839f6d173f0f9690be4172\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:38:33.893Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-b-6606aa","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-b-6606aa#rule-1"},"creationTimestamp":"2026-11-02T21:37:03Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:37:54Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:37:54Z"}],"name":"fd5344b8ac24eaa6a10100c9a9986783f297c93e75e644f00a46f1821c50b192","namespace":"kuadrant-system","resourceVersion":"54328","uid":"86dd11ce-94ef-4207-81e8-2611f1914fb8"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["fd5344b8ac24eaa6a10100c9a9986783f297c93e75e644f00a46f1821c50b192"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-b-6606aa.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-b-6606aa.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:37:04Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:37:04Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["fd5344b8ac24eaa6a10100c9a9986783f297c93e75e644f00a46f1821c50b192"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"fd5344b8ac24eaa6a10100c9a9986783f297c93e75e644f00a46f1821c50b192\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:38:33.951Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-api-b-6606aa","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T21:37:03Z","generation":1,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"89cfcbf8-a80c-4796-99d3-d773ea3d7191\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:37:03Z"}],"name":"kuadrant-e2e-api-b-6606aa","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-api-b-6606aa","uid":"89cfcbf8-a80c-4796-99d3-d773ea3d7191"}],"resourceVersion":"52855","uid":"69fec916-4aba-4ab5-a9b3-b6ff97b1e96b"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0ff71d62b1ff17bf42d720344c2f01301678e1babe4f98f658748ba00bf5fa0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-api-b-6606aa-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__005bc402\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-api-b-6606aa\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-api-b-6606aa\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__005bc402\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-api-b-6606aa\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-api-b-6606aa\"]}],\"name\":\"90502564b3a2ed8635f96260a8b0535e67b2539ae29874e331ec4263b614b9bb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"19d95d89530737bb6b46cdf5102f7dbee7faaa6803d8c27fd312ec690f67e917\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-api-b-6606aa-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__005bc402\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-api-b-6606aa\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-api-b-6606aa\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__005bc402\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-api-b-6606aa\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-api-b-6606aa\"]}],\"name\":\"78ca6cc7a7c3f5180d09c0226ec865b1c22ac56dfbd48169d7bb68c2762367ca\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"66d9739b04263cd8ab438ff81d1e8f9e2c42908f557dea2000a7f53abd3abda6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-api-b-6606aa-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__005bc402\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-api-b-6606aa\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-api-b-6606aa\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__005bc402\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-api-b-6606aa\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-api-b-6606aa\"]}],\"name\":\"9c385a0dbb8886274a9ac2014e8b750e015bdca76264d5fb0415678b9466fe9a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"61c8b167ecda537a686f05fb992a429748c1cc771260218a86b1647347016ecf\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-api-b-6606aa-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__005bc402\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-api-b-6606aa\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-api-b-6606aa\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__005bc402\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-api-b-6606aa\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-api-b-6606aa\"]}],\"name\":\"3404d6c0607d2bd26aa0d23d2c73ad1f5734594bebdddc042b688e78402d314a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1167cc91b979294c523b213273707a67cfd06bd7fb839f6d173f0f9690be4172\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-api-b-6606aa-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__005bc402\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-api-b-6606aa\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-api-b-6606aa\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__005bc402\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-api-b-6606aa\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-api-b-6606aa\"]}],\"name\":\"cd7863f2c8447f713d4c54aa108f99d19bc857796e9399c408563566b0a69f50\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fd5344b8ac24eaa6a10100c9a9986783f297c93e75e644f00a46f1821c50b192\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-api-b-6606aa-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__005bc402\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-api-b-6606aa\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-api-b-6606aa\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__005bc402\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-api-b-6606aa\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-api-b-6606aa\"]}],\"name\":\"557ab1e86922d0ed606c43c22fb61b999d4e8f71b0ac3165c94a0df5b215bcc7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}}],\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-api-b-6606aa"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-e2e-api-b-6606aa\" not found"}
{"level":"error","ts":"2026-11-02T21:38:33.957Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-b-6606aa","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-b-6606aa#rule-2"},"creationTimestamp":"2026-11-02T21:37:04Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:37:54Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:37:55Z"}],"name":"19d95d89530737bb6b46cdf5102f7dbee7faaa6803d8c27fd312ec690f67e917","namespace":"kuadrant-system","resourceVersion":"54342","uid":"a85bbaf2-9192-4ed3-9597-c432344621c3"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["19d95d89530737bb6b46cdf5102f7dbee7faaa6803d8c27fd312ec690f67e917"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-b-6606aa.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-b-6606aa.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:37:54Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:37:54Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["19d95d89530737bb6b46cdf5102f7dbee7faaa6803d8c27fd312ec690f67e917"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"19d95d89530737bb6b46cdf5102f7dbee7faaa6803d8c27fd312ec690f67e917\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:38:34.022Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-api-b-6606aa","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-api-b-6606aa#rule-3"},"creationTimestamp":"2026-11-02T21:37:04Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:37:54Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:37:54Z"}],"name":"61c8b167ecda537a686f05fb992a429748c1cc771260218a86b1647347016ecf","namespace":"kuadrant-system","resourceVersion":"54326","uid":"3d1307f2-e814-405b-80d6-2f1294691dab"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["61c8b167ecda537a686f05fb992a429748c1cc771260218a86b1647347016ecf"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-b-6606aa.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-api-b-6606aa.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:37:04Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:37:04Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["61c8b167ecda537a686f05fb992a429748c1cc771260218a86b1647347016ecf"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"61c8b167ecda537a686f05fb992a429748c1cc771260218a86b1647347016ecf\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:38:34.090Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/7423a2f76c00c27e0a8383b9e315e7f7063dd5642156172f597daf18b46fde33","error":"authconfigs.authorino.kuadrant.io \"7423a2f76c00c27e0a8383b9e315e7f7063dd5642156172f597daf18b46fde33\" not found"}
{"level":"error","ts":"2026-11-02T21:38:34.145Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/c8eb1936334744a56aa2274ce9d6f51ea168179c65f92874f3b8076be0207259","error":"authconfigs.authorino.kuadrant.io \"c8eb1936334744a56aa2274ce9d6f51ea168179c65f92874f3b8076be0207259\" not found"}
{"level":"error","ts":"2026-11-02T21:38:34.289Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/db50e23b7ab70237a8c459ccedfef510b8bf5836fa2ab59b3796864e9aa5e2cf","error":"authconfigs.authorino.kuadrant.io \"db50e23b7ab70237a8c459ccedfef510b8bf5836fa2ab59b3796864e9aa5e2cf\" not found"}
{"level":"error","ts":"2026-11-02T21:38:34.350Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/7dd93d350f32a149c45b09c240b7a22e2323c5563700b192f69d6c453081048e","error":"authconfigs.authorino.kuadrant.io \"7dd93d350f32a149c45b09c240b7a22e2323c5563700b192f69d6c453081048e\" not found"}
{"level":"error","ts":"2026-11-02T21:38:34.405Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/a12b83f55f68240e0a93f521386189139f7501b4fc78d20957e81d8280efc0fb","error":"authconfigs.authorino.kuadrant.io \"a12b83f55f68240e0a93f521386189139f7501b4fc78d20957e81d8280efc0fb\" not found"}
{"level":"error","ts":"2026-11-02T21:38:34.460Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/7adf1ca91bf336959a508540d878f5239ea90c05e08e3636aeaa69a6226a3003","error":"authconfigs.authorino.kuadrant.io \"7adf1ca91bf336959a508540d878f5239ea90c05e08e3636aeaa69a6226a3003\" not found"}
{"level":"error","ts":"2026-11-02T21:38:34.515Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/cd0342f6c3ef93f58d95e760fb8ed9fa936a0168aa423e2db15cd0f43b6a534f","error":"authconfigs.authorino.kuadrant.io \"cd0342f6c3ef93f58d95e760fb8ed9fa936a0168aa423e2db15cd0f43b6a534f\" not found"}
{"level":"error","ts":"2026-11-02T21:38:34.557Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-mt-70efbbab","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T21:37:03Z","generation":1,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"55b43ab2-2dfe-4712-81e7-9e7e015fa479\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:37:03Z"}],"name":"kuadrant-e2e-mt-70efbbab","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-mt-70efbbab","uid":"55b43ab2-2dfe-4712-81e7-9e7e015fa479"}],"resourceVersion":"52834","uid":"e9133fff-eff7-444a-b2bd-e18a53e06701"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0a626bd77283731109bdf44eb675ae0af0d6ae927fd1d71365c621209aa60038\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-70efbbab-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bb242d84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-mt-70efbbab\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-70efbbab\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bb242d84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-mt-70efbbab\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-70efbbab\"]}],\"name\":\"b87eba9ba35eb6a53338cb9c1a5f04f8c65b27b2608950e94b52695b57960191\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fd62a73690c4cdd37a87d21a98021e6dfaac4eaa6e8bb6637dd1d0128e2c74ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-70efbbab-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bb242d84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-mt-70efbbab\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-70efbbab\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bb242d84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-mt-70efbbab\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-70efbbab\"]}],\"name\":\"0730cd900d638778f9c32f3f7d9c5f420d734632bb8252b568315c5a9676d0d8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6f155f9c22fd9155424959d77e15b09e2e46420c024c9208fdcbaaf5989ef3ab\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-70efbbab-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bb242d84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-mt-70efbbab\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-70efbbab\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bb242d84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-mt-70efbbab\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-70efbbab\"]}],\"name\":\"c720b7f2d11b3dbb7b799bbebd973a4d4ec8c684155c16c46e1eda1185ff8837\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"31073c5c317c28e8c591480ae44909bd2739da3e04a508fefa3153f5dfff2bd7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-70efbbab-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bb242d84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-mt-70efbbab\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-70efbbab\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bb242d84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-mt-70efbbab\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-70efbbab\"]}],\"name\":\"64099bf2730414a6f288ff5b1ac6eeee51286fe6f193710bdd769df5c9ee2087\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"51d36c7f5f5d3ce8ca874f6f293be93ec6a5b3c79a267dd55f8e4240e4bb0e5c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-70efbbab-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bb242d84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-mt-70efbbab\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-70efbbab\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bb242d84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-mt-70efbbab\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-70efbbab\"]}],\"name\":\"50d37a806bd243094a3c969b2322245adf16563d4a39be9ea98b97e027900dd5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"81610c6024322aa440cb76b35caf0e21d85e94dd73885d1aff7f8f6ba84a448b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-70efbbab-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bb242d84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-mt-70efbbab\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-70efbbab\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__bb242d84\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-mt-70efbbab\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-70efbbab\"]}],\"name\":\"f8e7a3e592323f9939c7310e2c6057d3a35fc55047d6200c2567409a248d5fd1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-mt-70efbbab"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-mt-70efbbab\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:38:34.569Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/f8da20627f0169e69426fd609be7867dca7c3ecdf4acafec00912ff7791bd2d6","error":"authconfigs.authorino.kuadrant.io \"f8da20627f0169e69426fd609be7867dca7c3ecdf4acafec00912ff7791bd2d6\" not found"}
{"level":"error","ts":"2026-11-02T21:38:34.624Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/16cd5f900135f37e691702577f23320ffda92658e1586c995028efcab5106bb9","error":"authconfigs.authorino.kuadrant.io \"16cd5f900135f37e691702577f23320ffda92658e1586c995028efcab5106bb9\" not found"}
{"level":"error","ts":"2026-11-02T21:38:34.679Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/686f86f63369549dfd81bff146f9663d1dd02886636e63f1ff5322994f99d220","error":"authconfigs.authorino.kuadrant.io \"686f86f63369549dfd81bff146f9663d1dd02886636e63f1ff5322994f99d220\" not found"}
{"level":"error","ts":"2026-11-02T21:38:34.734Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/86769b4cd589416a0961b23aa701cac08477d8ee25523565ff53094b12f68d12","error":"authconfigs.authorino.kuadrant.io \"86769b4cd589416a0961b23aa701cac08477d8ee25523565ff53094b12f68d12\" not found"}
{"level":"error","ts":"2026-11-02T21:38:34.788Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/f3d9da241fa5737556fbbd5d3c4359c0d189af14f25f7374e71efb158db203bf","error":"authconfigs.authorino.kuadrant.io \"f3d9da241fa5737556fbbd5d3c4359c0d189af14f25f7374e71efb158db203bf\" not found"}
{"level":"error","ts":"2026-11-02T21:38:34.843Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/e2ef1a6a441ba51300173a3d2652431c0c70f9fbe3dec378b60bf73345e7ed62","error":"authconfigs.authorino.kuadrant.io \"e2ef1a6a441ba51300173a3d2652431c0c70f9fbe3dec378b60bf73345e7ed62\" not found"}
{"level":"error","ts":"2026-11-02T21:38:34.898Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/8963f302f71d40b22b463a6588998e3c87fec7d53908554dfc99bbb66749350f","error":"authconfigs.authorino.kuadrant.io \"8963f302f71d40b22b463a6588998e3c87fec7d53908554dfc99bbb66749350f\" not found"}
{"level":"error","ts":"2026-11-02T21:38:34.953Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/660283bab741313169e87794c6dfdd92b2fd87e67da62906cea103cd6b1b7218","error":"authconfigs.authorino.kuadrant.io \"660283bab741313169e87794c6dfdd92b2fd87e67da62906cea103cd6b1b7218\" not found"}
{"level":"error","ts":"2026-11-02T21:38:35.009Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/9ea783f2033457fc0f2f52f4f6f7a87dacb7918d14fd2c49d89468a40d5ce2f5","error":"authconfigs.authorino.kuadrant.io \"9ea783f2033457fc0f2f52f4f6f7a87dacb7918d14fd2c49d89468a40d5ce2f5\" not found"}
{"level":"error","ts":"2026-11-02T21:38:35.064Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/fdaba319a690936532fab62c3ebd16d3636d771c61603bf0d7a61cd58539e9de","error":"authconfigs.authorino.kuadrant.io \"fdaba319a690936532fab62c3ebd16d3636d771c61603bf0d7a61cd58539e9de\" not found"}
{"level":"error","ts":"2026-11-02T21:38:35.119Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/0cf37756964dc9b18bb0db7f6da9769e4de3c0cc72414f0c2f85d93e4d2a7438","error":"authconfigs.authorino.kuadrant.io \"0cf37756964dc9b18bb0db7f6da9769e4de3c0cc72414f0c2f85d93e4d2a7438\" not found"}
{"level":"error","ts":"2026-11-02T21:38:35.176Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-api-b-6606aa","namespace":"openshift-ingress","uid":"719a28d4-953c-4296-8e03-2a8a6fe26d37","error":"tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-api-b-6606aa\" not found"}
{"level":"error","ts":"2026-11-02T21:38:35.254Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-ipp-a-15253e-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-ipp-a-15253e-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:38:35.527Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-api-b-6606aa-maas-auth","namespace":"openshift-ingress","error":"authpolicies.kuadrant.io \"e2e-api-b-6606aa-maas-auth\" not found"}
{"level":"error","ts":"2026-11-02T21:38:35.710Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-ipp-a-15253e","namespace":"openshift-ingress","uid":"79cea698-ef77-4328-8e5e-94fb3112db27","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-ipp-a-15253e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:38:35.951Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-ipp-a-54e844","namespace":"openshift-ingress","uid":"b32a7504-b428-4788-91df-217356ebe33c","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-ipp-a-54e844\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:38:36.430Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:38:36.430Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T21:38:36.723Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-api-b-6606aa","error":"gateways.gateway.networking.k8s.io \"e2e-api-b-6606aa\" not found"}
{"level":"error","ts":"2026-11-02T21:38:37.029Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-mt-70efbbab","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-mt-70efbbab\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:38:37.150Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-ipp-a-7d3617","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-ipp-a-7d3617\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:38:40.798Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthPolicy","ConfigMap","Limitador","EnvoyFilter","AuthConfig","TokenRateLimitPolicy","HTTPRoute","Gateway","Kuadrant"],"eventTypes":{"create":4,"delete":25,"update":15}}
{"level":"info","ts":"2026-11-02T21:38:41.123Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:38:41.247Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:38:43.555Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:38:43.661Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:38:43.723Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:38:43.723Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:38:43.724Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:38:46.657Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:38:46.665Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:38:46.657Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:38:46.671Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:38:46.673Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:38:46.673Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-02T21:38:46.779Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:38:46.779Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:38:49.290Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:38:49.290Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:38:56.664Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","EnvoyFilter","Gateway","AuthPolicy","Limitador","TokenRateLimitPolicy","HTTPRoute","ConfigMap"],"eventTypes":{"create":9,"delete":6,"update":6}}
{"level":"info","ts":"2026-11-02T21:38:56.869Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:38:58.630Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:38:58.734Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:38:58.734Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:39:01.557Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:39:01.565Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:39:01.574Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:39:01.660Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:39:01.660Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:39:01.666Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:39:01.755Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:39:04.064Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:39:04.064Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:39:11.551Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","AuthPolicy","Limitador","ConfigMap"],"eventTypes":{"update":4}}
{"level":"info","ts":"2026-11-02T21:39:11.740Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:39:13.170Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:39:13.240Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:39:13.240Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:39:16.248Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:39:16.257Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:39:16.257Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:39:16.264Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:39:16.264Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:39:16.269Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-02T21:39:16.269Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:39:18.778Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:39:18.778Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:39:22.972Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","Limitador","ConfigMap"],"eventTypes":{"update":18}}
{"level":"info","ts":"2026-11-02T21:39:23.211Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:39:24.660Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:39:24.823Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:39:24.823Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:39:27.873Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:39:27.928Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-02T21:39:27.928Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:39:27.932Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:39:27.932Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:39:27.933Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:39:29Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ipp-a-e12f99","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-a-e12f99","reconcileID":"2d22caa5-31e8-4bc7-8b5f-d3aa4b3a545a","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-ipp-a-e12f99","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:39:29Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-a-e12f99","event":"CREATE"}
{"level":"info","ts":"2026-11-02T21:39:29Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:39:29Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-02T21:39:29Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-02T21:39:30Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:39:30Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ipp-a-e12f99","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-a-e12f99","reconcileID":"c54ba95d-e2fb-43d6-93d1-c238ebf2c46a","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-ipp-a-e12f99","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:39:30Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-a-e12f99","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T21:39:30Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:39:30.381Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:39:30.382Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:39:30Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-02T21:39:30Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-02T21:39:30Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-02T21:39:30Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:39:30Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ipp-a-e12f99","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-a-e12f99","reconcileID":"1001fbc0-f702-4e5a-b256-41af028a805b","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-ipp-a-e12f99","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:39:30Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-a-e12f99","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T21:39:30Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-02T21:39:30.987Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-ipp-a-e12f99","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-ipp-a-e12f99\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:39:31Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-02T21:39:31Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-02T21:39:31Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-02T21:39:31Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:39:38.145Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","Kuadrant","Gateway","ConfigMap","HTTPRoute","AuthPolicy"],"eventTypes":{"create":4,"update":3}}
{"level":"info","ts":"2026-11-02T21:39:38.436Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:39:38.456Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:39:40.750Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:39:40.865Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:39:40.873Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:39:40.874Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:39:41.256Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:39:43.994Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:39:43.994Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:39:44.001Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:39:44.023Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:39:44.029Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:39:44.029Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:39:44.169Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:39:46.721Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:39:46.721Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:39:54.102Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","AuthConfig","AuthPolicy","HTTPRoute","ConfigMap","Gateway","EnvoyFilter","Limitador"],"eventTypes":{"create":9,"update":22}}
{"level":"info","ts":"2026-11-02T21:39:54.450Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:39:56.130Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:39:56.246Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:39:56.246Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:39:59.629Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:39:59.637Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:39:59.637Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:39:59.646Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:39:59.646Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:39:59.651Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-02T21:39:59.651Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:40:02.500Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:40:02.500Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:40:06Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-mt-70efbbab","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-mt-70efbbab","reconcileID":"4f92f551-d6d1-4334-9b88-ef1098471827","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-mt-70efbbab","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:40:06Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-mt-70efbbab","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T21:40:06Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:40:06Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-11-02T21:40:06Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:40:06Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-11-02T21:40:06Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-mt-70efbbab","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-mt-70efbbab","reconcileID":"4f92f551-d6d1-4334-9b88-ef1098471827","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-mt-70efbbab","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:40:06Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-mt-70efbbab","event":"DELETE"}
{"level":"info","ts":"2026-11-02T21:40:06Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-02T21:40:06Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-mt-70efbbab\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-02T21:40:06Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:40:13.248Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","ConfigMap","AuthPolicy","Limitador","Gateway"],"eventTypes":{"create":1,"update":20}}
{"level":"info","ts":"2026-11-02T21:40:13.489Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:40:15.433Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:40:15.542Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:40:15.542Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:40:18.357Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:40:18.370Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:40:18.434Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:40:18.434Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:40:18.440Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:40:18.441Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:40:18.549Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:40:21.193Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:40:21.193Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:40:22.699Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","Kuadrant","HTTPRoute","EnvoyFilter","Gateway","AuthPolicy"],"eventTypes":{"delete":7,"update":2}}
{"level":"info","ts":"2026-11-02T21:40:22.858Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:40:22.878Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:40:25.125Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:40:25.441Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:40:25.531Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:40:25.751Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:40:25.751Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:40:28.644Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:40:28.651Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:40:28.644Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:40:28.663Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:40:28.663Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:40:28.671Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-11-02T21:40:28.730Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:40:28.730Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T21:40:28.786Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/81610c6024322aa440cb76b35caf0e21d85e94dd73885d1aff7f8f6ba84a448b","error":"authconfigs.authorino.kuadrant.io \"81610c6024322aa440cb76b35caf0e21d85e94dd73885d1aff7f8f6ba84a448b\" not found"}
{"level":"error","ts":"2026-11-02T21:40:28.840Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/0a626bd77283731109bdf44eb675ae0af0d6ae927fd1d71365c621209aa60038","error":"authconfigs.authorino.kuadrant.io \"0a626bd77283731109bdf44eb675ae0af0d6ae927fd1d71365c621209aa60038\" not found"}
{"level":"error","ts":"2026-11-02T21:40:28.897Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/6f155f9c22fd9155424959d77e15b09e2e46420c024c9208fdcbaaf5989ef3ab","error":"authconfigs.authorino.kuadrant.io \"6f155f9c22fd9155424959d77e15b09e2e46420c024c9208fdcbaaf5989ef3ab\" not found"}
{"level":"error","ts":"2026-11-02T21:40:28.954Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/fd62a73690c4cdd37a87d21a98021e6dfaac4eaa6e8bb6637dd1d0128e2c74ec","error":"authconfigs.authorino.kuadrant.io \"fd62a73690c4cdd37a87d21a98021e6dfaac4eaa6e8bb6637dd1d0128e2c74ec\" not found"}
{"level":"error","ts":"2026-11-02T21:40:29.008Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/31073c5c317c28e8c591480ae44909bd2739da3e04a508fefa3153f5dfff2bd7","error":"authconfigs.authorino.kuadrant.io \"31073c5c317c28e8c591480ae44909bd2739da3e04a508fefa3153f5dfff2bd7\" not found"}
{"level":"error","ts":"2026-11-02T21:40:29.066Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/51d36c7f5f5d3ce8ca874f6f293be93ec6a5b3c79a267dd55f8e4240e4bb0e5c","error":"authconfigs.authorino.kuadrant.io \"51d36c7f5f5d3ce8ca874f6f293be93ec6a5b3c79a267dd55f8e4240e4bb0e5c\" not found"}
{"level":"error","ts":"2026-11-02T21:40:29.477Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/maas-default-gateway","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T21:16:03Z","generation":15,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"371b36ef-c4b7-499a-87db-1bdf4e8f92de\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:32:24Z"}],"name":"kuadrant-maas-default-gateway","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"maas-default-gateway","uid":"371b36ef-c4b7-499a-87db-1bdf4e8f92de"}],"resourceVersion":"44711","uid":"86b5bad7-2bb7-41c9-b2c7-bb4c8f13292a"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"61b044087f8d56658ae99d15d4fab3cf1ad74e6636795c133e054a5aace0540d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e511d90f2140d9cde0b2100a0a488dacadd8f510bb901601d5e6fd25343a0f1c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"1e42d143d6033a677e2aa0de97c78600094e515d7c0d3f86b4925ef8be636163\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"26b7799af8a40e8b9585c255ec018a63b0074c27282d4dccebed45f14e703b5e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"ce74c295ef1588342c7308478a1dc6f6aa2cefc063e489a124e536ac32ecfdba\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"fbe95a07558afcf05ef68ff5beb293f527d6ab93dfe79956b5406dc463d78363\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"78abae9e2e773a05\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"78abae9e2e773a05\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"40a29ce438b5ca497e4389ce52025a9b91c0cf3177b1bd5c8519b041cfdcf75f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"845137604829fbc62550504d7bbe5ae8d55ea1cf474160cd789a72e811000e4b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5322619ef71b1d1ea3204f9014d0341d4402275b6ca23fca69d61cfc9a61e883\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"16b86e50920afda06ca195a717436238f5fca7f2e1bbe0939875bcb7d559cf31\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5da9070dfa3a5637213b5443376170dda26f57f381af542891ff3b19cc7a9d06\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"00ac1aeee65e93fab2ccfd89c11167f4d954e1cfb3e8b09ad3371a4fab4b6369\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"55c23b9552cb66c175ed2202220df6480eae89be2cda2e925458acf31c5bdbce\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"99f16470bd82ba57465b128d1c0fe73ef189001d77c6ead3fc34c98ad3ce27a2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"78abae9e2e773a05\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"78abae9e2e773a05\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"a6d134df42d4d90d93840f63dc770cadabd22dc22af01f991b6c067e96733c95\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"0be74a5083c4760789001949965ce7020664f6347b769f9f20735f95f9d34989\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4902f5a84509d49ec2fb75275af9692b524b1334f7c919eff1d9f33957acd5c4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4f0e9d14c4d1857d5415458306310b00d6a94ce68179c717917d13d30ede9b87\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"29d1c55f30b76c66bfb15588c297271fac7d5e9ca415f0c938d63e524a8187e5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"df729ecdaa88f0abfee16b94ea7be9c5aa7ccdfe91fbe0676e22ca4bfae35f29\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"69baf76a5f2e8f4f8d3e40025586b942794274a22455dc40e0b7c0116f0d2297\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"8199294e302361a6898546d62809d67d522e9c2b375c8b8727f0d966f7ad4d39\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"78abae9e2e773a05\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"78abae9e2e773a05\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"61ef91ec2e76cc107813a7351d7e38bb32d1ebbff452efa771b01f8a512fb99e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"f2d9c20918355999f92bc489c836e0d17ed8acb713739da4b73fc8ee019fc8a4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"c19d17a63dc280a83fa4dce8ef0f825a16118c6817d3126d095473335018edd0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"05aa8311318e9111c5925f4be454406e209ab832bc6e8ddf01725ebe4f1ffdcc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e680857c19914d59f115788ea93836704a1ddab04f5e495bf863d62ad8a5aa8e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"96b761d418352e3f8d172aa80bfb5542df670414bec97704e615f2e3e665c8aa\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4a199d441e37ffe8d62509ae7048cfd055df0de5619e9be81a8f47f9a64a7051\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"f17cbb57db714a7faf03a7e4ef3921069096709486e13c6b84b4b75ded84ca96\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"78abae9e2e773a05\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"78abae9e2e773a05\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"d8631ed26c63871d1138b31e9c971d72ad1152273309b27ee33862700ff4fb0c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"67a5fec0fb2398a03579a732c5e4640c9f9c5db5385b91db90ffb49522369904\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e5b5be5a42ead835fa1a13840fda21cf5afb14b8226da9a3008a321db777f685\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"a01c6bf1aa626b04ec6a9fc85abb6ced9b4a9c4cafe81d2176013cf3b0b4c4aa\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"0eb9568cf0385cf054d8f3ebcce089d8b225a9fe1b6061e3689f7bd26415f872\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"633e4cdca29207ccc8220565a86635db5bf3f227ef564ee1a0da6a5d6076231e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"ecaead2c94524df89be70a7c961f93dee41ef96545655d22914542a89dffe341\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b9f3d06eb6a92218fa1757dab6cb8e66e42102d46c94e6c0db854f694d6d855c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"78abae9e2e773a05\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"78abae9e2e773a05\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"7054423a069def7a36dcb993faa1143223d985021782b2552d55a522caf2eba9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"deac1d64e5b84f2fc26848a49153d512090eb1e2bffb72dd7091fd21a1234e18\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"3dbcd4467449162cad999d40988202fafebe535215351d004f1bf05937c76508\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"534f6056dec477fad33defb3049c84dc5497dacd9f6e3f2061b13ba089ed1cbd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"fa823b540319ebed6b9b488f79dda81b66933f7e616cfdaebe3543ae31b33b13\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"fb6ca2eee2169356e662d36e92b2b679a1235a86d976f9807297ad56386f6e2a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"0427c8054235bfb15b63a5a467ab470ce1cca867b5a232117e73059a4ec8891c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4aa2417057e81c2889811e45d786ab1591e3dfafc889b838aad26a3ec2cbfe9b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"acb4b8def068bc86711642e3242fd621a66a54452bf86a82586fc6bf69e8192b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"66831c252eeacbf3e19995c48be4a005b1726766550076c58cb47b979bece639\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"a80090acc18b7b092f5e9f2d49fd8643f16514df89a716f8f69afe4a7afebb76\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"f85e753996f9e90384b461c5504814ca0cada63ea0f44d6630a619ab36edbe08\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b72a3d2d64d0ddc05f076a7fcf59d924552b45080846c09e1084e67867a76e9c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"cd58d9e2c4a744adbc8ab336cd016f27bc1f14a1de2e975afa26b7f5113d1bfe\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"78abae9e2e773a05\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"78abae9e2e773a05\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"29c80f1787fdadd41eb24cbda56972d49e35d261e06b4f4fcd5851c7e2de3068\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"78abae9e2e773a05\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"78abae9e2e773a05\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"277489d8f3c2c5149e18b965c81958774efa7e81299a66265853d6af2e16037b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"7c211141c74fe1e91cc494ac860a81616dc49e2a5d1951dc70bf0f42824d53e5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"17df13edb14ef5c49ef0cc29deaea97728695c57b5ccad8feb2b23589083e083\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"014f0c5a15872002db778e7e40dfcf7dede4ab2db05bb6a08641f5d523cb3afc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"bdac37244e7b891cd2973e74c7b0db5110c344505a09a86e51fc6486ba35139d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"ea8a88726b68ceff7de514d89e12df024a67856b697e02c26b6e762395fdaf0d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"81df9bef1abee093a91a2eaab4b1a53122eb16d4150f27c879439ca5d99112f3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b3be2474c46178c0c39839b29d8d7c87b103574b042bb23175ac0e9786fde158\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"13fe2d56bb22ec9a1307da7bad05cdda8724fe788533352aa581ffdc96874c78\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"78abae9e2e773a05\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"78abae9e2e773a05\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"fbd262e90a5eaaf98d72db889488cbe13bdac9381f78343ea46c402679569fb2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"9794c132b0cd770efeb9723db862265df6a3584117821e44e2a5660a971c59eb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7def4ca304ff3869be64c2c02523fd9d2ff43465099dcd1124399f293eb4480f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"a86375603000eab9b808785894e0e63f3e53024a46681e97c41a06c4e0c67023\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"54eea38241838159e47386cb814ad20fc30631ee8c42d57f0ff8da80fbbf62a0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"d5b69938a04a8020c8a8d10df4921f2989326ca4811c3843a7201bdb1d5cb848\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-unconfigured-model/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c5a685f2a5ebdef5f1dee488990c0798a45ddce399cf99e7d0c505a5f46c69ac\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"0fcfc87f76b773c6a38375e46d76e569a372370e3ae2e7003932ed8ef776f5bd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fac07f302f653115fda3d376325a268abaf66025ed0e4af73e88bea3f41fe933\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"aa28eac51fc5e37c385a11a534759b09fb7998ba74bb01195dd8ff89d9e9ec43\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model-2/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"06165835c4461c0b16a2bc5bae936aff3c2f351edbef8aa378f1110874acedfc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"17390f436804c5d305f1dcb9ea78a72032310736cf630bb9589448f605bd1fd6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m-premium/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ad8714d3b8aed2a9ffd68fbcf0288557e9c1c059c1b59ad3e9a09910b37fd61b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"c4353817d988db43a8dd6b0d5c29305f9dcda76e19c9ef2c820808b0384a0bf4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-embedding-model/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"726a74c13fee356e859d9317271facbb60b066acbc5571de22d056f13c60878f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"1415e0d2aa117656e44a7d6aeaaf16aa87f18bdeee129f7e6757b2e1c7f996d3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-trlp-test-model/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cad6ab5a81a65fd4cb03a0fefdab5de82aa18c30a5b95078b1d05214b0606f40\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"0629facd48a81e3c82281be4a3f8566f55e61d1a30a8516b23bbb63c58e8f6f8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e5f81c7f7812462ebef000c68dc043013159f22201d2eeecf05c220e809f96ed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"2e292ccc99f990aa723c04a99267923f5b62fb8f3e0ab1a978e8334b9397ada0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-unconfigured-model/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"68502d1c1143a647ad56f2759ea89a4c5b3c74a8054739f7e7ea9ba6535e3b74\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"2b69b629cb2b5224adc61a8925f43333ba0b52ab39260c124057e9e82898937f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"74b47f1aa1203aad58596cbaab10ae46e8fddd08ac49eb57a26bdba532d88e72\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"d1e427bebfc099de9df176c73ee76d5dbd6f77919e840913d3a10818678c7394\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model-2/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3167d3bf853032a93e8569019dcd3e5aa33af9cb580cf9ca138990567fc9d857\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"482d2a79771eafe7f8d177701f43a13c6c4916251440ca00830042e050247443\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-unconfigured-model/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"99606c4eac496429be47144db9f3f48867815df12eb99d7be8073b767d7e44de\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"e635ba9dc59ae1e09b34ee6e0f2718b1c31e6f6b6ff2bc6d05c094fedc42c40b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m-premium/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5d590119308c6f848b12dd3ecdfb1b06cc2fe172af702455c342075944a045ff\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"caf1a50009b65f25df3a996283d38ada17bb57a2ebed842a552f137f6121c63a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-embedding-model/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0e042276580ed8976d8ad3afd87a71640025c28b9b48f5c88eb159ec9998209f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e17697b7e023603155a06feebe0602591826e794ee2f5189abf795c259be1b37\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-trlp-test-model/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0829dbf2b5dc0900de272826295adf351de381b46fa6fba00b896213530780f6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"1e772a79f4b1660c75cf3493e21c9ddb58d2de640363115c57dac03a10f22c33\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cc1ffc2ee4e05618c28c108cac668c0c02eb8e658953439e47a733edab44a1a0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4fe1d1c6df78a26f30e2392ae9da7fc67b0845dfda48a89e247bee6aa536d8e1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-unconfigured-model/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"486615827938fa99814e929fe7dc62bc16f7563179fef855074eb73dc7ce4724\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"ee2f6a8baeba450552a3e168b9df1808bba4e2c59106ad0881ae78aee4fcbd40\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-echo-model/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"98ec9d74d07c88c1e6923ed1cbafd4c5b41bf1763b3a942282f964f72425ae57\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"653f23106eb8a10791805e2f9355c750c56aa6873ef311fe707e76083d93d55d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model-2/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2ddbced6f2f51d410743da1d9db1257d0006d99f38986dd7cc7efd26620791ad\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"1e776cd43733621e16ebc27c91dbdeea062f73e4dde2f494701c85a6843faeed\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d752a44ad8df3a50b5a1147110eb89039ed764e1fed197b1f77e0935c424a90b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"62f67bf9885222d9a86a95e02ed17ae26ad7cf71e15aae0a7517e647c29618ca\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3083301b5359be118f04faaefcd72fd127f2297a3374ef7231b59a59a31b405c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"e85460469045801c3e6927ab49333ff01612a4899d5a7c29ec27824b9942f3b9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m-premium/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"67c67ce733de50e7b3d797bb248036b01badfe02e958f5f76af05b58a504989c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"f9b414e31cae5d16cc1ad22ba2462b8816d9369a97316f40f32a6e7912fc4f78\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model-2/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2d4a2275e6cbab5c26d5c3cf2d75aa2776066390e5b66f5498b16b26bc596af7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e33110b3dae1dd80b2bfa573def0b488a6fd4f1243962fe81d58e1853ed2d3f5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-embedding-model/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"23672b974f0dbc05100a34c78d2b029e41f1d5a3752f3fcb52915f56db360e25\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"a6183db94e49e3ba0149a19f4e52ff19aebb55d6261b0cacec0656136bd2adf4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-trlp-test-model/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8274337fc3f0de48e5213819aeb4a46559c4f8b3428c1bae43c0d75207ef5264\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"78abae9e2e773a05\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"78abae9e2e773a05\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"efcdf81b8f74d74207beb897f447376d1f950ae12e8a330f1ae67b0d9dc6a545\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0e89fc4b75d3a5dd95fca2c4d8ae33c7826f05a8016c44eb39e28c3c1860fcfb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"7f0f599e497ae797f3b5922614ceddb3375c007237412d01b520bb7498ef288d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/premium-simulated-simulated-premium/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ab505bdf28287fe00099987c1bde2c2f297c40c792a7f6cb5fbfa5adc44754d3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"06c1aa31be81b1f5c6266514c955712865b30117291a39dd749994f4ce931145\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m-premium/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1704c6bc15d6f547acca888061680f2275f690cb79e5af6fee44747bcf278b95\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"6a8319194e2c2fc998268cdbab03a5aae2d83019f5ac30c316c4e548895b7c63\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"eaeb360b41b3f9e0bd6b247d4dae3eef1ffc3355d6e9408df3f8f71bc7f033b5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"32cfee4e66c307d5ebed6a406d2260f4374553d184b5486fc53cb64bc6ffcd8d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-embedding-model/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"135ffad9bbcd33779a0b9a1c0dc5d5f547356be21489762803640aca855c728a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"3194cef788c3fa9898599a57480aeaed07c6eac2edf957788235b37d22918588\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-trlp-test-model/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"17002b7f0c8e62582ad262d9c2b8b038ee7f2a9327fe34f21fd4f47134b7b8cf\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5acde2b886749c1c54f99db5c33887e6fc5ed0caf412daacfb5df0f329882c66\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a6a6232fd5656520e75d100c41add5f1637dde9705a4ec608bbb90b724c258a5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"37a71c27032e51fdbc7ca688064a47abb86230a8138af6eb55e8069fad975a93\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-echo-model/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"92917da87eaba4f2684cd45947a3698434b99ff4ca6d3ddde51d6573aecb1600\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b2b26e0af9ad7defb486e5d1db19af6bbdd0998559d16f3776651669aeb4d067\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-echo-model/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aa7038625b8f43b0c002f79637065e5ab90468f50f998759d08f2c4640c07c04\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"78abae9e2e773a05\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"78abae9e2e773a05\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"2a62f0614f6526bc3f195f838aebd1abe29514f2707db40d9ef738d645ccf001\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"de97dd5d45c6eb12b4a1112ed1f362d8544427428d2249a399e26ba069d6aadb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"22b2ec7ec96ee09c9e07a84cd3d313c2223af42433bbb28c5846401f64d5e3c1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/premium-simulated-simulated-premium/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"dc061bec60bd28b1c132bf30965b4810124429576337bcc4a6030617600d1714\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b188b939a496049e47b8ef664d7c7c490722f1753404a08d89ccec1dcb87b8fa\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-echo-model/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"75612d85af2bae456dadd78163b2d2f9015c0a0bf4e20bcb8a555e6a5ab3b8c0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"78abae9e2e773a05\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"78abae9e2e773a05\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"96bc4fc13cb63707a942ca33034f78d2b39476a10860398523789db3990584d1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a4493fc88328eba553ef36791fbf4706bffae04a1ac501d099b12309ebc85c6b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"d84e45c7a3e370ea510e8e0294e009b29bc2f2ea789c47559293007b6c4410d2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/premium-simulated-simulated-premium/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2d953f7313807988e63546aa32431d96f77e6989c672f8ab42827c1c21918630\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"78abae9e2e773a05\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"78abae9e2e773a05\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"dd2f15d9a08862ab664dadf9bf5da25828d327a11a07849fa919713f034c2b0d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/facebook-opt-125m-simulated/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d69b9c128f599c9ea1af84bb3e783ed71688baf6b3ad2b86f2b7183f9a4208b9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"78abae9e2e773a05\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"78abae9e2e773a05\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"4dfeb9ff2318af8f84e70b11545800bb83948c080a97ae1ece5780d4022bb383\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"dd89509e97b96670685602ae2d08749226db8693944d2c6f868af9d3e0a5feb5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"1025db78adc8b9c9592b692cc227b1a306a99ac5502300d9ed4ed7615f5e3ef8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/premium-simulated-simulated-premium/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3386c5e86c72abcdab369776ccd7182024ab8681cbe497e81724868f101a3c0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"58e90354179740b1af406b2911c9997f3f3283475aeb77ce7918f3b3239a293f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9e75e9fd02f51c2f043b145c5d6b82e95f1447b388ee529262aea27a6a2774ef\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b89d1075a79c93acaa097e4e6db4d6a4b23bf3ffe5e964409e29b258ed725a99\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-2-simulated/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0913a452a02695c6681f1037232199b40b64236fed4d29cdbb41561695826340\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5c0b495d1a10c1cf1548ef17998cb18c0ca25371ad42d5ffe1aed42bd55e31ad\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-unconfigured-facebook-opt-125m-simulated')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"010adf02b2e7deb40c572f4729b6dd4619847c8e6344137326b72df28772fc1a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"c04f8a7c7387e6794115c41161cb001d8a07340d2878cb8f36774a8f6a200ba4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"105cf4dd91a8abf4a93abd65b255521c3d37b560b5d23f3ec59757b5b362fae6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"7e7d1a0ec6d957a4d4de94f93078f10e836b23442c9cfa90f11c8520cca12e87\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-embedding-simulated/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"75fd86e2a4870af5fd78f2ad7aa2a9d79aff977b3678d81954b1e207a9315f2c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"c3cfc634a11046a837448628e2f17db0ed3466194da289a808544d874ecf6451\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-trlp-test-simulated/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"54cd0149b818480305f3d0024b3c95629cafb641b48195d003b2b7006d5c6bcd\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"f5bc618bde549671e84473b23ef3632426f8606e2045744a860c603f2a7675d3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bf65ad13397c94660867eb0205e06d1c9bebda4b019f632c0d0b8ef989930381\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"d8d67afd40f17474755bd3f6b00e265761bf5154febca129bc3f2b0bcd749c41\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-simulated/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f9fa9cfc2b4e701183573419a92c79384cd30210289602f0115c75c5029d55aa\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"ac2105eead12bb02dd7d1691cc77fc8a580b903f98564a8fd585dfa345dec1dd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"596921ddc7ba8523386263c5cffcbd6ad9b6a385318ed7e24f72be06f36fc398\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"f4ae34c5c82a0969651301a535f404653a60a5d75f20c7ea56ad9bb89b67e9fb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f95805f0e9b755664735d898c1d644d571943be553204d3f86136bc35719ff13\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"78abae9e2e773a05\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"78abae9e2e773a05\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"95c39f44eae69bd53f57e5ff93243887dafd591c9b8cf2e736f0ab034e67021d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/facebook-opt-125m-simulated/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8d5571efc1d304f5bcfc2ffb4ac6819154ba5556c29ce33416d460b887427984\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5d6b359055267732253f201a1fe48f0abe6d5e22b011c70e1cb006eea672f535\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e91aceffc2d4f6d6b120625bd3ca23781b74a1cae6cf1da26bda310bbed0ef07\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"78abae9e2e773a05\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"78abae9e2e773a05\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"c8475d27649a649c955538ff79eb001372050ff4f1d4ad295b01dc6fcc69ba2a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/facebook-opt-125m-simulated/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a402d1681ab35bace735c19b1d084a86eb3d741d4e1c14371cfdaa55d22c3ebe\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"7320c049419b863194fd55db5ebd887462dd24e1289e6308d79f047431f2bed9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-2-simulated/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f9b535aed6243496a67741936e53a0d303bea1b872a06fb62f1f9c27150edc40\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"78abae9e2e773a05\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"78abae9e2e773a05\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"5eeab80447ec6c71797517b4d94c6623353e89097743360eadd7f31115976dfe\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/facebook-opt-125m-simulated/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a9800464506c58f005016df354e160757732171ff4d19747202524955329b998\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4984a24eb707d1b965a79974a98ed4afc271f2ca356b150cbc8943de1ddcfef8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-embedding-simulated/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c82a1a3dc2ce54c0b664f79a2cd895a3c40f774b3694999badae8cedd328292e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"276f5d5d67b2bd83c05c2b39e4a262885498e6807e3129a866eff0651b3604a9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-trlp-test-simulated/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"669658556fba0f45c2a82def2f57614416614ddf154ed8dc5f4f9188f10130f2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"692f39321f892929348fe56801dc14c8a35eaf749609a3a5f4b5e684edddf17c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-2-simulated/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c4399a95e89654e5b2bb5fabe45bc947d11ccd1448ebf64c30b195b34f239d58\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5b273834f06c6341dd07bba6c809b3297ba2514e6d3b9b5d0f4f8211c68ccf8b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-simulated/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5e4821ff903ad6ca2e1c42162432e34d8b0a2a78052961e753d36b742193432f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"f35ed2fb168a3a608435006c8c1b103242765d7d37f41bf1dbdb7bbc0331da89\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a91faccafad197e2a4065ce3d12a052ac484d2e8fb2fc9265ee48f02b28e6dce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"fbfd0ada86117ffb0a134e591bf8b8390012983d25496ef188c6da73fef5eaec\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-2-simulated/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0020c64019ffd1a0bdcc75e6441e6a30e6d8bb08f463f67bd2408a1e82b95b2a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e78a4964c93ec23890e62f7f50201f5b832b4c714066a914dc734d8ef60e8213\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-embedding-simulated/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7c924aa2b37ea38067b4e69052d541ea2e7c86fbdaa79b19f9ea09e87adbe4ff\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"d5cf96eeeaa56bb891ea0cba28f7beabf17a8c0f061ea01c768ed842dd26334f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-trlp-test-simulated/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"028a8b5bd5d4e690eebb2f20c5fd47cf0b3c6e2a3619ba9e55322bbca7b94cc3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"8fe4100eab1f023f5b06dd8e19bcc80109b82503466d49576acc234cdda9bf0e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-simulated/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"80056c658070f49140955cb6eabdbd252857a614af6b0f2f2de7a1ab1cd47949\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"53aad0199369eb8c8f787ea099e93092089c04344e8f910dcff366f54bc831cb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-embedding-simulated/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2416d7b42d11a09d7152746be0e114f8fdc87d0fbd0efa9dec5b52b011082194\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e0cfec53d1f17771317082d9a7d69806ae3468971bac79a1135f2b0d51ecdc07\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-trlp-test-simulated/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"50c2058cf11e07a931b06ac4446a56eee86855f00badf26618abe486a7bdcfd7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"78abae9e2e773a05\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"78abae9e2e773a05\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"f3b6e6c38a521fae8ef5c7fddf3b3178baba88effb4e5338e0b387e28ecc468d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"134a7a790ba665547ca14f80f917549f66ee5063fc41096471c0778399db6dd5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"4ddd3fa1f54c642a57a48737e710ec0116705776084d8cebd8134dfa49accdde\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/premium-simulated-simulated-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4d18a96899c43d55ee63d2ae1a7a938c7e873d88b2fd95f06b2e3aae2c7f1c84\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"44e38055536c3f0d49cb81abb42bfefcf2c78faf963a6160afbe459bbc04db39\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-simulated/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8d34bd12ba2030284fcb69127f53b8158bbdd4a1432bfe619165b4c2c96cc061\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"c9dd9c233e43b53241ee27e937246e51b8f3331f30a7fba22640617c1b0bf47a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/echo-simulator/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"319e246831bdaf5e765e63d5511b516594fd2b64527850e2ddabd2a4a85532ea\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"7cfd2ed5cb8a5913fa5f55b92b02805c6778991c01c80eb14a0962cc710a56ff\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/echo-simulator/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a8c8220ad6f1387002e262ace5db78a2c4bb39e5953306702a228215174f6796\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"87e1712d02794c6d66ec1a932f02901d7a4369f46d0f041178cd3efadb7f59b7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/echo-simulator/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1e077a716d89a43572a3c16e8d0b0436816baa48a2ea227603701f10cad6d6f4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"78abae9e2e773a05\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"78abae9e2e773a05\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"ae9eac2a2b8c8311bb8c6ea82ab445a5d6f50d2d51c3f79962be9d82007097ad\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/facebook-opt-125m-simulated')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3f23315aacd6e16f4ab41f96aeedc9549d1abdfc9476577a47d45d12875dec5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"165d3b8e224f71685dee07aadd133117aeeed097eae99437d561d5bfa2d22233\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/echo-simulator/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6687eb3cec74c6c51428ce3f3d22d50ba269f59015d1bc8f185da49eb095534e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"05ac0e89d0298398d3996609d7c22b514bdf08bfa3787653bc739995c5942441\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-2-simulated')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bfd36c5ed73eb81df97258ffa1aa36d8cbf6f3e7a8096c33ca4ff417be59d002\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"d5ac583036f3821c88111dd82571eab1fc94aa4e9fcd045b27336f798e26075d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-embedding-simulated')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d303c788902ad4467c7ae545d65cbef45564d1c0d56396c93057df3909461aa1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4a6b0d84cc35c0f532405eea81056481fd54e7ad71284a97ce8f6a2424eac819\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-trlp-test-simulated')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2f53b030326b8e1f5908c601aecd3fffcb6d08a8337d0bdc53ee1fc699a4cd71\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5c3bcd9fb119b0fd45f3b4ba5de5f905cacbb4963fec309a0961a40f76a7a7a9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-simulated')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"94ddc5e77f082c32bebc7a36bcebf621518ebf303e83b9c540da1352d04e620b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"50057c9a2acf4ae7152e8c97f7778cb04340d1470974e5272422d0bf244a4e5c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/echo-simulator')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c6918972d1a7f8ad5201880b7d6d9c1191ca1f25376682f691def7868e3fd02\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"01cc37113b4d6c301e355f63decf46a21e93a023494bdfeaeed2890c97ec1f57\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a82769ff87473da04c27497e160e9b4b1a5dd93578e0cf2342be8b2f06845269\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e747b72d92315b743934153588614b27670cf0c9d9dc4fb380ea4965def7f235\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"06b05a8e4dd69bdc4f333ad9509ee8cad3c5c0f5dd48edbe94c1158b60f79ed3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"661962837510c6dc6d1faa64e61ec3086efa9e0a2e7315c6ded616c1879e5ba8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b4bfec1b33959dd0ebfc5cd6fb410688e820d4b55c7f149cb4acc4353f30a9b2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a7740f6e77d024a437502c023fb1d8939cb3cc2b9ed7f4073af7d779e19459eb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"f82564e076ea3e672592bab71e048537faba17a5e909884c2a0204e235905a69\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a908063c86927e6bf07b7d793aad9f277ac3c2a8f5f5d468b116cb9e07929b14\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"fbdfff5b213f506d78434055d011cf63d616653e502ee04408a43578986e1e5c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d1d232e06f90d479cd9b802f24889e83af58c51cf54ba273d5e24dcb8a297688\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b49f2d7e152d4de959577465d2494ee11771b4c439cb6eae71c90bff26224fb4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"810f299b76daf089b33c92cfbe0445ab5cc89a48d38e36df0cc89ed6cd1fe8df\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b27d6255cac73fc039120e157e1f3ce0e99e86995ac5a66974d5e8744df6c64d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4f800155f293f82eeaf5fd6a9553c0a1bee90f47a295bba8d7a04b3f11faea33\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b1ccc7ca46f6a14e90afe1dddfab8763f07f30549ce1cda0bae985581f063098\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ce7d381faee9ff949d68d825ffa1dcb9247dad19667ec59a8e91847320dacbe0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5d72fc7cc241ffd60d83142a900be014cc5d57320142e013493b21ecc86cb534\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6565c4085b3917d5390fe1b0194fb3d8319f1d56b45867e3c68ff740b5c16ef3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"be1ccea8a4cc19c7190600de6631fcb661b63db81e2862348a6ef4f90bf33fa3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8d8c8aae1332bb0300ac2d65be9b8708fbfde6d4b5599ec52380cf1f70956045\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"78abae9e2e773a05\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"78abae9e2e773a05\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"ca48ea5d9ee701ac5383800306378d945e66ca5427eba33396e6805ebbdc1ea7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f6df6bc14432fdc346191db86ee06e75c8090ed87a32c984493c837e97a10be6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"fc54a1d4f18d4d59e58b6a3aa31dbfaddda2b89e5c28dc9eacf14ff38a414021\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"maas-default-gateway"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-maas-default-gateway\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:40:30.180Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w1-5f765a","namespace":"e2e-models-e2e-worker-w1-5f765a","uid":"7188eadc-9748-4be8-a5e2-d904cf5b6130","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w1-5f765a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:40:30.238Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w4-d6cb38","namespace":"e2e-models-e2e-worker-w4-d6cb38","uid":"0d3ebd35-5005-4ee4-a055-ff95546e3673","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w4-d6cb38\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:40:30.296Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w2-6fa533","namespace":"e2e-models-e2e-worker-w2-6fa533","uid":"3a128bb2-de88-49aa-ab9e-c8626107a077","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w2-6fa533\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:40:30.422Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w3-f51151","namespace":"e2e-models-e2e-worker-w3-f51151","uid":"c78aa03a-e3ca-4797-8a09-ab0d9cd88148","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w3-f51151\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:40:30.549Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-facebook-opt-125m-simulated","namespace":"llm","uid":"da8edb1a-ed61-454d-939f-fc7cd235d9fb","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-facebook-opt-125m-simulated\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:40:30.727Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-ipp-a-54e844","namespace":"openshift-ingress","uid":"b32a7504-b428-4788-91df-217356ebe33c","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-ipp-a-54e844\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:40:30.784Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w3-f51151","namespace":"e2e-models-e2e-worker-w3-f51151","uid":"e3340067-224a-43ad-8020-ca9e00ead152","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w3-f51151\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:40:30.842Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-simulated-simulated-premium","namespace":"llm","uid":"447993be-3c57-4e68-8ffa-6fc998a39c77","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-simulated-simulated-premium\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:40:30.902Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w2-6fa533","namespace":"e2e-models-e2e-worker-w2-6fa533","uid":"2ff73667-c2c3-4579-9503-b6ca098f1021","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w2-6fa533\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:40:30.961Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w0-0c9014","namespace":"e2e-models-e2e-worker-w0-0c9014","uid":"dcb5a0e4-7049-4ddc-91de-e14d55b09789","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w0-0c9014\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:40:31.019Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-ipp-a-15253e","namespace":"openshift-ingress","uid":"79cea698-ef77-4328-8e5e-94fb3112db27","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-ipp-a-15253e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:40:31.077Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w1-5f765a","namespace":"e2e-models-e2e-worker-w1-5f765a","uid":"9c852546-ee7c-4e72-855c-111315f7bf82","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w1-5f765a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:40:31.135Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-ipp-a-e12f99","namespace":"openshift-ingress","uid":"586f6ac7-72ee-4a5c-83d6-b9b39b674005","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-ipp-a-e12f99\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:40:31.193Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w4-d6cb38","namespace":"e2e-models-e2e-worker-w4-d6cb38","uid":"486176e6-7786-40c4-9ce0-6f4a68b408b2","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w4-d6cb38\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:40:31.251Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-ipp-a-7d3617","namespace":"openshift-ingress","uid":"145eadb1-b934-4484-bb5c-a149bec3181e","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-ipp-a-7d3617\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:40:31.309Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w0-0c9014","namespace":"e2e-models-e2e-worker-w0-0c9014","uid":"4f647df6-1d5b-433b-b4fc-1279ff1755f7","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w0-0c9014\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:40:31.368Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:40:31.368Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:40:35Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ipp-b-4453bd","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-b-4453bd","reconcileID":"9f47612e-11a4-4f85-9a50-cd8c2bb9d7b7","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-ipp-b-4453bd","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:40:35Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-b-4453bd","event":"CREATE"}
{"level":"info","ts":"2026-11-02T21:40:35Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:40:36Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-02T21:40:36Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-02T21:40:36Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:40:36Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ipp-b-4453bd","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-b-4453bd","reconcileID":"2490cd0e-3273-4c63-b913-f714ba1c754c","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-ipp-b-4453bd","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:40:36Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-b-4453bd","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T21:40:36Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:40:36Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-02T21:40:36Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-02T21:40:36Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-02T21:40:36Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:40:36Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ipp-b-4453bd","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-b-4453bd","reconcileID":"562c338b-4dc1-4deb-a426-8ebba439b696","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-ipp-b-4453bd","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:40:36Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-b-4453bd","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T21:40:36Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:40:37Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-02T21:40:37Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-02T21:40:37Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-02T21:40:37Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:40:41.989Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","Gateway","HTTPRoute","ConfigMap","EnvoyFilter","Limitador","AuthConfig"],"eventTypes":{"create":3,"delete":6,"update":20}}
{"level":"info","ts":"2026-11-02T21:40:42.236Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:40:44.439Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:40:44.523Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:40:44.523Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:40:47.366Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:40:47.370Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:40:47.376Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:40:47.376Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:40:47.376Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:40:47.378Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:40:47.532Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:40:50.299Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:40:50.299Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:40:51.758Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Kuadrant","AuthPolicy","TokenRateLimitPolicy","Gateway"],"eventTypes":{"create":3,"update":1}}
{"level":"info","ts":"2026-11-02T21:40:51.901Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:40:51.967Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:40:54.425Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:40:54.638Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:40:54.731Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:40:54.861Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:40:54.861Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:40:57.942Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:40:57.952Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:40:57.953Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:40:57.953Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:40:57.956Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:40:57.959Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"error","ts":"2026-11-02T21:40:58.011Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-ipp-b-4453bd","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"kuadrant-auth-e2e-ipp-b-4453bd","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-ipp-b-4453bd","uid":"e0d1a8d9-11c3-4552-a3d5-90b1f7ec1b9d"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-auth-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local","port_value":50051}}}}]}]},"name":"kuadrant-auth-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-ipp-b-4453bd"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-ipp-b-4453bd\" already exists"}
{"level":"error","ts":"2026-11-02T21:40:58.012Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-ipp-b-4453bd","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/ratelimit":"true"},"name":"kuadrant-ratelimiting-e2e-ipp-b-4453bd","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-ipp-b-4453bd","uid":"e0d1a8d9-11c3-4552-a3d5-90b1f7ec1b9d"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"limitador-limitador.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-ratelimit-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"limitador-limitador.kuadrant-system.svc.cluster.local","port_value":8081}}}}]}]},"name":"kuadrant-ratelimit-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-ipp-b-4453bd"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-ipp-b-4453bd\" already exists"}
{"level":"error","ts":"2026-11-02T21:40:58.064Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:40:58.064Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T21:40:58.070Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-4453bd","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-4453bd#rule-2"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"d25e4ca9fb5f67f329bb4d092a202ee425ed3b0ff584d4ff9a34ec9976652c2d","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d25e4ca9fb5f67f329bb4d092a202ee425ed3b0ff584d4ff9a34ec9976652c2d"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-b-4453bd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-b-4453bd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"d25e4ca9fb5f67f329bb4d092a202ee425ed3b0ff584d4ff9a34ec9976652c2d\" already exists"}
{"level":"error","ts":"2026-11-02T21:40:58.138Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-4453bd","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-4453bd#rule-4"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"2b90ffde2a26d5bfc29d5a740d3931daada09c605d0d365ebb8f3d2918722297","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["2b90ffde2a26d5bfc29d5a740d3931daada09c605d0d365ebb8f3d2918722297"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-b-4453bd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-b-4453bd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"2b90ffde2a26d5bfc29d5a740d3931daada09c605d0d365ebb8f3d2918722297\" already exists"}
{"level":"error","ts":"2026-11-02T21:40:58.238Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-4453bd","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-4453bd#rule-3"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"ecb83226ddc442b7ec436cabc64481486887a4748e0f54bb66b0fd9f9e8e8268","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["ecb83226ddc442b7ec436cabc64481486887a4748e0f54bb66b0fd9f9e8e8268"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-b-4453bd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-b-4453bd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"ecb83226ddc442b7ec436cabc64481486887a4748e0f54bb66b0fd9f9e8e8268\" already exists"}
{"level":"error","ts":"2026-11-02T21:40:58.329Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-4453bd","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-4453bd#rule-5"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"003e08921762e20968cfd946973c5ea6e643c88466c6add012824438f022dc56","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["003e08921762e20968cfd946973c5ea6e643c88466c6add012824438f022dc56"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-b-4453bd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-b-4453bd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"003e08921762e20968cfd946973c5ea6e643c88466c6add012824438f022dc56\" already exists"}
{"level":"error","ts":"2026-11-02T21:40:58.399Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-4453bd","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-4453bd#rule-1"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"b22a97ec9de03574378f4e99bbba4d4f52f0674b9c50664d43680da7e072c8ac","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["b22a97ec9de03574378f4e99bbba4d4f52f0674b9c50664d43680da7e072c8ac"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-b-4453bd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-b-4453bd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"b22a97ec9de03574378f4e99bbba4d4f52f0674b9c50664d43680da7e072c8ac\" already exists"}
{"level":"error","ts":"2026-11-02T21:40:58.466Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-4453bd","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-4453bd#rule-6"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"429418e4bf958099ac3a6c51c2a84b0587f09943c66e921492d2a56b3d4b7eaf","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["429418e4bf958099ac3a6c51c2a84b0587f09943c66e921492d2a56b3d4b7eaf"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-b-4453bd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-b-4453bd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"429418e4bf958099ac3a6c51c2a84b0587f09943c66e921492d2a56b3d4b7eaf\" already exists"}
{"level":"error","ts":"2026-11-02T21:40:58.728Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/maas-default-gateway","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T21:16:03Z","generation":16,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"371b36ef-c4b7-499a-87db-1bdf4e8f92de\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:40:19Z"}],"name":"kuadrant-maas-default-gateway","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"maas-default-gateway","uid":"371b36ef-c4b7-499a-87db-1bdf4e8f92de"}],"resourceVersion":"58591","uid":"86b5bad7-2bb7-41c9-b2c7-bb4c8f13292a"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"61b044087f8d56658ae99d15d4fab3cf1ad74e6636795c133e054a5aace0540d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e511d90f2140d9cde0b2100a0a488dacadd8f510bb901601d5e6fd25343a0f1c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"1e42d143d6033a677e2aa0de97c78600094e515d7c0d3f86b4925ef8be636163\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"26b7799af8a40e8b9585c255ec018a63b0074c27282d4dccebed45f14e703b5e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"ce74c295ef1588342c7308478a1dc6f6aa2cefc063e489a124e536ac32ecfdba\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"fbe95a07558afcf05ef68ff5beb293f527d6ab93dfe79956b5406dc463d78363\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"40a29ce438b5ca497e4389ce52025a9b91c0cf3177b1bd5c8519b041cfdcf75f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"845137604829fbc62550504d7bbe5ae8d55ea1cf474160cd789a72e811000e4b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5322619ef71b1d1ea3204f9014d0341d4402275b6ca23fca69d61cfc9a61e883\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"16b86e50920afda06ca195a717436238f5fca7f2e1bbe0939875bcb7d559cf31\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5da9070dfa3a5637213b5443376170dda26f57f381af542891ff3b19cc7a9d06\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"00ac1aeee65e93fab2ccfd89c11167f4d954e1cfb3e8b09ad3371a4fab4b6369\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"55c23b9552cb66c175ed2202220df6480eae89be2cda2e925458acf31c5bdbce\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"99f16470bd82ba57465b128d1c0fe73ef189001d77c6ead3fc34c98ad3ce27a2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"a6d134df42d4d90d93840f63dc770cadabd22dc22af01f991b6c067e96733c95\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"0be74a5083c4760789001949965ce7020664f6347b769f9f20735f95f9d34989\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4902f5a84509d49ec2fb75275af9692b524b1334f7c919eff1d9f33957acd5c4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4f0e9d14c4d1857d5415458306310b00d6a94ce68179c717917d13d30ede9b87\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"29d1c55f30b76c66bfb15588c297271fac7d5e9ca415f0c938d63e524a8187e5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"df729ecdaa88f0abfee16b94ea7be9c5aa7ccdfe91fbe0676e22ca4bfae35f29\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"69baf76a5f2e8f4f8d3e40025586b942794274a22455dc40e0b7c0116f0d2297\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"8199294e302361a6898546d62809d67d522e9c2b375c8b8727f0d966f7ad4d39\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"61ef91ec2e76cc107813a7351d7e38bb32d1ebbff452efa771b01f8a512fb99e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"f2d9c20918355999f92bc489c836e0d17ed8acb713739da4b73fc8ee019fc8a4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"c19d17a63dc280a83fa4dce8ef0f825a16118c6817d3126d095473335018edd0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"05aa8311318e9111c5925f4be454406e209ab832bc6e8ddf01725ebe4f1ffdcc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e680857c19914d59f115788ea93836704a1ddab04f5e495bf863d62ad8a5aa8e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"96b761d418352e3f8d172aa80bfb5542df670414bec97704e615f2e3e665c8aa\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4a199d441e37ffe8d62509ae7048cfd055df0de5619e9be81a8f47f9a64a7051\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"f17cbb57db714a7faf03a7e4ef3921069096709486e13c6b84b4b75ded84ca96\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"d8631ed26c63871d1138b31e9c971d72ad1152273309b27ee33862700ff4fb0c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"67a5fec0fb2398a03579a732c5e4640c9f9c5db5385b91db90ffb49522369904\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e5b5be5a42ead835fa1a13840fda21cf5afb14b8226da9a3008a321db777f685\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"a01c6bf1aa626b04ec6a9fc85abb6ced9b4a9c4cafe81d2176013cf3b0b4c4aa\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"0eb9568cf0385cf054d8f3ebcce089d8b225a9fe1b6061e3689f7bd26415f872\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"633e4cdca29207ccc8220565a86635db5bf3f227ef564ee1a0da6a5d6076231e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"ecaead2c94524df89be70a7c961f93dee41ef96545655d22914542a89dffe341\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b9f3d06eb6a92218fa1757dab6cb8e66e42102d46c94e6c0db854f694d6d855c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"7054423a069def7a36dcb993faa1143223d985021782b2552d55a522caf2eba9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"deac1d64e5b84f2fc26848a49153d512090eb1e2bffb72dd7091fd21a1234e18\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"3dbcd4467449162cad999d40988202fafebe535215351d004f1bf05937c76508\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"534f6056dec477fad33defb3049c84dc5497dacd9f6e3f2061b13ba089ed1cbd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"fa823b540319ebed6b9b488f79dda81b66933f7e616cfdaebe3543ae31b33b13\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"fb6ca2eee2169356e662d36e92b2b679a1235a86d976f9807297ad56386f6e2a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"0427c8054235bfb15b63a5a467ab470ce1cca867b5a232117e73059a4ec8891c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4aa2417057e81c2889811e45d786ab1591e3dfafc889b838aad26a3ec2cbfe9b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"acb4b8def068bc86711642e3242fd621a66a54452bf86a82586fc6bf69e8192b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"66831c252eeacbf3e19995c48be4a005b1726766550076c58cb47b979bece639\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"a80090acc18b7b092f5e9f2d49fd8643f16514df89a716f8f69afe4a7afebb76\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"f85e753996f9e90384b461c5504814ca0cada63ea0f44d6630a619ab36edbe08\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b72a3d2d64d0ddc05f076a7fcf59d924552b45080846c09e1084e67867a76e9c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"cd58d9e2c4a744adbc8ab336cd016f27bc1f14a1de2e975afa26b7f5113d1bfe\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"29c80f1787fdadd41eb24cbda56972d49e35d261e06b4f4fcd5851c7e2de3068\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"277489d8f3c2c5149e18b965c81958774efa7e81299a66265853d6af2e16037b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"7c211141c74fe1e91cc494ac860a81616dc49e2a5d1951dc70bf0f42824d53e5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"17df13edb14ef5c49ef0cc29deaea97728695c57b5ccad8feb2b23589083e083\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"014f0c5a15872002db778e7e40dfcf7dede4ab2db05bb6a08641f5d523cb3afc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"bdac37244e7b891cd2973e74c7b0db5110c344505a09a86e51fc6486ba35139d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"ea8a88726b68ceff7de514d89e12df024a67856b697e02c26b6e762395fdaf0d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"81df9bef1abee093a91a2eaab4b1a53122eb16d4150f27c879439ca5d99112f3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b3be2474c46178c0c39839b29d8d7c87b103574b042bb23175ac0e9786fde158\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"13fe2d56bb22ec9a1307da7bad05cdda8724fe788533352aa581ffdc96874c78\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"fbd262e90a5eaaf98d72db889488cbe13bdac9381f78343ea46c402679569fb2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"9794c132b0cd770efeb9723db862265df6a3584117821e44e2a5660a971c59eb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7def4ca304ff3869be64c2c02523fd9d2ff43465099dcd1124399f293eb4480f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"a86375603000eab9b808785894e0e63f3e53024a46681e97c41a06c4e0c67023\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"54eea38241838159e47386cb814ad20fc30631ee8c42d57f0ff8da80fbbf62a0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"d5b69938a04a8020c8a8d10df4921f2989326ca4811c3843a7201bdb1d5cb848\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-unconfigured-model/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c5a685f2a5ebdef5f1dee488990c0798a45ddce399cf99e7d0c505a5f46c69ac\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"0fcfc87f76b773c6a38375e46d76e569a372370e3ae2e7003932ed8ef776f5bd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fac07f302f653115fda3d376325a268abaf66025ed0e4af73e88bea3f41fe933\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"aa28eac51fc5e37c385a11a534759b09fb7998ba74bb01195dd8ff89d9e9ec43\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model-2/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"06165835c4461c0b16a2bc5bae936aff3c2f351edbef8aa378f1110874acedfc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"17390f436804c5d305f1dcb9ea78a72032310736cf630bb9589448f605bd1fd6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m-premium/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ad8714d3b8aed2a9ffd68fbcf0288557e9c1c059c1b59ad3e9a09910b37fd61b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"c4353817d988db43a8dd6b0d5c29305f9dcda76e19c9ef2c820808b0384a0bf4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-embedding-model/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"726a74c13fee356e859d9317271facbb60b066acbc5571de22d056f13c60878f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"1415e0d2aa117656e44a7d6aeaaf16aa87f18bdeee129f7e6757b2e1c7f996d3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-trlp-test-model/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cad6ab5a81a65fd4cb03a0fefdab5de82aa18c30a5b95078b1d05214b0606f40\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"0629facd48a81e3c82281be4a3f8566f55e61d1a30a8516b23bbb63c58e8f6f8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e5f81c7f7812462ebef000c68dc043013159f22201d2eeecf05c220e809f96ed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"2e292ccc99f990aa723c04a99267923f5b62fb8f3e0ab1a978e8334b9397ada0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-unconfigured-model/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"68502d1c1143a647ad56f2759ea89a4c5b3c74a8054739f7e7ea9ba6535e3b74\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"2b69b629cb2b5224adc61a8925f43333ba0b52ab39260c124057e9e82898937f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"74b47f1aa1203aad58596cbaab10ae46e8fddd08ac49eb57a26bdba532d88e72\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"d1e427bebfc099de9df176c73ee76d5dbd6f77919e840913d3a10818678c7394\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model-2/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3167d3bf853032a93e8569019dcd3e5aa33af9cb580cf9ca138990567fc9d857\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"482d2a79771eafe7f8d177701f43a13c6c4916251440ca00830042e050247443\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-unconfigured-model/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"99606c4eac496429be47144db9f3f48867815df12eb99d7be8073b767d7e44de\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"e635ba9dc59ae1e09b34ee6e0f2718b1c31e6f6b6ff2bc6d05c094fedc42c40b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m-premium/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5d590119308c6f848b12dd3ecdfb1b06cc2fe172af702455c342075944a045ff\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"caf1a50009b65f25df3a996283d38ada17bb57a2ebed842a552f137f6121c63a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-embedding-model/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0e042276580ed8976d8ad3afd87a71640025c28b9b48f5c88eb159ec9998209f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e17697b7e023603155a06feebe0602591826e794ee2f5189abf795c259be1b37\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-trlp-test-model/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0829dbf2b5dc0900de272826295adf351de381b46fa6fba00b896213530780f6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"1e772a79f4b1660c75cf3493e21c9ddb58d2de640363115c57dac03a10f22c33\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cc1ffc2ee4e05618c28c108cac668c0c02eb8e658953439e47a733edab44a1a0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4fe1d1c6df78a26f30e2392ae9da7fc67b0845dfda48a89e247bee6aa536d8e1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-unconfigured-model/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"486615827938fa99814e929fe7dc62bc16f7563179fef855074eb73dc7ce4724\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"ee2f6a8baeba450552a3e168b9df1808bba4e2c59106ad0881ae78aee4fcbd40\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-echo-model/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"98ec9d74d07c88c1e6923ed1cbafd4c5b41bf1763b3a942282f964f72425ae57\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"653f23106eb8a10791805e2f9355c750c56aa6873ef311fe707e76083d93d55d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model-2/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2ddbced6f2f51d410743da1d9db1257d0006d99f38986dd7cc7efd26620791ad\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"1e776cd43733621e16ebc27c91dbdeea062f73e4dde2f494701c85a6843faeed\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d752a44ad8df3a50b5a1147110eb89039ed764e1fed197b1f77e0935c424a90b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"62f67bf9885222d9a86a95e02ed17ae26ad7cf71e15aae0a7517e647c29618ca\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3083301b5359be118f04faaefcd72fd127f2297a3374ef7231b59a59a31b405c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"e85460469045801c3e6927ab49333ff01612a4899d5a7c29ec27824b9942f3b9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m-premium/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"67c67ce733de50e7b3d797bb248036b01badfe02e958f5f76af05b58a504989c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"f9b414e31cae5d16cc1ad22ba2462b8816d9369a97316f40f32a6e7912fc4f78\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model-2/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2d4a2275e6cbab5c26d5c3cf2d75aa2776066390e5b66f5498b16b26bc596af7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e33110b3dae1dd80b2bfa573def0b488a6fd4f1243962fe81d58e1853ed2d3f5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-embedding-model/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"23672b974f0dbc05100a34c78d2b029e41f1d5a3752f3fcb52915f56db360e25\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"a6183db94e49e3ba0149a19f4e52ff19aebb55d6261b0cacec0656136bd2adf4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-trlp-test-model/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8274337fc3f0de48e5213819aeb4a46559c4f8b3428c1bae43c0d75207ef5264\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"efcdf81b8f74d74207beb897f447376d1f950ae12e8a330f1ae67b0d9dc6a545\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0e89fc4b75d3a5dd95fca2c4d8ae33c7826f05a8016c44eb39e28c3c1860fcfb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"7f0f599e497ae797f3b5922614ceddb3375c007237412d01b520bb7498ef288d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/premium-simulated-simulated-premium/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ab505bdf28287fe00099987c1bde2c2f297c40c792a7f6cb5fbfa5adc44754d3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"06c1aa31be81b1f5c6266514c955712865b30117291a39dd749994f4ce931145\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m-premium/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1704c6bc15d6f547acca888061680f2275f690cb79e5af6fee44747bcf278b95\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"6a8319194e2c2fc998268cdbab03a5aae2d83019f5ac30c316c4e548895b7c63\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"eaeb360b41b3f9e0bd6b247d4dae3eef1ffc3355d6e9408df3f8f71bc7f033b5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"32cfee4e66c307d5ebed6a406d2260f4374553d184b5486fc53cb64bc6ffcd8d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-embedding-model/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"135ffad9bbcd33779a0b9a1c0dc5d5f547356be21489762803640aca855c728a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"3194cef788c3fa9898599a57480aeaed07c6eac2edf957788235b37d22918588\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-trlp-test-model/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"17002b7f0c8e62582ad262d9c2b8b038ee7f2a9327fe34f21fd4f47134b7b8cf\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5acde2b886749c1c54f99db5c33887e6fc5ed0caf412daacfb5df0f329882c66\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a6a6232fd5656520e75d100c41add5f1637dde9705a4ec608bbb90b724c258a5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"37a71c27032e51fdbc7ca688064a47abb86230a8138af6eb55e8069fad975a93\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-echo-model/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"92917da87eaba4f2684cd45947a3698434b99ff4ca6d3ddde51d6573aecb1600\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b2b26e0af9ad7defb486e5d1db19af6bbdd0998559d16f3776651669aeb4d067\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-echo-model/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aa7038625b8f43b0c002f79637065e5ab90468f50f998759d08f2c4640c07c04\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"2a62f0614f6526bc3f195f838aebd1abe29514f2707db40d9ef738d645ccf001\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"de97dd5d45c6eb12b4a1112ed1f362d8544427428d2249a399e26ba069d6aadb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"22b2ec7ec96ee09c9e07a84cd3d313c2223af42433bbb28c5846401f64d5e3c1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/premium-simulated-simulated-premium/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"dc061bec60bd28b1c132bf30965b4810124429576337bcc4a6030617600d1714\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b188b939a496049e47b8ef664d7c7c490722f1753404a08d89ccec1dcb87b8fa\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-echo-model/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"75612d85af2bae456dadd78163b2d2f9015c0a0bf4e20bcb8a555e6a5ab3b8c0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"96bc4fc13cb63707a942ca33034f78d2b39476a10860398523789db3990584d1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a4493fc88328eba553ef36791fbf4706bffae04a1ac501d099b12309ebc85c6b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"d84e45c7a3e370ea510e8e0294e009b29bc2f2ea789c47559293007b6c4410d2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/premium-simulated-simulated-premium/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2d953f7313807988e63546aa32431d96f77e6989c672f8ab42827c1c21918630\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"dd2f15d9a08862ab664dadf9bf5da25828d327a11a07849fa919713f034c2b0d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/facebook-opt-125m-simulated/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d69b9c128f599c9ea1af84bb3e783ed71688baf6b3ad2b86f2b7183f9a4208b9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"4dfeb9ff2318af8f84e70b11545800bb83948c080a97ae1ece5780d4022bb383\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"dd89509e97b96670685602ae2d08749226db8693944d2c6f868af9d3e0a5feb5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"1025db78adc8b9c9592b692cc227b1a306a99ac5502300d9ed4ed7615f5e3ef8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/premium-simulated-simulated-premium/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3386c5e86c72abcdab369776ccd7182024ab8681cbe497e81724868f101a3c0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"58e90354179740b1af406b2911c9997f3f3283475aeb77ce7918f3b3239a293f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9e75e9fd02f51c2f043b145c5d6b82e95f1447b388ee529262aea27a6a2774ef\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b89d1075a79c93acaa097e4e6db4d6a4b23bf3ffe5e964409e29b258ed725a99\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-2-simulated/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0913a452a02695c6681f1037232199b40b64236fed4d29cdbb41561695826340\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5c0b495d1a10c1cf1548ef17998cb18c0ca25371ad42d5ffe1aed42bd55e31ad\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-unconfigured-facebook-opt-125m-simulated')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"010adf02b2e7deb40c572f4729b6dd4619847c8e6344137326b72df28772fc1a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"c04f8a7c7387e6794115c41161cb001d8a07340d2878cb8f36774a8f6a200ba4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"105cf4dd91a8abf4a93abd65b255521c3d37b560b5d23f3ec59757b5b362fae6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"7e7d1a0ec6d957a4d4de94f93078f10e836b23442c9cfa90f11c8520cca12e87\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-embedding-simulated/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"75fd86e2a4870af5fd78f2ad7aa2a9d79aff977b3678d81954b1e207a9315f2c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"c3cfc634a11046a837448628e2f17db0ed3466194da289a808544d874ecf6451\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-trlp-test-simulated/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"54cd0149b818480305f3d0024b3c95629cafb641b48195d003b2b7006d5c6bcd\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"f5bc618bde549671e84473b23ef3632426f8606e2045744a860c603f2a7675d3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bf65ad13397c94660867eb0205e06d1c9bebda4b019f632c0d0b8ef989930381\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"d8d67afd40f17474755bd3f6b00e265761bf5154febca129bc3f2b0bcd749c41\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-simulated/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f9fa9cfc2b4e701183573419a92c79384cd30210289602f0115c75c5029d55aa\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"ac2105eead12bb02dd7d1691cc77fc8a580b903f98564a8fd585dfa345dec1dd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"596921ddc7ba8523386263c5cffcbd6ad9b6a385318ed7e24f72be06f36fc398\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"f4ae34c5c82a0969651301a535f404653a60a5d75f20c7ea56ad9bb89b67e9fb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f95805f0e9b755664735d898c1d644d571943be553204d3f86136bc35719ff13\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"95c39f44eae69bd53f57e5ff93243887dafd591c9b8cf2e736f0ab034e67021d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/facebook-opt-125m-simulated/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8d5571efc1d304f5bcfc2ffb4ac6819154ba5556c29ce33416d460b887427984\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5d6b359055267732253f201a1fe48f0abe6d5e22b011c70e1cb006eea672f535\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e91aceffc2d4f6d6b120625bd3ca23781b74a1cae6cf1da26bda310bbed0ef07\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"c8475d27649a649c955538ff79eb001372050ff4f1d4ad295b01dc6fcc69ba2a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/facebook-opt-125m-simulated/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a402d1681ab35bace735c19b1d084a86eb3d741d4e1c14371cfdaa55d22c3ebe\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"7320c049419b863194fd55db5ebd887462dd24e1289e6308d79f047431f2bed9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-2-simulated/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f9b535aed6243496a67741936e53a0d303bea1b872a06fb62f1f9c27150edc40\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"5eeab80447ec6c71797517b4d94c6623353e89097743360eadd7f31115976dfe\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/facebook-opt-125m-simulated/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a9800464506c58f005016df354e160757732171ff4d19747202524955329b998\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4984a24eb707d1b965a79974a98ed4afc271f2ca356b150cbc8943de1ddcfef8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-embedding-simulated/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c82a1a3dc2ce54c0b664f79a2cd895a3c40f774b3694999badae8cedd328292e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"276f5d5d67b2bd83c05c2b39e4a262885498e6807e3129a866eff0651b3604a9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-trlp-test-simulated/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"669658556fba0f45c2a82def2f57614416614ddf154ed8dc5f4f9188f10130f2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"692f39321f892929348fe56801dc14c8a35eaf749609a3a5f4b5e684edddf17c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-2-simulated/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c4399a95e89654e5b2bb5fabe45bc947d11ccd1448ebf64c30b195b34f239d58\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5b273834f06c6341dd07bba6c809b3297ba2514e6d3b9b5d0f4f8211c68ccf8b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-simulated/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5e4821ff903ad6ca2e1c42162432e34d8b0a2a78052961e753d36b742193432f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"f35ed2fb168a3a608435006c8c1b103242765d7d37f41bf1dbdb7bbc0331da89\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a91faccafad197e2a4065ce3d12a052ac484d2e8fb2fc9265ee48f02b28e6dce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"fbfd0ada86117ffb0a134e591bf8b8390012983d25496ef188c6da73fef5eaec\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-2-simulated/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0020c64019ffd1a0bdcc75e6441e6a30e6d8bb08f463f67bd2408a1e82b95b2a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e78a4964c93ec23890e62f7f50201f5b832b4c714066a914dc734d8ef60e8213\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-embedding-simulated/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7c924aa2b37ea38067b4e69052d541ea2e7c86fbdaa79b19f9ea09e87adbe4ff\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"d5cf96eeeaa56bb891ea0cba28f7beabf17a8c0f061ea01c768ed842dd26334f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-trlp-test-simulated/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"028a8b5bd5d4e690eebb2f20c5fd47cf0b3c6e2a3619ba9e55322bbca7b94cc3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"8fe4100eab1f023f5b06dd8e19bcc80109b82503466d49576acc234cdda9bf0e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-simulated/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"80056c658070f49140955cb6eabdbd252857a614af6b0f2f2de7a1ab1cd47949\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"53aad0199369eb8c8f787ea099e93092089c04344e8f910dcff366f54bc831cb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-embedding-simulated/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2416d7b42d11a09d7152746be0e114f8fdc87d0fbd0efa9dec5b52b011082194\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e0cfec53d1f17771317082d9a7d69806ae3468971bac79a1135f2b0d51ecdc07\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-trlp-test-simulated/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"50c2058cf11e07a931b06ac4446a56eee86855f00badf26618abe486a7bdcfd7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"f3b6e6c38a521fae8ef5c7fddf3b3178baba88effb4e5338e0b387e28ecc468d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"134a7a790ba665547ca14f80f917549f66ee5063fc41096471c0778399db6dd5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"4ddd3fa1f54c642a57a48737e710ec0116705776084d8cebd8134dfa49accdde\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/premium-simulated-simulated-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4d18a96899c43d55ee63d2ae1a7a938c7e873d88b2fd95f06b2e3aae2c7f1c84\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"44e38055536c3f0d49cb81abb42bfefcf2c78faf963a6160afbe459bbc04db39\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-simulated/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8d34bd12ba2030284fcb69127f53b8158bbdd4a1432bfe619165b4c2c96cc061\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"c9dd9c233e43b53241ee27e937246e51b8f3331f30a7fba22640617c1b0bf47a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/echo-simulator/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"319e246831bdaf5e765e63d5511b516594fd2b64527850e2ddabd2a4a85532ea\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"7cfd2ed5cb8a5913fa5f55b92b02805c6778991c01c80eb14a0962cc710a56ff\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/echo-simulator/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a8c8220ad6f1387002e262ace5db78a2c4bb39e5953306702a228215174f6796\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"87e1712d02794c6d66ec1a932f02901d7a4369f46d0f041178cd3efadb7f59b7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/echo-simulator/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1e077a716d89a43572a3c16e8d0b0436816baa48a2ea227603701f10cad6d6f4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"ae9eac2a2b8c8311bb8c6ea82ab445a5d6f50d2d51c3f79962be9d82007097ad\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/facebook-opt-125m-simulated')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3f23315aacd6e16f4ab41f96aeedc9549d1abdfc9476577a47d45d12875dec5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"165d3b8e224f71685dee07aadd133117aeeed097eae99437d561d5bfa2d22233\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/echo-simulator/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6687eb3cec74c6c51428ce3f3d22d50ba269f59015d1bc8f185da49eb095534e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"05ac0e89d0298398d3996609d7c22b514bdf08bfa3787653bc739995c5942441\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-2-simulated')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bfd36c5ed73eb81df97258ffa1aa36d8cbf6f3e7a8096c33ca4ff417be59d002\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"d5ac583036f3821c88111dd82571eab1fc94aa4e9fcd045b27336f798e26075d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-embedding-simulated')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d303c788902ad4467c7ae545d65cbef45564d1c0d56396c93057df3909461aa1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4a6b0d84cc35c0f532405eea81056481fd54e7ad71284a97ce8f6a2424eac819\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-trlp-test-simulated')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2f53b030326b8e1f5908c601aecd3fffcb6d08a8337d0bdc53ee1fc699a4cd71\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5c3bcd9fb119b0fd45f3b4ba5de5f905cacbb4963fec309a0961a40f76a7a7a9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-simulated')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"94ddc5e77f082c32bebc7a36bcebf621518ebf303e83b9c540da1352d04e620b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"50057c9a2acf4ae7152e8c97f7778cb04340d1470974e5272422d0bf244a4e5c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/echo-simulator')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c6918972d1a7f8ad5201880b7d6d9c1191ca1f25376682f691def7868e3fd02\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"01cc37113b4d6c301e355f63decf46a21e93a023494bdfeaeed2890c97ec1f57\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a82769ff87473da04c27497e160e9b4b1a5dd93578e0cf2342be8b2f06845269\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e747b72d92315b743934153588614b27670cf0c9d9dc4fb380ea4965def7f235\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"06b05a8e4dd69bdc4f333ad9509ee8cad3c5c0f5dd48edbe94c1158b60f79ed3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"661962837510c6dc6d1faa64e61ec3086efa9e0a2e7315c6ded616c1879e5ba8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b4bfec1b33959dd0ebfc5cd6fb410688e820d4b55c7f149cb4acc4353f30a9b2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a7740f6e77d024a437502c023fb1d8939cb3cc2b9ed7f4073af7d779e19459eb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"f82564e076ea3e672592bab71e048537faba17a5e909884c2a0204e235905a69\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a908063c86927e6bf07b7d793aad9f277ac3c2a8f5f5d468b116cb9e07929b14\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"fbdfff5b213f506d78434055d011cf63d616653e502ee04408a43578986e1e5c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d1d232e06f90d479cd9b802f24889e83af58c51cf54ba273d5e24dcb8a297688\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b49f2d7e152d4de959577465d2494ee11771b4c439cb6eae71c90bff26224fb4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"810f299b76daf089b33c92cfbe0445ab5cc89a48d38e36df0cc89ed6cd1fe8df\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b27d6255cac73fc039120e157e1f3ce0e99e86995ac5a66974d5e8744df6c64d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4f800155f293f82eeaf5fd6a9553c0a1bee90f47a295bba8d7a04b3f11faea33\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b1ccc7ca46f6a14e90afe1dddfab8763f07f30549ce1cda0bae985581f063098\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ce7d381faee9ff949d68d825ffa1dcb9247dad19667ec59a8e91847320dacbe0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5d72fc7cc241ffd60d83142a900be014cc5d57320142e013493b21ecc86cb534\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6565c4085b3917d5390fe1b0194fb3d8319f1d56b45867e3c68ff740b5c16ef3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"be1ccea8a4cc19c7190600de6631fcb661b63db81e2862348a6ef4f90bf33fa3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8d8c8aae1332bb0300ac2d65be9b8708fbfde6d4b5599ec52380cf1f70956045\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"ca48ea5d9ee701ac5383800306378d945e66ca5427eba33396e6805ebbdc1ea7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f6df6bc14432fdc346191db86ee06e75c8090ed87a32c984493c837e97a10be6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"fc54a1d4f18d4d59e58b6a3aa31dbfaddda2b89e5c28dc9eacf14ff38a414021\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"maas-default-gateway"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-maas-default-gateway\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:40:59.223Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-ipp-b-4453bd","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"name":"kuadrant-e2e-ipp-b-4453bd","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-ipp-b-4453bd","uid":"e0d1a8d9-11c3-4552-a3d5-90b1f7ec1b9d"}]},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"429418e4bf958099ac3a6c51c2a84b0587f09943c66e921492d2a56b3d4b7eaf\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-b-4453bd-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__2f5f9ade\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-4453bd\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-4453bd\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__2f5f9ade\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-4453bd\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-4453bd\"]}],\"name\":\"bac1a38a403d18fce0cfd478f3e97896182a539440760fb35f6727286552d1e3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d25e4ca9fb5f67f329bb4d092a202ee425ed3b0ff584d4ff9a34ec9976652c2d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-b-4453bd-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__2f5f9ade\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-4453bd\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-4453bd\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__2f5f9ade\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-4453bd\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-4453bd\"]}],\"name\":\"2481db5d6245edf13fbdf07ceee0cc81da0876ebc67e5f7564d3ea6c08d1c049\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"003e08921762e20968cfd946973c5ea6e643c88466c6add012824438f022dc56\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-b-4453bd-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__2f5f9ade\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-4453bd\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-4453bd\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__2f5f9ade\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-4453bd\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-4453bd\"]}],\"name\":\"d00fed234f89fa9a8bbe603f9becc94eab89515551392f85e44b89ff8e3ae468\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ecb83226ddc442b7ec436cabc64481486887a4748e0f54bb66b0fd9f9e8e8268\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-b-4453bd-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__2f5f9ade\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-4453bd\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-4453bd\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__2f5f9ade\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-4453bd\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-4453bd\"]}],\"name\":\"b2b9d66ab94acbf319e46cee9a64afd31e1599928b86e3afbfde0efa6ddc5186\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2b90ffde2a26d5bfc29d5a740d3931daada09c605d0d365ebb8f3d2918722297\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-b-4453bd-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__2f5f9ade\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-4453bd\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-4453bd\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__2f5f9ade\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-4453bd\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-4453bd\"]}],\"name\":\"38ef4ad2caa022a04a3c5d9fe941af0b1c34ed2d714fb20dcb056a487cbde978\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b22a97ec9de03574378f4e99bbba4d4f52f0674b9c50664d43680da7e072c8ac\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-b-4453bd-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__2f5f9ade\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-4453bd\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-4453bd\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__2f5f9ade\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-4453bd\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-4453bd\"]}],\"name\":\"85dbdc06d0d3eba8548fba158ba87ba866dfd7befe67c32172fea59002cffdc4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-ipp-b-4453bd"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-e2e-ipp-b-4453bd\" already exists"}
{"level":"error","ts":"2026-11-02T21:40:59.939Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-ipp-b-4453bd-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-ipp-b-4453bd-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:41:00.107Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-facebook-opt-125m-simulated","namespace":"llm","uid":"da8edb1a-ed61-454d-939f-fc7cd235d9fb","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-facebook-opt-125m-simulated\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:41:00.519Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-ipp-b-4453bd","namespace":"openshift-ingress","uid":"97a893fd-514d-4a9f-af65-838639292f33","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-ipp-b-4453bd\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:41:00.818Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:41:00.819Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T21:41:00.878Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-ipp-b-4453bd","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-ipp-b-4453bd\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:41:00.946Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"maas-api-route-e2e-ipp-b-4453bd","namespace":"odh-ai-gateway-infra","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"maas-api-route-e2e-ipp-b-4453bd\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:41:09Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ipp-b-6a9abc","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-b-6a9abc","reconcileID":"1f51addd-a85d-4f85-a6be-5c01becd1e96","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-ipp-b-6a9abc","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:41:09Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-b-6a9abc","event":"CREATE"}
{"level":"info","ts":"2026-11-02T21:41:09Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:41:09Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-02T21:41:09Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-02T21:41:09Z","logger":"telemetry-policy-extension-controller","msg":"Failed to update status: resource might just be outdated"}
{"level":"info","ts":"2026-11-02T21:41:09Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:41:09Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ipp-b-6a9abc","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-b-6a9abc","reconcileID":"742e8927-0aa8-4f56-be6f-aaa438d0f7b4","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-ipp-b-6a9abc","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:41:09Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-b-6a9abc","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T21:41:09Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:41:10Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-02T21:41:10Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-02T21:41:10Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:41:10Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ipp-b-6a9abc","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-b-6a9abc","reconcileID":"10b33231-b55b-4e33-a384-c255fd7a4edf","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-ipp-b-6a9abc","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:41:10Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-b-6a9abc","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T21:41:10Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:41:10Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-02T21:41:10Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-02T21:41:10Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-02T21:41:10Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:41:11.627Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["EnvoyFilter","AuthPolicy","Limitador","HTTPRoute","AuthConfig","TokenRateLimitPolicy","Gateway","ConfigMap"],"eventTypes":{"create":9,"update":8}}
{"level":"info","ts":"2026-11-02T21:41:11.761Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:41:13.340Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:41:13.439Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:41:13.439Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:41:16.670Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:41:16.682Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:41:16.682Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:41:16.723Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:41:16.729Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-02T21:41:16.729Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:41:16.730Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:41:19.358Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:41:19.359Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:41:20.829Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway","Kuadrant","HTTPRoute","AuthPolicy"],"eventTypes":{"create":2,"update":2}}
{"level":"info","ts":"2026-11-02T21:41:21.097Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:41:21.138Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:41:23.623Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:41:23.867Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:41:23.868Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:41:24.057Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:41:24.057Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:41:26.877Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:41:26.881Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:41:26.888Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:41:26.890Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:41:26.890Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:41:26.891Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-02T21:41:26.891Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T21:41:26.950Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-ipp-b-6a9abc","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"kuadrant-auth-e2e-ipp-b-6a9abc","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-ipp-b-6a9abc","uid":"c30df342-3896-4582-9162-f034939ea08a"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-auth-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local","port_value":50051}}}}]}]},"name":"kuadrant-auth-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-ipp-b-6a9abc"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-ipp-b-6a9abc\" already exists"}
{"level":"error","ts":"2026-11-02T21:41:27.045Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-6a9abc","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-6a9abc#rule-4"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"150c8624b4eda3da4b6c57e6330c81779b269c75f26831ec089c50242083d74f","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["150c8624b4eda3da4b6c57e6330c81779b269c75f26831ec089c50242083d74f"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-b-6a9abc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-b-6a9abc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"150c8624b4eda3da4b6c57e6330c81779b269c75f26831ec089c50242083d74f\" already exists"}
{"level":"error","ts":"2026-11-02T21:41:27.126Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-6a9abc","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-6a9abc#rule-6"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"e508d27ea55ee13280a9c1ba51e5e1ea67f12ccb8fc234dfb1431fb55e37c38d","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["e508d27ea55ee13280a9c1ba51e5e1ea67f12ccb8fc234dfb1431fb55e37c38d"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-b-6a9abc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-b-6a9abc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"e508d27ea55ee13280a9c1ba51e5e1ea67f12ccb8fc234dfb1431fb55e37c38d\" already exists"}
{"level":"error","ts":"2026-11-02T21:41:27.195Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-6a9abc","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-6a9abc#rule-2"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"c15bf0d2246a7ac40c66f725414673aa3274be7ac1239c924f6e364b0662ff11","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["c15bf0d2246a7ac40c66f725414673aa3274be7ac1239c924f6e364b0662ff11"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-b-6a9abc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-b-6a9abc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"c15bf0d2246a7ac40c66f725414673aa3274be7ac1239c924f6e364b0662ff11\" already exists"}
{"level":"error","ts":"2026-11-02T21:41:27.290Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-6a9abc","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-6a9abc#rule-3"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"f3e952e6dada04d0d598a918019b73dd6f6b858530b92ba28df0c75bafd151d6","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f3e952e6dada04d0d598a918019b73dd6f6b858530b92ba28df0c75bafd151d6"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-b-6a9abc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-b-6a9abc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"f3e952e6dada04d0d598a918019b73dd6f6b858530b92ba28df0c75bafd151d6\" already exists"}
{"level":"error","ts":"2026-11-02T21:41:27.369Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-6a9abc","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-6a9abc#rule-1"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"5cbc6cbfb05adb2876e3c8ea22f08290348ae91c25c2176df41cad1dba678d72","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["5cbc6cbfb05adb2876e3c8ea22f08290348ae91c25c2176df41cad1dba678d72"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-b-6a9abc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-b-6a9abc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"5cbc6cbfb05adb2876e3c8ea22f08290348ae91c25c2176df41cad1dba678d72\" already exists"}
{"level":"error","ts":"2026-11-02T21:41:27.435Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-6a9abc","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-6a9abc#rule-5"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"d6ce1122a354e8c511fbb32c1378614dd5bb2b5632d82db4b58ab23a503d8753","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d6ce1122a354e8c511fbb32c1378614dd5bb2b5632d82db4b58ab23a503d8753"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-b-6a9abc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-b-6a9abc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"d6ce1122a354e8c511fbb32c1378614dd5bb2b5632d82db4b58ab23a503d8753\" already exists"}
{"level":"error","ts":"2026-11-02T21:41:27.855Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-ipp-b-6a9abc","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"name":"kuadrant-e2e-ipp-b-6a9abc","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-ipp-b-6a9abc","uid":"c30df342-3896-4582-9162-f034939ea08a"}]},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e508d27ea55ee13280a9c1ba51e5e1ea67f12ccb8fc234dfb1431fb55e37c38d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-b-6a9abc-maas-auth\"]}],\"name\":\"524f51b0136f45b319ae1e6d207624fe99ced4340920f2e5c83d8166435666a4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c15bf0d2246a7ac40c66f725414673aa3274be7ac1239c924f6e364b0662ff11\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-b-6a9abc-maas-auth\"]}],\"name\":\"f30effd7955f07a7e7d658561281074471730c4899f8e1da0bec5eb68c4b2d62\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d6ce1122a354e8c511fbb32c1378614dd5bb2b5632d82db4b58ab23a503d8753\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-b-6a9abc-maas-auth\"]}],\"name\":\"485d36357992aa4ef31d86d4cd5e3fe205bdfdfabbbe031f08387595a94609e9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f3e952e6dada04d0d598a918019b73dd6f6b858530b92ba28df0c75bafd151d6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-b-6a9abc-maas-auth\"]}],\"name\":\"fa65402ba00b84ab85093a58f0e18283b9adeebf59e537d2c471ec7ab360607e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"150c8624b4eda3da4b6c57e6330c81779b269c75f26831ec089c50242083d74f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-b-6a9abc-maas-auth\"]}],\"name\":\"7ce35a4f1d0674f85cf984522634506cb16d77ec42517441fb5cb194d66780b2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5cbc6cbfb05adb2876e3c8ea22f08290348ae91c25c2176df41cad1dba678d72\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-b-6a9abc-maas-auth\"]}],\"name\":\"9ff9aafc03935fc485e73b6690e51bc2172d78e90aefb1c86bc720d62cca81d0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-ipp-b-6a9abc"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-e2e-ipp-b-6a9abc\" already exists"}
{"level":"error","ts":"2026-11-02T21:41:28.448Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-ipp-a-54e844","namespace":"openshift-ingress","uid":"b32a7504-b428-4788-91df-217356ebe33c","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-ipp-a-54e844\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:41:28.507Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-simulated-simulated-premium","namespace":"llm","uid":"447993be-3c57-4e68-8ffa-6fc998a39c77","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-simulated-simulated-premium\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:41:28.626Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w2-6fa533","namespace":"e2e-models-e2e-worker-w2-6fa533","uid":"3a128bb2-de88-49aa-ab9e-c8626107a077","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w2-6fa533\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:41:28.684Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w1-5f765a","namespace":"e2e-models-e2e-worker-w1-5f765a","uid":"7188eadc-9748-4be8-a5e2-d904cf5b6130","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w1-5f765a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:41:28.741Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w0-0c9014","namespace":"e2e-models-e2e-worker-w0-0c9014","uid":"dcb5a0e4-7049-4ddc-91de-e14d55b09789","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w0-0c9014\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:41:28.799Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-ipp-a-e12f99","namespace":"openshift-ingress","uid":"586f6ac7-72ee-4a5c-83d6-b9b39b674005","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-ipp-a-e12f99\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:41:28.857Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-ipp-a-15253e","namespace":"openshift-ingress","uid":"79cea698-ef77-4328-8e5e-94fb3112db27","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-ipp-a-15253e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:41:28.861Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-ipp-b-4453bd-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-ipp-b-4453bd-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:41:28.915Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-ipp-b-4453bd","namespace":"openshift-ingress","uid":"97a893fd-514d-4a9f-af65-838639292f33","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-ipp-b-4453bd\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:41:28.994Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-ipp-b-6a9abc-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-ipp-b-6a9abc-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:41:29.032Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w4-d6cb38","namespace":"e2e-models-e2e-worker-w4-d6cb38","uid":"486176e6-7786-40c4-9ce0-6f4a68b408b2","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w4-d6cb38\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:41:29.090Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w3-f51151","namespace":"e2e-models-e2e-worker-w3-f51151","uid":"e3340067-224a-43ad-8020-ca9e00ead152","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w3-f51151\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:41:29.148Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w0-0c9014","namespace":"e2e-models-e2e-worker-w0-0c9014","uid":"4f647df6-1d5b-433b-b4fc-1279ff1755f7","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w0-0c9014\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:41:29.207Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-ipp-a-7d3617","namespace":"openshift-ingress","uid":"145eadb1-b934-4484-bb5c-a149bec3181e","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-ipp-a-7d3617\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:41:29.265Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-facebook-opt-125m-simulated","namespace":"llm","uid":"da8edb1a-ed61-454d-939f-fc7cd235d9fb","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-facebook-opt-125m-simulated\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:41:29.324Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w1-5f765a","namespace":"e2e-models-e2e-worker-w1-5f765a","uid":"9c852546-ee7c-4e72-855c-111315f7bf82","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w1-5f765a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:41:29.382Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w2-6fa533","namespace":"e2e-models-e2e-worker-w2-6fa533","uid":"2ff73667-c2c3-4579-9503-b6ca098f1021","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w2-6fa533\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:41:29.441Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w3-f51151","namespace":"e2e-models-e2e-worker-w3-f51151","uid":"c78aa03a-e3ca-4797-8a09-ab0d9cd88148","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w3-f51151\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:41:29.499Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w4-d6cb38","namespace":"e2e-models-e2e-worker-w4-d6cb38","uid":"0d3ebd35-5005-4ee4-a055-ff95546e3673","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w4-d6cb38\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:41:29.618Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:41:29.618Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T21:41:29.847Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-ipp-b-6a9abc","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-ipp-b-6a9abc\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:41:30.050Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"maas-api-route-e2e-ipp-b-6a9abc","namespace":"odh-ai-gateway-infra","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"maas-api-route-e2e-ipp-b-6a9abc\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:41:37.484Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","EnvoyFilter","ConfigMap","AuthConfig","Gateway","AuthPolicy","Kuadrant","HTTPRoute"],"eventTypes":{"create":9,"update":23}}
{"level":"info","ts":"2026-11-02T21:41:37.780Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:41:37.798Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:41:40.361Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:41:40.550Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:41:40.564Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:41:40.565Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:41:40.565Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:41:43.854Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:41:43.861Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:41:43.870Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:41:43.928Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:41:43.954Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:41:43.954Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:41:44.041Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:41:45Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ipp-a-ce2453","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-a-ce2453","reconcileID":"15a6714e-1592-4bb0-bbae-61609e2d3309","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-ipp-a-ce2453","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:41:45Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-a-ce2453","event":"CREATE"}
{"level":"info","ts":"2026-11-02T21:41:45Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:41:45Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-02T21:41:45Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-02T21:41:45Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:41:45Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ipp-a-ce2453","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-a-ce2453","reconcileID":"fa52c8f9-b332-4b25-9594-ce70d8bcbf5f","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-ipp-a-ce2453","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:41:45Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-a-ce2453","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T21:41:45Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:41:46Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-02T21:41:46Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-02T21:41:46Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-02T21:41:46Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:41:46Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ipp-a-ce2453","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-a-ce2453","reconcileID":"01d1b4d1-34fd-47c6-8433-fc62dfeb3ccc","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-ipp-a-ce2453","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:41:46Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-a-ce2453","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T21:41:46Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:41:46Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-02T21:41:46Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-02T21:41:46Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-02T21:41:46Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:41:46.755Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:41:46.756Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T21:41:47.124Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-ipp-a-ce2453","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-ipp-a-ce2453\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:41:55Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ipp-b-387f88","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-b-387f88","reconcileID":"70357616-ff21-4f54-adf7-9d78f0faa72e","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-ipp-b-387f88","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:41:55Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-b-387f88","event":"CREATE"}
{"level":"info","ts":"2026-11-02T21:41:55Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:41:56Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-02T21:41:56Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-02T21:41:56Z","logger":"telemetry-policy-extension-controller","msg":"Failed to update status: resource might just be outdated"}
{"level":"info","ts":"2026-11-02T21:41:56Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:41:56Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ipp-b-387f88","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-b-387f88","reconcileID":"aa51a982-adb8-4c8d-8d72-46486ebf1962","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-ipp-b-387f88","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:41:56Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-b-387f88","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T21:41:56Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:41:56Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-02T21:41:56Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-02T21:41:56Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:41:56Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ipp-b-387f88","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-b-387f88","reconcileID":"6271ee47-f49b-46f7-9313-2e959322520c","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-ipp-b-387f88","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:41:56Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-b-387f88","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T21:41:56Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:41:57Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-02T21:41:57Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-02T21:41:57Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-02T21:41:57Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:41:57.367Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway","EnvoyFilter","TokenRateLimitPolicy","HTTPRoute","AuthPolicy","Limitador","Kuadrant","ConfigMap"],"eventTypes":{"create":4,"update":26}}
{"level":"info","ts":"2026-11-02T21:41:57.534Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:41:57.554Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:42:00.035Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:42:00.036Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:42:00.162Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:42:00.167Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:42:00.167Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:42:03.766Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:42:03.769Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:42:03.825Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:42:03.835Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:42:03.835Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:42:03.837Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"error","ts":"2026-11-02T21:42:03.954Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:42:03.954Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:42:06.719Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:42:06.719Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T21:42:07.266Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-ipp-b-3e3997","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-ipp-b-3e3997\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:42:08Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ipp-b-3e3997","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-b-3e3997","reconcileID":"be7acd73-a305-4b54-aa4f-049836015eba","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-ipp-b-3e3997","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:42:08Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-b-3e3997","event":"CREATE"}
{"level":"info","ts":"2026-11-02T21:42:08Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:42:08.236Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway","Kuadrant","HTTPRoute"],"eventTypes":{"create":1,"update":2}}
{"level":"info","ts":"2026-11-02T21:42:08.439Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:42:08.453Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:42:10Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-02T21:42:10Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-02T21:42:10Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:42:10Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ipp-b-3e3997","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-b-3e3997","reconcileID":"06698320-d2bd-47bc-8043-94c7a28496e5","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-ipp-b-3e3997","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:42:10Z","logger":"telemetry-policy-extension-controller","msg":"Warning: Reconciler returned both a non-zero result and a non-nil error. The result will always be ignored if the error is non-nil and the non-nil error causes requeuing with exponential backoff. For more details, see: https://pkg.go.dev/sigs.k8s.io/controller-runtime/pkg/reconcile#Reconciler","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ipp-b-3e3997","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-b-3e3997","reconcileID":"06698320-d2bd-47bc-8043-94c7a28496e5"}
{"level":"error","ts":"2026-11-02T21:42:10Z","logger":"telemetry-policy-extension-controller","msg":"Reconciler error","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ipp-b-3e3997","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-b-3e3997","reconcileID":"06698320-d2bd-47bc-8043-94c7a28496e5","error":"Operation cannot be fulfilled on telemetrypolicies.extensions.kuadrant.io \"maas-telemetry-e2e-ipp-b-3e3997\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:353\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-02T21:42:10Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ipp-b-3e3997","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-b-3e3997","reconcileID":"9810510e-1137-458c-86ba-15c50524b4cb","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-ipp-b-3e3997","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:42:10Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-b-3e3997","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T21:42:10Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:42:11.344Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:42:11.561Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:42:11.567Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:42:11.662Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:42:11.662Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:42:12Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-02T21:42:12Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-02T21:42:12Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-02T21:42:12Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:42:12Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-b-3e3997","event":"UNKNOWN"}
{"level":"info","ts":"2026-11-02T21:42:12Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:42:13Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-02T21:42:13Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-02T21:42:13Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-02T21:42:13Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:42:14.850Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:42:14.860Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:42:14.860Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:42:14.861Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:42:14.864Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:42:14.868Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"error","ts":"2026-11-02T21:42:14.910Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-ipp-a-ce2453","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/ratelimit":"true"},"name":"kuadrant-ratelimiting-e2e-ipp-a-ce2453","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-ipp-a-ce2453","uid":"254d284b-43c7-4ef2-9080-9ed312b7aae5"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"limitador-limitador.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-ratelimit-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"limitador-limitador.kuadrant-system.svc.cluster.local","port_value":8081}}}}]}]},"name":"kuadrant-ratelimit-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-ipp-a-ce2453"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-ipp-a-ce2453\" already exists"}
{"level":"error","ts":"2026-11-02T21:42:14.974Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:42:14.974Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T21:42:15.021Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-ipp-a-ce2453","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"kuadrant-auth-e2e-ipp-a-ce2453","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-ipp-a-ce2453","uid":"254d284b-43c7-4ef2-9080-9ed312b7aae5"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-auth-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local","port_value":50051}}}}]}]},"name":"kuadrant-auth-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-ipp-a-ce2453"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-ipp-a-ce2453\" already exists"}
{"level":"error","ts":"2026-11-02T21:42:15.022Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-ce2453","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-ce2453#rule-1"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"93b9a32c7b23acf31e43e9db9007a107c836bc0fe6a680afd16005e9deceb070","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["93b9a32c7b23acf31e43e9db9007a107c836bc0fe6a680afd16005e9deceb070"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-a-ce2453.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-a-ce2453.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"93b9a32c7b23acf31e43e9db9007a107c836bc0fe6a680afd16005e9deceb070\" already exists"}
{"level":"error","ts":"2026-11-02T21:42:15.097Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-ce2453","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-ce2453#rule-4"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"4fcb9f993f17dd0eef5d34bb0de64ef7047bfa6056410eb1e59f2f4bbf7e1a54","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["4fcb9f993f17dd0eef5d34bb0de64ef7047bfa6056410eb1e59f2f4bbf7e1a54"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-a-ce2453.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-a-ce2453.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"4fcb9f993f17dd0eef5d34bb0de64ef7047bfa6056410eb1e59f2f4bbf7e1a54\" already exists"}
{"level":"error","ts":"2026-11-02T21:42:15.168Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-ce2453","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-ce2453#rule-3"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"bd8721e9d17f5f3ba2e1fffb6978c86598bc85297f3b0e0fbd1e56adb44df1f4","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["bd8721e9d17f5f3ba2e1fffb6978c86598bc85297f3b0e0fbd1e56adb44df1f4"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-a-ce2453.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-a-ce2453.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"bd8721e9d17f5f3ba2e1fffb6978c86598bc85297f3b0e0fbd1e56adb44df1f4\" already exists"}
{"level":"error","ts":"2026-11-02T21:42:15.234Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-ce2453","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-ce2453#rule-2"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"1af979847e61ee62f748707bd08717a112d0904feb1eac70881a949b76fa6d61","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["1af979847e61ee62f748707bd08717a112d0904feb1eac70881a949b76fa6d61"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-a-ce2453.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-a-ce2453.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"1af979847e61ee62f748707bd08717a112d0904feb1eac70881a949b76fa6d61\" already exists"}
{"level":"error","ts":"2026-11-02T21:42:15.301Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-ce2453","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-ce2453#rule-5"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"d069f1a629c4b80d835027ed5a6d6ba8d643762cf5d54b723b8880ad8b3ce68c","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d069f1a629c4b80d835027ed5a6d6ba8d643762cf5d54b723b8880ad8b3ce68c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-a-ce2453.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-a-ce2453.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"d069f1a629c4b80d835027ed5a6d6ba8d643762cf5d54b723b8880ad8b3ce68c\" already exists"}
{"level":"error","ts":"2026-11-02T21:42:15.335Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-ipp-a-ce2453","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"name":"kuadrant-e2e-ipp-a-ce2453","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-ipp-a-ce2453","uid":"254d284b-43c7-4ef2-9080-9ed312b7aae5"}]},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"42c0502125113aac244c36c0bea7ba50a3f48d1f4bdfc0289f186ef39959831c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-a-ce2453-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6257fed7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-ce2453\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-ce2453\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6257fed7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-ce2453\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-ce2453\"]}],\"name\":\"645332d84af457db8281dacf38fe87807fff0d770ac80978575ce7f646d71b4b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1af979847e61ee62f748707bd08717a112d0904feb1eac70881a949b76fa6d61\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-a-ce2453-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6257fed7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-ce2453\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-ce2453\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6257fed7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-ce2453\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-ce2453\"]}],\"name\":\"75008f422cba7aa1f3e6307439fe14ab990ca73d9d3209cffc2d45972f7bf663\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d069f1a629c4b80d835027ed5a6d6ba8d643762cf5d54b723b8880ad8b3ce68c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-a-ce2453-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6257fed7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-ce2453\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-ce2453\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6257fed7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-ce2453\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-ce2453\"]}],\"name\":\"2c9f9b32badf3c6fc43435931314b786fbf412bac2609d36e0b0b98616728b6c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bd8721e9d17f5f3ba2e1fffb6978c86598bc85297f3b0e0fbd1e56adb44df1f4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-a-ce2453-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6257fed7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-ce2453\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-ce2453\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6257fed7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-ce2453\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-ce2453\"]}],\"name\":\"0458b43600181f4d34fdfb3110385676f9b4ba945f7a16d1493afa176e2ca89f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4fcb9f993f17dd0eef5d34bb0de64ef7047bfa6056410eb1e59f2f4bbf7e1a54\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-a-ce2453-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6257fed7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-ce2453\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-ce2453\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6257fed7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-ce2453\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-ce2453\"]}],\"name\":\"311e6dd6448a4c144c848d8f4316a39d7bcce7a5719976e47669a6aa2631c012\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"93b9a32c7b23acf31e43e9db9007a107c836bc0fe6a680afd16005e9deceb070\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-a-ce2453-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6257fed7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-ce2453\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-ce2453\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6257fed7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-ce2453\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-ce2453\"]}],\"name\":\"34fb3db576a2916c86b5720976f10873a4a3d131e06c787099f389f8f8a62f1e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-ipp-a-ce2453"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-e2e-ipp-a-ce2453\" already exists"}
{"level":"error","ts":"2026-11-02T21:42:15.399Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-ce2453","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-ce2453#rule-6"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"42c0502125113aac244c36c0bea7ba50a3f48d1f4bdfc0289f186ef39959831c","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["42c0502125113aac244c36c0bea7ba50a3f48d1f4bdfc0289f186ef39959831c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-a-ce2453.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-a-ce2453.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"42c0502125113aac244c36c0bea7ba50a3f48d1f4bdfc0289f186ef39959831c\" already exists"}
{"level":"error","ts":"2026-11-02T21:42:16.282Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-ipp-a-ce2453-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-ipp-a-ce2453-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:42:16.641Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-ipp-a-ce2453","namespace":"openshift-ingress","uid":"294447a1-97cf-47b8-8c42-e0e6eb41e223","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-ipp-a-ce2453\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:42:17.470Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-ipp-b-6a9abc","namespace":"openshift-ingress","uid":"223ef469-9c1b-4980-b3f1-e4ef639d8f87","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-ipp-b-6a9abc\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:42:17.590Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:42:17.590Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T21:42:17.896Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"maas-api-route-e2e-ipp-a-ce2453","namespace":"odh-ai-gateway-infra","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"maas-api-route-e2e-ipp-a-ce2453\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:42:18.628Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-ipp-b-3e3997","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-ipp-b-3e3997\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:42:18.687Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-ipp-a-ce2453","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-ipp-a-ce2453\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:42:25.266Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","TokenRateLimitPolicy","HTTPRoute","AuthPolicy","Limitador","ConfigMap","EnvoyFilter","Gateway","Kuadrant"],"eventTypes":{"create":14,"update":9}}
{"level":"info","ts":"2026-11-02T21:42:25.613Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:42:25.633Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:42:28.026Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:42:28.243Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:42:28.754Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:42:28.943Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:42:28.943Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:42:31.995Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:42:31.998Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:42:32.005Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:42:32.006Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:42:32.006Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:42:32.006Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:42:32.164Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:42:34Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ipp-a-54e844","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-a-54e844","reconcileID":"16ba4c30-3f18-469b-a2b7-7faca15f76bf","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-ipp-a-54e844","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:42:34Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-a-54e844","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T21:42:34Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:42:34Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-11-02T21:42:34Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:42:34Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-11-02T21:42:34Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ipp-a-54e844","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-a-54e844","reconcileID":"16ba4c30-3f18-469b-a2b7-7faca15f76bf","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-ipp-a-54e844","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:42:34Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-a-54e844","event":"DELETE"}
{"level":"info","ts":"2026-11-02T21:42:34Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-02T21:42:34Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-ipp-a-54e844\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-02T21:42:34Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:42:35.171Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:42:35.171Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T21:42:35.230Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-ipp-a-54e844","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-ipp-a-54e844\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:42:43.071Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","EnvoyFilter","TokenRateLimitPolicy","AuthPolicy","HTTPRoute","Gateway","ConfigMap","Limitador","Kuadrant"],"eventTypes":{"create":18,"delete":3,"update":14}}
{"level":"info","ts":"2026-11-02T21:42:43.395Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:42:43.415Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:42:46.762Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:42:46.762Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:42:46.843Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:42:46.939Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:42:46.939Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:42:49.836Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:42:49.848Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:42:49.848Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:42:49.859Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:42:49.859Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:42:49.865Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"error","ts":"2026-11-02T21:42:49.979Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:42:49.979Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:42:52.736Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:42:52.736Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:42:54.086Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["EnvoyFilter","Gateway"],"eventTypes":{"delete":4}}
{"level":"info","ts":"2026-11-02T21:42:59.428Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:42:59.445Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:42:59.455Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:42:59.534Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:42:59.534Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:42:59.537Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-11-02T21:42:59.644Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/c4f927f10bbe3cb7e4809e339baf54b1e0de51027b86f4974b63cdbe60408702","error":"authconfigs.authorino.kuadrant.io \"c4f927f10bbe3cb7e4809e339baf54b1e0de51027b86f4974b63cdbe60408702\" not found"}
{"level":"error","ts":"2026-11-02T21:42:59.647Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:42:59.647Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T21:42:59.699Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/33e15e11b867dd9bc38ad28a8f4a100d47666621d3babd049806979aaed1ab15","error":"authconfigs.authorino.kuadrant.io \"33e15e11b867dd9bc38ad28a8f4a100d47666621d3babd049806979aaed1ab15\" not found"}
{"level":"error","ts":"2026-11-02T21:42:59.753Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/281b4de3d8a080a3c91b6babf36d294972f47bd01f1f21b44b97bf7c287cfdc5","error":"authconfigs.authorino.kuadrant.io \"281b4de3d8a080a3c91b6babf36d294972f47bd01f1f21b44b97bf7c287cfdc5\" not found"}
{"level":"error","ts":"2026-11-02T21:42:59.808Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/213d4e6e34493b57241b2950569fcc83525960a427eb933d1683c23e1b87d2d5","error":"authconfigs.authorino.kuadrant.io \"213d4e6e34493b57241b2950569fcc83525960a427eb933d1683c23e1b87d2d5\" not found"}
{"level":"error","ts":"2026-11-02T21:42:59.863Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/a0181e531d0504643a09c194738cf17e43653ff05004b16a290f03d2f49f4c36","error":"authconfigs.authorino.kuadrant.io \"a0181e531d0504643a09c194738cf17e43653ff05004b16a290f03d2f49f4c36\" not found"}
{"level":"error","ts":"2026-11-02T21:42:59.917Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/f08b1ef1b7782590808229cbb9bc4109562583c8b47bdd9fb309c82522ce918f","error":"authconfigs.authorino.kuadrant.io \"f08b1ef1b7782590808229cbb9bc4109562583c8b47bdd9fb309c82522ce918f\" not found"}
{"level":"error","ts":"2026-11-02T21:43:01.191Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-ipp-b-387f88","namespace":"openshift-ingress","uid":"e48487ef-c119-41ea-b486-34b8fc542f2c","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-ipp-b-387f88\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:43:01.355Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-ipp-b-3e3997-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-ipp-b-3e3997-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:43:01.554Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-ipp-b-387f88-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-ipp-b-387f88-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:43:02.023Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-ipp-b-3e3997","namespace":"openshift-ingress","uid":"b3699a22-0612-4e54-b536-47bce1c563f6","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-ipp-b-3e3997\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:43:02.386Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:43:02.386Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:43:05Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ipp-b-4453bd","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-b-4453bd","reconcileID":"65c74ac8-8330-4a34-907f-ff41f242c466","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-ipp-b-4453bd","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:43:05Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-b-4453bd","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T21:43:05Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:43:05Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-11-02T21:43:05Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:43:05Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-11-02T21:43:05Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ipp-b-4453bd","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-b-4453bd","reconcileID":"65c74ac8-8330-4a34-907f-ff41f242c466","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-ipp-b-4453bd","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:43:05Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-b-4453bd","event":"DELETE"}
{"level":"info","ts":"2026-11-02T21:43:05Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-02T21:43:05Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-ipp-b-4453bd\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-02T21:43:05Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:43:13.303Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","TokenRateLimitPolicy","AuthPolicy","Limitador","AuthConfig","HTTPRoute"],"eventTypes":{"delete":7,"update":6}}
{"level":"info","ts":"2026-11-02T21:43:13.498Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:43:15.345Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:43:15.464Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:43:15.464Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:43:18.432Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:43:18.435Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:43:18.443Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:43:18.452Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:43:18.458Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:43:18.458Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:43:18.564Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:43:21.277Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:43:21.277Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:43:22.641Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Kuadrant","Gateway","AuthPolicy","EnvoyFilter","TokenRateLimitPolicy"],"eventTypes":{"delete":6,"update":1}}
{"level":"info","ts":"2026-11-02T21:43:22.830Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:43:22.838Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:43:25.423Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:43:25.745Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:43:25.764Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:43:25.934Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:43:25.934Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:43:29.156Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:43:29.165Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:43:29.165Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:43:29.169Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:43:29.170Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:43:29.176Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"error","ts":"2026-11-02T21:43:29.286Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:43:29.286Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T21:43:29.288Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/ecb83226ddc442b7ec436cabc64481486887a4748e0f54bb66b0fd9f9e8e8268","error":"authconfigs.authorino.kuadrant.io \"ecb83226ddc442b7ec436cabc64481486887a4748e0f54bb66b0fd9f9e8e8268\" not found"}
{"level":"error","ts":"2026-11-02T21:43:29.343Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/2b90ffde2a26d5bfc29d5a740d3931daada09c605d0d365ebb8f3d2918722297","error":"authconfigs.authorino.kuadrant.io \"2b90ffde2a26d5bfc29d5a740d3931daada09c605d0d365ebb8f3d2918722297\" not found"}
{"level":"error","ts":"2026-11-02T21:43:29.397Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/003e08921762e20968cfd946973c5ea6e643c88466c6add012824438f022dc56","error":"authconfigs.authorino.kuadrant.io \"003e08921762e20968cfd946973c5ea6e643c88466c6add012824438f022dc56\" not found"}
{"level":"error","ts":"2026-11-02T21:43:29.452Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/b22a97ec9de03574378f4e99bbba4d4f52f0674b9c50664d43680da7e072c8ac","error":"authconfigs.authorino.kuadrant.io \"b22a97ec9de03574378f4e99bbba4d4f52f0674b9c50664d43680da7e072c8ac\" not found"}
{"level":"error","ts":"2026-11-02T21:43:29.544Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/429418e4bf958099ac3a6c51c2a84b0587f09943c66e921492d2a56b3d4b7eaf","error":"authconfigs.authorino.kuadrant.io \"429418e4bf958099ac3a6c51c2a84b0587f09943c66e921492d2a56b3d4b7eaf\" not found"}
{"level":"error","ts":"2026-11-02T21:43:29.599Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/d25e4ca9fb5f67f329bb4d092a202ee425ed3b0ff584d4ff9a34ec9976652c2d","error":"authconfigs.authorino.kuadrant.io \"d25e4ca9fb5f67f329bb4d092a202ee425ed3b0ff584d4ff9a34ec9976652c2d\" not found"}
{"level":"info","ts":"2026-11-02T21:43:32.022Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:43:32.022Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:43:40.226Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Limitador","ConfigMap","Gateway","AuthConfig"],"eventTypes":{"create":1,"delete":6,"update":2}}
{"level":"info","ts":"2026-11-02T21:43:40.522Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:43:42.563Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:43:42.741Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:43:42.741Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:43:45.772Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:43:45.772Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:43:45.779Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-02T21:43:45.779Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:43:45.793Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:43:45.793Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:43:45.823Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:43:48.717Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:43:48.717Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T21:43:49.349Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-ipp-a-e12f99","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-ipp-a-e12f99\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:43:56.352Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","Gateway","HTTPRoute","ConfigMap"],"eventTypes":{"create":1,"update":21}}
{"level":"info","ts":"2026-11-02T21:44:01.535Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:44:01.541Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:44:01.545Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:44:01.545Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:44:01.548Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:44:01.549Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:44:01.724Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:44:04.589Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:44:04.589Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:44:12.484Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","TokenRateLimitPolicy","Limitador","EnvoyFilter","HTTPRoute","AuthPolicy","ConfigMap"],"eventTypes":{"create":12,"update":24}}
{"level":"info","ts":"2026-11-02T21:44:12.820Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:44:14.343Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:44:14.535Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:44:14.535Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:44:17.946Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:44:17.951Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:44:17.958Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-02T21:44:17.958Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:44:17.970Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:44:17.970Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:44:18.023Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:44:20.980Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:44:20.980Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:44:25.556Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","ConfigMap","AuthPolicy","Limitador"],"eventTypes":{"update":22}}
{"level":"info","ts":"2026-11-02T21:44:25.850Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:44:27.741Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:44:27.934Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:44:27.934Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:44:31.137Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:44:31.146Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:44:31.146Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:44:31.156Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:44:31.156Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:44:31.162Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-02T21:44:31.162Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:44:31Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ipp-a-15253e","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-a-15253e","reconcileID":"5e9f5e87-136a-4d0d-adb9-96de815fbb3b","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-ipp-a-15253e","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:44:31Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-a-15253e","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T21:44:31Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:44:31Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-11-02T21:44:31Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:44:31Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-11-02T21:44:31Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ipp-a-15253e","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-a-15253e","reconcileID":"5e9f5e87-136a-4d0d-adb9-96de815fbb3b","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-ipp-a-15253e","namespace":"openshift-ingress"}
{"level":"error","ts":"2026-11-02T21:44:31Z","logger":"telemetry-policy-extension-controller","msg":"Reconciler error","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ipp-a-15253e","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-a-15253e","reconcileID":"462d8753-966a-4afe-9525-ab1efa633cd7","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-ipp-a-15253e\" not found","stacktrace":"sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:353\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-02T21:44:31Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-a-15253e","event":"DELETE"}
{"level":"info","ts":"2026-11-02T21:44:31Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-02T21:44:31Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-ipp-a-15253e\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-02T21:44:31Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"error","ts":"2026-11-02T21:44:33.867Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-ipp-a-15253e","namespace":"openshift-ingress","uid":"79cea698-ef77-4328-8e5e-94fb3112db27","error":"tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-ipp-a-15253e\" not found"}
{"level":"info","ts":"2026-11-02T21:44:34.346Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:44:34.346Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T21:44:34.841Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-ipp-a-15253e","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-ipp-a-15253e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:44:37Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-praxis-a-be6df0","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-a-be6df0","reconcileID":"c7f13d90-e441-4d7c-b9e2-716519e6d5f9","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-praxis-a-be6df0","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:44:37Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-a-be6df0","event":"CREATE"}
{"level":"info","ts":"2026-11-02T21:44:37Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:44:37Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-02T21:44:37Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-02T21:44:37Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:44:37Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-praxis-a-be6df0","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-a-be6df0","reconcileID":"0acf1629-a502-42b3-98fd-a0f006cfbd25","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-praxis-a-be6df0","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:44:37Z","logger":"telemetry-policy-extension-controller","msg":"Warning: Reconciler returned both a non-zero result and a non-nil error. The result will always be ignored if the error is non-nil and the non-nil error causes requeuing with exponential backoff. For more details, see: https://pkg.go.dev/sigs.k8s.io/controller-runtime/pkg/reconcile#Reconciler","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-praxis-a-be6df0","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-a-be6df0","reconcileID":"0acf1629-a502-42b3-98fd-a0f006cfbd25"}
{"level":"error","ts":"2026-11-02T21:44:37Z","logger":"telemetry-policy-extension-controller","msg":"Reconciler error","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-praxis-a-be6df0","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-a-be6df0","reconcileID":"0acf1629-a502-42b3-98fd-a0f006cfbd25","error":"Operation cannot be fulfilled on telemetrypolicies.extensions.kuadrant.io \"maas-telemetry-e2e-praxis-a-be6df0\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:353\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-02T21:44:37Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-praxis-a-be6df0","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-a-be6df0","reconcileID":"79bc403e-873c-4843-97ee-a61036cb2f89","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-praxis-a-be6df0","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:44:37Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-a-be6df0","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T21:44:37Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:44:38Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-02T21:44:38Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-02T21:44:38Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-02T21:44:38Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:44:38Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-a-be6df0","event":"UNKNOWN"}
{"level":"info","ts":"2026-11-02T21:44:38Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:44:38Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-02T21:44:38Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-02T21:44:38Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-02T21:44:38Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:44:45.939Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Kuadrant","EnvoyFilter","ConfigMap","Gateway","HTTPRoute","AuthPolicy","TokenRateLimitPolicy"],"eventTypes":{"create":2,"delete":2,"update":5}}
{"level":"info","ts":"2026-11-02T21:44:46.162Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:44:46.170Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:44:48.762Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:44:49.035Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:44:49.042Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:44:49.249Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:44:49.249Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:44:52.757Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:44:52.764Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:44:52.757Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:44:52.771Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:44:52.773Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:44:52.773Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:44:52.969Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T21:44:54.593Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-ipp-a-e12f99-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-ipp-a-e12f99-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:44:55.969Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:44:55.969Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:44:57.552Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","Gateway","Kuadrant","EnvoyFilter","AuthPolicy"],"eventTypes":{"create":2,"delete":5,"update":1}}
{"level":"info","ts":"2026-11-02T21:44:57.883Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:44:57.923Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:45:01.559Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:45:01.723Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:45:01.773Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:45:01.942Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:45:01.942Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:45:05.650Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:45:05.664Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:45:05.664Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:45:05.665Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:45:05.665Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:45:05.674Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"error","ts":"2026-11-02T21:45:05.711Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-praxis-a-be6df0","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/ratelimit":"true"},"name":"kuadrant-ratelimiting-e2e-praxis-a-be6df0","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-praxis-a-be6df0","uid":"c27549f0-d317-4ba6-b79d-b5bbd7bd32cf"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"limitador-limitador.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-ratelimit-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"limitador-limitador.kuadrant-system.svc.cluster.local","port_value":8081}}}}]}]},"name":"kuadrant-ratelimit-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-praxis-a-be6df0"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-praxis-a-be6df0\" already exists"}
{"level":"error","ts":"2026-11-02T21:45:05.731Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-praxis-a-be6df0","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"kuadrant-auth-e2e-praxis-a-be6df0","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-praxis-a-be6df0","uid":"c27549f0-d317-4ba6-b79d-b5bbd7bd32cf"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-auth-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local","port_value":50051}}}}]}]},"name":"kuadrant-auth-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-praxis-a-be6df0"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-praxis-a-be6df0\" already exists"}
{"level":"error","ts":"2026-11-02T21:45:05.767Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:45:05.767Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T21:45:05.792Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-be6df0","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-be6df0#rule-6"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"b75ab7f295d70d55dbec8ca12c652e7abb62d2ebcc92b898f4c4729d7f8803c3","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["b75ab7f295d70d55dbec8ca12c652e7abb62d2ebcc92b898f4c4729d7f8803c3"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-a-be6df0.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-a-be6df0.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"b75ab7f295d70d55dbec8ca12c652e7abb62d2ebcc92b898f4c4729d7f8803c3\" already exists"}
{"level":"error","ts":"2026-11-02T21:45:05.864Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-be6df0","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-be6df0#rule-3"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"370242dc36799ee454bd95f7efe8c65254abd6f8326b5b6178a643c470edeebe","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["370242dc36799ee454bd95f7efe8c65254abd6f8326b5b6178a643c470edeebe"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-a-be6df0.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-a-be6df0.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"370242dc36799ee454bd95f7efe8c65254abd6f8326b5b6178a643c470edeebe\" already exists"}
{"level":"error","ts":"2026-11-02T21:45:05.939Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-be6df0","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-be6df0#rule-2"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"8f13dfe4a3332a794731ee8067bfcba5d7ea8d31b51b50c4d668585cf14007b3","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["8f13dfe4a3332a794731ee8067bfcba5d7ea8d31b51b50c4d668585cf14007b3"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-a-be6df0.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-a-be6df0.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"8f13dfe4a3332a794731ee8067bfcba5d7ea8d31b51b50c4d668585cf14007b3\" already exists"}
{"level":"error","ts":"2026-11-02T21:45:06.019Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-be6df0","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-be6df0#rule-4"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"6db1caed750e62eae6b27440400077fbd5b058973a42963a64d608e7399b6c78","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["6db1caed750e62eae6b27440400077fbd5b058973a42963a64d608e7399b6c78"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-a-be6df0.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-a-be6df0.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"6db1caed750e62eae6b27440400077fbd5b058973a42963a64d608e7399b6c78\" already exists"}
{"level":"error","ts":"2026-11-02T21:45:06.144Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-be6df0","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-be6df0#rule-5"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"56875159a661af9bcb999a76f0afc515e944f5060f39a2b31919abac8354d435","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["56875159a661af9bcb999a76f0afc515e944f5060f39a2b31919abac8354d435"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-a-be6df0.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-a-be6df0.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"56875159a661af9bcb999a76f0afc515e944f5060f39a2b31919abac8354d435\" already exists"}
{"level":"error","ts":"2026-11-02T21:45:06.215Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-be6df0","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-be6df0#rule-1"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"c97c18e99caf3c1be21795b827e39cec68b2a2d7edae7fc7ae3a6db08ba3b2bc","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["c97c18e99caf3c1be21795b827e39cec68b2a2d7edae7fc7ae3a6db08ba3b2bc"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-a-be6df0.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-a-be6df0.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"c97c18e99caf3c1be21795b827e39cec68b2a2d7edae7fc7ae3a6db08ba3b2bc\" already exists"}
{"level":"error","ts":"2026-11-02T21:45:06.282Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/d76093039d48df45b00344ef57af7d23a93c3afec85dba375992202ded1972f7","error":"authconfigs.authorino.kuadrant.io \"d76093039d48df45b00344ef57af7d23a93c3afec85dba375992202ded1972f7\" not found"}
{"level":"error","ts":"2026-11-02T21:45:06.338Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/04b357832e46c3de2ace6cc7e52929da5c1fba0dde72dbfdfc7d533c2903151d","error":"authconfigs.authorino.kuadrant.io \"04b357832e46c3de2ace6cc7e52929da5c1fba0dde72dbfdfc7d533c2903151d\" not found"}
{"level":"error","ts":"2026-11-02T21:45:06.395Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/08e42ab17cbf96c8e376cbd7311a3f69335b9ca4d010e0f3f637c7e4737037ab","error":"authconfigs.authorino.kuadrant.io \"08e42ab17cbf96c8e376cbd7311a3f69335b9ca4d010e0f3f637c7e4737037ab\" not found"}
{"level":"error","ts":"2026-11-02T21:45:06.450Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/1a02d37b4a6a46c1c934bc01fe493a684b5edfa1ff612d557252bec0500db39a","error":"authconfigs.authorino.kuadrant.io \"1a02d37b4a6a46c1c934bc01fe493a684b5edfa1ff612d557252bec0500db39a\" not found"}
{"level":"error","ts":"2026-11-02T21:45:06.504Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/00f59d7451e61295cd0230a6b7a8ab76c246b47ee0a15b7e294d0d200eba9031","error":"authconfigs.authorino.kuadrant.io \"00f59d7451e61295cd0230a6b7a8ab76c246b47ee0a15b7e294d0d200eba9031\" not found"}
{"level":"error","ts":"2026-11-02T21:45:06.559Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/d7ce8a0a8b4a4918ca9d4d6f6cfe98322e930a07107ca11d0899f718ca87d5fb","error":"authconfigs.authorino.kuadrant.io \"d7ce8a0a8b4a4918ca9d4d6f6cfe98322e930a07107ca11d0899f718ca87d5fb\" not found"}
{"level":"error","ts":"2026-11-02T21:45:07.034Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-praxis-a-be6df0","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"name":"kuadrant-e2e-praxis-a-be6df0","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-praxis-a-be6df0","uid":"c27549f0-d317-4ba6-b79d-b5bbd7bd32cf"}]},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b75ab7f295d70d55dbec8ca12c652e7abb62d2ebcc92b898f4c4729d7f8803c3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-a-be6df0-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__287ae0ac\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-be6df0\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-a-be6df0\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__287ae0ac\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-be6df0\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-a-be6df0\"]}],\"name\":\"7c5a7e6bb931da271c32c3dc0bb86706629a241cb653508387132720b3809779\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8f13dfe4a3332a794731ee8067bfcba5d7ea8d31b51b50c4d668585cf14007b3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-a-be6df0-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__287ae0ac\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-be6df0\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-a-be6df0\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__287ae0ac\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-be6df0\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-a-be6df0\"]}],\"name\":\"6f8bc8ba7e193e529b8f100921ad243db66f5232c5f844334cde9aad7edcbd13\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"56875159a661af9bcb999a76f0afc515e944f5060f39a2b31919abac8354d435\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-a-be6df0-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__287ae0ac\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-be6df0\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-a-be6df0\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__287ae0ac\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-be6df0\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-a-be6df0\"]}],\"name\":\"8f62dae7b5729106c3cdecc6b11f2051eab02f791277b88062eeba2744abbb57\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"370242dc36799ee454bd95f7efe8c65254abd6f8326b5b6178a643c470edeebe\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-a-be6df0-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__287ae0ac\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-be6df0\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-a-be6df0\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__287ae0ac\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-be6df0\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-a-be6df0\"]}],\"name\":\"1f3f4bef8ca7ea66e09f066ed4bd82dce66bb301328f52d8c36051d86652966d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6db1caed750e62eae6b27440400077fbd5b058973a42963a64d608e7399b6c78\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-a-be6df0-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__287ae0ac\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-be6df0\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-a-be6df0\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__287ae0ac\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-be6df0\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-a-be6df0\"]}],\"name\":\"2add2dcdd3eeaece85ada0676457a2acde3478c77e7600d68474d6f965f19e40\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c97c18e99caf3c1be21795b827e39cec68b2a2d7edae7fc7ae3a6db08ba3b2bc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-a-be6df0-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__287ae0ac\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-be6df0\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-a-be6df0\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__287ae0ac\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-be6df0\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-a-be6df0\"]}],\"name\":\"c3f131a6344bd27495ce677480b4a8c896af657916dfbcc6a11e149003673fd4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-praxis-a-be6df0"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-e2e-praxis-a-be6df0\" already exists"}
{"level":"error","ts":"2026-11-02T21:45:07.153Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w3-f51151","namespace":"e2e-models-e2e-worker-w3-f51151","uid":"e3340067-224a-43ad-8020-ca9e00ead152","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w3-f51151\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:45:07.157Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-praxis-a-be6df0-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-praxis-a-be6df0-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:45:07.270Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-ipp-a-e12f99","namespace":"openshift-ingress","uid":"586f6ac7-72ee-4a5c-83d6-b9b39b674005","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-ipp-a-e12f99\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:45:07.331Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-facebook-opt-125m-simulated","namespace":"llm","uid":"da8edb1a-ed61-454d-939f-fc7cd235d9fb","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-facebook-opt-125m-simulated\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:45:07.393Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w2-6fa533","namespace":"e2e-models-e2e-worker-w2-6fa533","uid":"2ff73667-c2c3-4579-9503-b6ca098f1021","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w2-6fa533\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:45:07.472Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-ipp-a-e12f99-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-ipp-a-e12f99-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:45:07.511Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-praxis-a-be6df0","namespace":"openshift-ingress","uid":"5202e01b-afdb-44ab-98c1-c5c24d1449a1","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-praxis-a-be6df0\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:45:07.569Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-ipp-b-3e3997","namespace":"openshift-ingress","uid":"b3699a22-0612-4e54-b536-47bce1c563f6","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-ipp-b-3e3997\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:45:07.634Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w4-d6cb38","namespace":"e2e-models-e2e-worker-w4-d6cb38","uid":"0d3ebd35-5005-4ee4-a055-ff95546e3673","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w4-d6cb38\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:45:07.697Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w0-0c9014","namespace":"e2e-models-e2e-worker-w0-0c9014","uid":"4f647df6-1d5b-433b-b4fc-1279ff1755f7","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w0-0c9014\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:45:07.757Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w2-6fa533","namespace":"e2e-models-e2e-worker-w2-6fa533","uid":"3a128bb2-de88-49aa-ab9e-c8626107a077","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w2-6fa533\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:45:07.815Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w3-f51151","namespace":"e2e-models-e2e-worker-w3-f51151","uid":"c78aa03a-e3ca-4797-8a09-ab0d9cd88148","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w3-f51151\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:45:07.873Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-ipp-b-6a9abc","namespace":"openshift-ingress","uid":"223ef469-9c1b-4980-b3f1-e4ef639d8f87","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-ipp-b-6a9abc\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:45:07.936Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-ipp-a-ce2453","namespace":"openshift-ingress","uid":"294447a1-97cf-47b8-8c42-e0e6eb41e223","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-ipp-a-ce2453\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:45:07.996Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w4-d6cb38","namespace":"e2e-models-e2e-worker-w4-d6cb38","uid":"486176e6-7786-40c4-9ce0-6f4a68b408b2","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w4-d6cb38\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:45:08.055Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w1-5f765a","namespace":"e2e-models-e2e-worker-w1-5f765a","uid":"9c852546-ee7c-4e72-855c-111315f7bf82","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w1-5f765a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:45:08.115Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w1-5f765a","namespace":"e2e-models-e2e-worker-w1-5f765a","uid":"7188eadc-9748-4be8-a5e2-d904cf5b6130","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w1-5f765a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:45:08Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ipp-b-6a9abc","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-b-6a9abc","reconcileID":"6797c967-5fb7-45b0-b978-4d77aff2247a","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-ipp-b-6a9abc","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:45:08Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-b-6a9abc","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T21:45:08Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:45:08Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-11-02T21:45:08Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"error","ts":"2026-11-02T21:45:08.312Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-ipp-a-7d3617","namespace":"openshift-ingress","uid":"145eadb1-b934-4484-bb5c-a149bec3181e","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-ipp-a-7d3617\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:45:08Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-11-02T21:45:08Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ipp-b-6a9abc","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-b-6a9abc","reconcileID":"6797c967-5fb7-45b0-b978-4d77aff2247a","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-ipp-b-6a9abc","namespace":"openshift-ingress"}
{"level":"error","ts":"2026-11-02T21:45:08.447Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w0-0c9014","namespace":"e2e-models-e2e-worker-w0-0c9014","uid":"dcb5a0e4-7049-4ddc-91de-e14d55b09789","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w0-0c9014\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:45:08Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-b-6a9abc","event":"DELETE"}
{"level":"info","ts":"2026-11-02T21:45:08Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-02T21:45:08Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-ipp-b-6a9abc\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-02T21:45:08Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"error","ts":"2026-11-02T21:45:08.508Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-simulated-simulated-premium","namespace":"llm","uid":"447993be-3c57-4e68-8ffa-6fc998a39c77","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-simulated-simulated-premium\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:45:08.634Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-ipp-b-387f88","namespace":"openshift-ingress","uid":"e48487ef-c119-41ea-b486-34b8fc542f2c","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-ipp-b-387f88\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:45:08.634Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:45:08.634Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T21:45:08.854Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-praxis-a-be6df0","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-praxis-a-be6df0\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:45:09.147Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"maas-api-route-e2e-praxis-a-be6df0","namespace":"odh-ai-gateway-infra","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"maas-api-route-e2e-praxis-a-be6df0\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:45:09.175Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-ipp-b-6a9abc","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-ipp-b-6a9abc\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:45:09Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ipp-a-7d3617","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-a-7d3617","reconcileID":"405b12a3-6615-4f61-a2e8-929fb68cc495","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-ipp-a-7d3617","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:45:09Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-a-7d3617","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T21:45:09Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:45:09Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-11-02T21:45:09Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:45:09Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-11-02T21:45:09Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ipp-a-7d3617","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-a-7d3617","reconcileID":"405b12a3-6615-4f61-a2e8-929fb68cc495","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-ipp-a-7d3617","namespace":"openshift-ingress"}
{"level":"error","ts":"2026-11-02T21:45:09Z","logger":"telemetry-policy-extension-controller","msg":"Reconciler error","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ipp-a-7d3617","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-a-7d3617","reconcileID":"e8c003c8-1045-4b74-809a-4435c6aa8992","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-ipp-a-7d3617\" not found","stacktrace":"sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:353\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-02T21:45:09Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-a-7d3617","event":"DELETE"}
{"level":"info","ts":"2026-11-02T21:45:09Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-02T21:45:09Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-ipp-a-7d3617\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-02T21:45:09Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:45:20.126Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","TokenRateLimitPolicy","Gateway","Limitador","AuthPolicy","ConfigMap","EnvoyFilter","Kuadrant","HTTPRoute"],"eventTypes":{"create":9,"delete":10,"update":26}}
{"level":"info","ts":"2026-11-02T21:45:20.450Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:45:20.470Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:45:23.037Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:45:23.747Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:45:23.835Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:45:23.835Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:45:23.923Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:45:26.746Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:45:26.749Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:45:26.756Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:45:26.763Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:45:26.769Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:45:26.769Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:45:26.910Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:45:30.339Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:45:30.339Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:45:31.728Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway","AuthPolicy","EnvoyFilter"],"eventTypes":{"create":1,"delete":10}}
{"level":"info","ts":"2026-11-02T21:45:36.838Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:45:36.842Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:45:36.852Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:45:36.870Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:45:36.874Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:45:36.874Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-02T21:45:36.952Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:45:36.952Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T21:45:36.955Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-ipp-a-e12f99/ipp-route-e12f99-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-ipp-a-e12f99/ipp-route-e12f99-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-02T21:44:02Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:44:02Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:44:03Z"}],"name":"9dfa734d03faae8faf6733ec7e5c45619a0418de1ac529002f8941eed13de930","namespace":"kuadrant-system","resourceVersion":"64218","uid":"e3b75afb-bc6f-476b-ba20-152046cd8d01"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["9dfa734d03faae8faf6733ec7e5c45619a0418de1ac529002f8941eed13de930"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-a-e12f99.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-a-e12f99.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:44:02Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:44:02Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["9dfa734d03faae8faf6733ec7e5c45619a0418de1ac529002f8941eed13de930"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"9dfa734d03faae8faf6733ec7e5c45619a0418de1ac529002f8941eed13de930\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:45:37.017Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-ipp-a-e12f99/ipp-route-e12f99-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-ipp-a-e12f99/ipp-route-e12f99-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-02T21:44:02Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:44:02Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:44:02Z"}],"name":"d3ff2a72657355e32eddbafc4cdddea0b439fc280dd0e5c3f5c03ef791f949e6","namespace":"kuadrant-system","resourceVersion":"64191","uid":"36e3630c-a1ac-4595-b3cb-c1171d6bd493"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d3ff2a72657355e32eddbafc4cdddea0b439fc280dd0e5c3f5c03ef791f949e6"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-a-e12f99.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-a-e12f99.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:44:02Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:44:02Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["d3ff2a72657355e32eddbafc4cdddea0b439fc280dd0e5c3f5c03ef791f949e6"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"d3ff2a72657355e32eddbafc4cdddea0b439fc280dd0e5c3f5c03ef791f949e6\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:45:37.084Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-e12f99","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-e12f99#rule-5"},"creationTimestamp":"2026-11-02T21:39:44Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:39:44Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:39:44Z"}],"name":"4924b812583d5cb214dfa7b4f30534b959fa1139a89409fbc55542fbff6ef00b","namespace":"kuadrant-system","resourceVersion":"57596","uid":"01f3a21a-8d11-40b4-b3c2-3fccd0019728"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["4924b812583d5cb214dfa7b4f30534b959fa1139a89409fbc55542fbff6ef00b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-a-e12f99.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-a-e12f99.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:39:44Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:39:44Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["4924b812583d5cb214dfa7b4f30534b959fa1139a89409fbc55542fbff6ef00b"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"4924b812583d5cb214dfa7b4f30534b959fa1139a89409fbc55542fbff6ef00b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:45:37.150Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-ipp-a-e12f99/ipp-route-e12f99-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-ipp-a-e12f99/ipp-route-e12f99-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-02T21:44:02Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:44:02Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:44:02Z"}],"name":"371eddc8658a41abeabdc6abfa87ef7f16f8987ea0f9213346566ca7438b35a9","namespace":"kuadrant-system","resourceVersion":"64213","uid":"c0a930c7-3bb2-4b30-9686-394e24636a84"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["371eddc8658a41abeabdc6abfa87ef7f16f8987ea0f9213346566ca7438b35a9"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-a-e12f99.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-a-e12f99.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:44:02Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:44:02Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["371eddc8658a41abeabdc6abfa87ef7f16f8987ea0f9213346566ca7438b35a9"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"371eddc8658a41abeabdc6abfa87ef7f16f8987ea0f9213346566ca7438b35a9\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:45:37.215Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-e12f99","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-e12f99#rule-2"},"creationTimestamp":"2026-11-02T21:39:44Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:39:44Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:39:44Z"}],"name":"b939d14c6d500da913442bf0ae2eae702210661bada1be383e0c3a90fe89911f","namespace":"kuadrant-system","resourceVersion":"57600","uid":"4e759487-3f1b-4f89-8362-bdff6d7c8e74"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["b939d14c6d500da913442bf0ae2eae702210661bada1be383e0c3a90fe89911f"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-a-e12f99.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-a-e12f99.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:39:44Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:39:44Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["b939d14c6d500da913442bf0ae2eae702210661bada1be383e0c3a90fe89911f"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"b939d14c6d500da913442bf0ae2eae702210661bada1be383e0c3a90fe89911f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:45:37.286Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-ipp-a-e12f99/ipp-route-e12f99-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-ipp-a-e12f99/ipp-route-e12f99-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-02T21:44:01Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:44:01Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:44:02Z"}],"name":"66794f8c019123d8d3fd237af6104a154aa66e7234a9f42388fd8ef3230463d9","namespace":"kuadrant-system","resourceVersion":"64187","uid":"cd66890d-1a76-4466-9543-a1f4b4e93924"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["66794f8c019123d8d3fd237af6104a154aa66e7234a9f42388fd8ef3230463d9"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-a-e12f99.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-a-e12f99.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:44:02Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:44:02Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["66794f8c019123d8d3fd237af6104a154aa66e7234a9f42388fd8ef3230463d9"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"66794f8c019123d8d3fd237af6104a154aa66e7234a9f42388fd8ef3230463d9\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:45:37.352Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-e12f99","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-e12f99#rule-6"},"creationTimestamp":"2026-11-02T21:39:44Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:39:44Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:39:44Z"}],"name":"fc1e4861794bf508710ccd5cfb530682e02b122815daf9063a3bcf7001ff8c42","namespace":"kuadrant-system","resourceVersion":"57602","uid":"85cb6cb8-7168-4948-8a7e-9c532c2a9165"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["fc1e4861794bf508710ccd5cfb530682e02b122815daf9063a3bcf7001ff8c42"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-a-e12f99.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-a-e12f99.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:39:44Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:39:44Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["fc1e4861794bf508710ccd5cfb530682e02b122815daf9063a3bcf7001ff8c42"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"fc1e4861794bf508710ccd5cfb530682e02b122815daf9063a3bcf7001ff8c42\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:45:37.417Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-ipp-a-e12f99/ipp-route-e12f99-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-ipp-a-e12f99/ipp-route-e12f99-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-02T21:44:02Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:44:02Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:44:02Z"}],"name":"123329622ef3ba90cfdb9d478795e9f94b9580e9b2de1d6a91e354b67c693e4c","namespace":"kuadrant-system","resourceVersion":"64195","uid":"80d644e7-17bf-491f-9dd0-979c894ff434"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["123329622ef3ba90cfdb9d478795e9f94b9580e9b2de1d6a91e354b67c693e4c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-a-e12f99.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-a-e12f99.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:44:02Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:44:02Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["123329622ef3ba90cfdb9d478795e9f94b9580e9b2de1d6a91e354b67c693e4c"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"123329622ef3ba90cfdb9d478795e9f94b9580e9b2de1d6a91e354b67c693e4c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:45:37Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ipp-b-387f88","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-b-387f88","reconcileID":"5c34ec83-196b-41ff-a95a-a20298a83939","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-ipp-b-387f88","namespace":"openshift-ingress"}
{"level":"error","ts":"2026-11-02T21:45:37.480Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-e12f99","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-e12f99#rule-1"},"creationTimestamp":"2026-11-02T21:39:44Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:39:44Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:39:44Z"}],"name":"b6bef48bf81237b36892ce9be6f139179845dcc51505a86074b2e83bb220bf3f","namespace":"kuadrant-system","resourceVersion":"57588","uid":"02ba6e4d-2a42-4a95-86f9-3b737b2d2bef"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["b6bef48bf81237b36892ce9be6f139179845dcc51505a86074b2e83bb220bf3f"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-a-e12f99.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-a-e12f99.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:39:44Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:39:44Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["b6bef48bf81237b36892ce9be6f139179845dcc51505a86074b2e83bb220bf3f"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"b6bef48bf81237b36892ce9be6f139179845dcc51505a86074b2e83bb220bf3f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:45:37Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-b-387f88","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T21:45:37Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:45:37Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-11-02T21:45:37Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"error","ts":"2026-11-02T21:45:37.544Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-ipp-a-e12f99/ipp-route-e12f99-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-ipp-a-e12f99/ipp-route-e12f99-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-02T21:44:02Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:44:02Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:44:02Z"}],"name":"003e96a349243248e09431ae8474bd532bb07c40f974c9bc1bfad04c4062f88d","namespace":"kuadrant-system","resourceVersion":"64201","uid":"ba38558c-523c-4a43-b416-fe521bdd42ea"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["003e96a349243248e09431ae8474bd532bb07c40f974c9bc1bfad04c4062f88d"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-a-e12f99.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-a-e12f99.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:44:02Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:44:02Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["003e96a349243248e09431ae8474bd532bb07c40f974c9bc1bfad04c4062f88d"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"003e96a349243248e09431ae8474bd532bb07c40f974c9bc1bfad04c4062f88d\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:45:37Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-11-02T21:45:37Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ipp-b-387f88","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-b-387f88","reconcileID":"5c34ec83-196b-41ff-a95a-a20298a83939","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-ipp-b-387f88","namespace":"openshift-ingress"}
{"level":"error","ts":"2026-11-02T21:45:37.633Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-ipp-a-e12f99/ipp-route-e12f99-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-ipp-a-e12f99/ipp-route-e12f99-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-02T21:44:02Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:44:02Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:44:02Z"}],"name":"1ab2b03930caeb0b01e3866fe3bbb355b701f7dc9e7aef4e61231215ddeb712e","namespace":"kuadrant-system","resourceVersion":"64199","uid":"617dedb9-ef4c-4cfe-9768-285a844fb288"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["1ab2b03930caeb0b01e3866fe3bbb355b701f7dc9e7aef4e61231215ddeb712e"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-a-e12f99.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-a-e12f99.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:44:02Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:44:02Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["1ab2b03930caeb0b01e3866fe3bbb355b701f7dc9e7aef4e61231215ddeb712e"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"1ab2b03930caeb0b01e3866fe3bbb355b701f7dc9e7aef4e61231215ddeb712e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:45:37Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-b-387f88","event":"DELETE"}
{"level":"info","ts":"2026-11-02T21:45:37Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-02T21:45:37Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-ipp-b-387f88\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-02T21:45:37Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"error","ts":"2026-11-02T21:45:37.729Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-e12f99","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-e12f99#rule-4"},"creationTimestamp":"2026-11-02T21:39:44Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:39:44Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:39:44Z"}],"name":"16ec655cda4ed58fc097703b65e7d18cc8acb3ed7f71cae31f4cbfba87cfdb90","namespace":"kuadrant-system","resourceVersion":"57599","uid":"5af6c99e-6fed-4818-8885-b48d46e53525"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["16ec655cda4ed58fc097703b65e7d18cc8acb3ed7f71cae31f4cbfba87cfdb90"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-a-e12f99.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-a-e12f99.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:39:44Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:39:44Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["16ec655cda4ed58fc097703b65e7d18cc8acb3ed7f71cae31f4cbfba87cfdb90"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"16ec655cda4ed58fc097703b65e7d18cc8acb3ed7f71cae31f4cbfba87cfdb90\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:45:37.800Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-ipp-a-e12f99/ipp-route-e12f99-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-ipp-a-e12f99/ipp-route-e12f99-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-02T21:44:01Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:44:01Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:44:02Z"}],"name":"0f578de151b1d8010d70869ca70866d16a86320456f5a59c5540e4681e25ec9b","namespace":"kuadrant-system","resourceVersion":"64181","uid":"2678bf26-8555-42c0-8faf-ef1e8fbe78a3"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["0f578de151b1d8010d70869ca70866d16a86320456f5a59c5540e4681e25ec9b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-a-e12f99.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-a-e12f99.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:44:02Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:44:02Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["0f578de151b1d8010d70869ca70866d16a86320456f5a59c5540e4681e25ec9b"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"0f578de151b1d8010d70869ca70866d16a86320456f5a59c5540e4681e25ec9b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:45:37.866Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-ipp-a-e12f99/ipp-route-e12f99-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-ipp-a-e12f99/ipp-route-e12f99-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-02T21:44:02Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:44:02Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:44:02Z"}],"name":"82db0765970933fb0040b44bdc690d9cb0141493fc84762f54d104062b6a1e49","namespace":"kuadrant-system","resourceVersion":"64212","uid":"f796a020-d460-4332-a853-afe126284839"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["82db0765970933fb0040b44bdc690d9cb0141493fc84762f54d104062b6a1e49"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-a-e12f99.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-a-e12f99.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:44:02Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:44:02Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["82db0765970933fb0040b44bdc690d9cb0141493fc84762f54d104062b6a1e49"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"82db0765970933fb0040b44bdc690d9cb0141493fc84762f54d104062b6a1e49\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:45:37.927Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-ipp-a-e12f99/ipp-route-e12f99-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-ipp-a-e12f99/ipp-route-e12f99-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-02T21:44:01Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:44:01Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:44:02Z"}],"name":"a742a522d948744d73e44cc3b6acafdfa4627da94da25a81facfa12f56f60257","namespace":"kuadrant-system","resourceVersion":"64179","uid":"062da6a6-76df-4a72-8cff-1fedde9b6412"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a742a522d948744d73e44cc3b6acafdfa4627da94da25a81facfa12f56f60257"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-a-e12f99.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-a-e12f99.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:44:01Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:44:01Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["a742a522d948744d73e44cc3b6acafdfa4627da94da25a81facfa12f56f60257"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a742a522d948744d73e44cc3b6acafdfa4627da94da25a81facfa12f56f60257\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:45:37.992Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-e12f99","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-e12f99#rule-3"},"creationTimestamp":"2026-11-02T21:39:44Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:39:44Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:39:44Z"}],"name":"7dcea37de001b1046b7b323eae24a7f4955980cdbb1f638b6bcb7c141644504d","namespace":"kuadrant-system","resourceVersion":"57592","uid":"a165f8cf-7875-41d0-a075-3b306d288f5a"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["7dcea37de001b1046b7b323eae24a7f4955980cdbb1f638b6bcb7c141644504d"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-a-e12f99.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-a-e12f99.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:39:44Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:39:44Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["7dcea37de001b1046b7b323eae24a7f4955980cdbb1f638b6bcb7c141644504d"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"7dcea37de001b1046b7b323eae24a7f4955980cdbb1f638b6bcb7c141644504d\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:45:38.055Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-ipp-a-e12f99/ipp-route-e12f99-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-ipp-a-e12f99/ipp-route-e12f99-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-02T21:44:01Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:44:01Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:44:01Z"}],"name":"b15bc4a4062d9f6bfe6f7170937cc11df0e7c3749d42565d906a6d5e8daa2d77","namespace":"kuadrant-system","resourceVersion":"64177","uid":"2ffcb5a3-9a42-4b5f-8006-c2a06f1fc1dd"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["b15bc4a4062d9f6bfe6f7170937cc11df0e7c3749d42565d906a6d5e8daa2d77"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-a-e12f99.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-a-e12f99.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:44:01Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:44:01Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["b15bc4a4062d9f6bfe6f7170937cc11df0e7c3749d42565d906a6d5e8daa2d77"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"b15bc4a4062d9f6bfe6f7170937cc11df0e7c3749d42565d906a6d5e8daa2d77\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:45:38.119Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-ipp-a-e12f99/ipp-route-e12f99-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-ipp-a-e12f99/ipp-route-e12f99-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-02T21:44:02Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:44:02Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:44:02Z"}],"name":"3f9569827298992b2b69e50061b898bd13ecda5691dc60035362fdd60a55861e","namespace":"kuadrant-system","resourceVersion":"64210","uid":"b3c51488-3555-4a9f-b959-286b8e576487"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["3f9569827298992b2b69e50061b898bd13ecda5691dc60035362fdd60a55861e"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-a-e12f99.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-ipp-a-e12f99.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:44:02Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:44:02Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["3f9569827298992b2b69e50061b898bd13ecda5691dc60035362fdd60a55861e"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"3f9569827298992b2b69e50061b898bd13ecda5691dc60035362fdd60a55861e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:45:38.187Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/f3e952e6dada04d0d598a918019b73dd6f6b858530b92ba28df0c75bafd151d6","error":"authconfigs.authorino.kuadrant.io \"f3e952e6dada04d0d598a918019b73dd6f6b858530b92ba28df0c75bafd151d6\" not found"}
{"level":"error","ts":"2026-11-02T21:45:38.244Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/4caab9b9f1aa91b34b2ff226de70ea89772732110a0e604d11b45716188cfe9f","error":"authconfigs.authorino.kuadrant.io \"4caab9b9f1aa91b34b2ff226de70ea89772732110a0e604d11b45716188cfe9f\" not found"}
{"level":"error","ts":"2026-11-02T21:45:38.299Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/c15bf0d2246a7ac40c66f725414673aa3274be7ac1239c924f6e364b0662ff11","error":"authconfigs.authorino.kuadrant.io \"c15bf0d2246a7ac40c66f725414673aa3274be7ac1239c924f6e364b0662ff11\" not found"}
{"level":"error","ts":"2026-11-02T21:45:38.353Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/5cbc6cbfb05adb2876e3c8ea22f08290348ae91c25c2176df41cad1dba678d72","error":"authconfigs.authorino.kuadrant.io \"5cbc6cbfb05adb2876e3c8ea22f08290348ae91c25c2176df41cad1dba678d72\" not found"}
{"level":"error","ts":"2026-11-02T21:45:38.409Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/e508d27ea55ee13280a9c1ba51e5e1ea67f12ccb8fc234dfb1431fb55e37c38d","error":"authconfigs.authorino.kuadrant.io \"e508d27ea55ee13280a9c1ba51e5e1ea67f12ccb8fc234dfb1431fb55e37c38d\" not found"}
{"level":"error","ts":"2026-11-02T21:45:38.465Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/3cc3ba3763c7b869446ab0ccc18eb235da4f27607399ad6a2dfd47cc15efb203","error":"authconfigs.authorino.kuadrant.io \"3cc3ba3763c7b869446ab0ccc18eb235da4f27607399ad6a2dfd47cc15efb203\" not found"}
{"level":"error","ts":"2026-11-02T21:45:38.519Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/1e727f94fd288266417af3cca9490acaa7fb007bf66e26d2b3df2f787fbb3077","error":"authconfigs.authorino.kuadrant.io \"1e727f94fd288266417af3cca9490acaa7fb007bf66e26d2b3df2f787fbb3077\" not found"}
{"level":"error","ts":"2026-11-02T21:45:38.574Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/150c8624b4eda3da4b6c57e6330c81779b269c75f26831ec089c50242083d74f","error":"authconfigs.authorino.kuadrant.io \"150c8624b4eda3da4b6c57e6330c81779b269c75f26831ec089c50242083d74f\" not found"}
{"level":"error","ts":"2026-11-02T21:45:38.628Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/da9b46671ee9af83f4b9d0321be549fad80a415c18137381f971b91a7bf6e540","error":"authconfigs.authorino.kuadrant.io \"da9b46671ee9af83f4b9d0321be549fad80a415c18137381f971b91a7bf6e540\" not found"}
{"level":"error","ts":"2026-11-02T21:45:38.683Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/a74187eb982637b3c6e5943ba0c00108688e988fdb7fefc4417556eaeed58a9b","error":"authconfigs.authorino.kuadrant.io \"a74187eb982637b3c6e5943ba0c00108688e988fdb7fefc4417556eaeed58a9b\" not found"}
{"level":"error","ts":"2026-11-02T21:45:38.738Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/dfce3003b3683bfa633459baf027b3e4c41fdf74ec3ae0282e3e85a85139cc02","error":"authconfigs.authorino.kuadrant.io \"dfce3003b3683bfa633459baf027b3e4c41fdf74ec3ae0282e3e85a85139cc02\" not found"}
{"level":"error","ts":"2026-11-02T21:45:38.793Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/d6ce1122a354e8c511fbb32c1378614dd5bb2b5632d82db4b58ab23a503d8753","error":"authconfigs.authorino.kuadrant.io \"d6ce1122a354e8c511fbb32c1378614dd5bb2b5632d82db4b58ab23a503d8753\" not found"}
{"level":"error","ts":"2026-11-02T21:45:38.995Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-praxis-a-be6df0-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-praxis-a-be6df0-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:45:39.201Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-ipp-a-e12f99-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-ipp-a-e12f99-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:45:39.800Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-praxis-a-be6df0","namespace":"openshift-ingress","uid":"5202e01b-afdb-44ab-98c1-c5c24d1449a1","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-praxis-a-be6df0\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:45:39.857Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-ipp-b-387f88","namespace":"openshift-ingress","uid":"e48487ef-c119-41ea-b486-34b8fc542f2c","error":"tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-ipp-b-387f88\" not found"}
{"level":"info","ts":"2026-11-02T21:45:40.154Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:45:40.154Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T21:45:40.606Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-ipp-b-387f88","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-ipp-b-387f88\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:45:47.667Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","Limitador","Gateway","ConfigMap","TokenRateLimitPolicy","AuthPolicy","Kuadrant","HTTPRoute"],"eventTypes":{"delete":14,"update":25}}
{"level":"info","ts":"2026-11-02T21:45:47.913Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:45:47.921Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:45:50.254Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:45:50.646Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:45:50.769Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:45:50.769Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:45:50.771Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:45:54.262Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:45:54.268Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:45:54.275Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:45:54.275Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:45:54.262Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:45:54.284Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-11-02T21:45:54.339Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to delete envoyfilter object","envoyfilter":"openshift-ingress/kuadrant-auth-e2e-ipp-b-387f88","error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-ipp-b-387f88\" not found"}
{"level":"error","ts":"2026-11-02T21:45:54.339Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to delete envoyfilter object","envoyfilter":"openshift-ingress/kuadrant-ratelimiting-e2e-ipp-b-387f88","error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-ipp-b-387f88\" not found"}
{"level":"error","ts":"2026-11-02T21:45:54.374Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:45:54.374Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T21:45:55.540Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to delete envoyfilter object","gateway":"openshift-ingress/e2e-ipp-b-387f88","envoyfilter":"openshift-ingress/kuadrant-e2e-ipp-b-387f88","error":"envoyfilters.networking.istio.io \"kuadrant-e2e-ipp-b-387f88\" not found"}
{"level":"info","ts":"2026-11-02T21:45:55Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ipp-b-aa60bc","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-b-aa60bc","reconcileID":"8dbdb939-9bcd-4b88-9158-e0f73a0288ff","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-ipp-b-aa60bc","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:45:55Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-b-aa60bc","event":"CREATE"}
{"level":"info","ts":"2026-11-02T21:45:55Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-02T21:45:55.956Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-ipp-b-387f88-maas-auth","namespace":"openshift-ingress","error":"authpolicies.kuadrant.io \"e2e-ipp-b-387f88-maas-auth\" not found"}
{"level":"info","ts":"2026-11-02T21:45:56Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-02T21:45:56Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-02T21:45:56Z","logger":"telemetry-policy-extension-controller","msg":"Failed to update status: resource might just be outdated"}
{"level":"info","ts":"2026-11-02T21:45:56Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:45:56Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ipp-b-aa60bc","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-b-aa60bc","reconcileID":"7e161009-2905-4e81-ab28-b7ecd3cbe037","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-ipp-b-aa60bc","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:45:56Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-b-aa60bc","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T21:45:56Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:45:56.904Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:45:56.904Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:45:57Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-02T21:45:57Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-02T21:45:57Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:45:57Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ipp-b-aa60bc","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-b-aa60bc","reconcileID":"daec0eff-2023-40c5-908e-eb1f41dcdb95","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-ipp-b-aa60bc","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:45:57Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-b-aa60bc","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T21:45:57Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-02T21:45:57.344Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-ipp-b-aa60bc","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-ipp-b-aa60bc\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:45:57.591Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-ipp-b-387f88","error":"gateways.gateway.networking.k8s.io \"e2e-ipp-b-387f88\" not found"}
{"level":"info","ts":"2026-11-02T21:45:57Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-02T21:45:57Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-02T21:45:57Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-02T21:45:57Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:46:07.889Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthPolicy","TokenRateLimitPolicy","Limitador","ConfigMap","Kuadrant","Gateway","HTTPRoute","AuthConfig","EnvoyFilter"],"eventTypes":{"create":5,"delete":11,"update":5}}
{"level":"info","ts":"2026-11-02T21:46:08.236Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:46:08.264Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:46:10.659Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:46:10.942Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:46:10.962Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:46:11.058Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:46:11.058Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:46:14.262Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:46:14.271Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:46:14.271Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:46:14.273Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:46:14.277Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:46:14.279Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:46:14.434Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:46:17.154Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:46:17.155Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:46:18.672Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy"],"eventTypes":{"create":1}}
{"level":"info","ts":"2026-11-02T21:46:23.964Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:46:23.970Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:46:23.971Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:46:23.971Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-02T21:46:24.023Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-ipp-b-aa60bc","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/ratelimit":"true"},"name":"kuadrant-ratelimiting-e2e-ipp-b-aa60bc","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-ipp-b-aa60bc","uid":"f4eca095-9674-4d54-a6d9-be28750a44b7"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"limitador-limitador.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-ratelimit-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"limitador-limitador.kuadrant-system.svc.cluster.local","port_value":8081}}}}]}]},"name":"kuadrant-ratelimit-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-ipp-b-aa60bc"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-ipp-b-aa60bc\" already exists"}
{"level":"error","ts":"2026-11-02T21:46:24.074Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:46:24.074Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T21:46:24.823Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-ipp-a-e12f99","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T21:39:44Z","generation":2,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"815f9bad-bf4a-41af-beef-f987797b3f13\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:44:02Z"}],"name":"kuadrant-e2e-ipp-a-e12f99","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-ipp-a-e12f99","uid":"815f9bad-bf4a-41af-beef-f987797b3f13"}],"resourceVersion":"64197","uid":"0b76053d-833f-4818-bd6a-ceebb0eed90c"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b15bc4a4062d9f6bfe6f7170937cc11df0e7c3749d42565d906a6d5e8daa2d77\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-a-e12f99-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5bfbd095\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"39c009ac2440e25e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-ipp-a-e12f99/ipp-route-e12f99-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-ipp-a-e12f99/maas-trlp-ipp-route-e12f99\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5bfbd095\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"39c009ac2440e25e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-ipp-a-e12f99/ipp-route-e12f99-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-ipp-a-e12f99/maas-trlp-ipp-route-e12f99\"]}],\"name\":\"b6647b2c507ddc26aab06b3cdd4685aff147a0ed65cb04b3bdee6a6a46b6352b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-ipp-a-e12f99/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b15bc4a4062d9f6bfe6f7170937cc11df0e7c3749d42565d906a6d5e8daa2d77\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-a-e12f99-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5bfbd095\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"39c009ac2440e25e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-ipp-a-e12f99/ipp-route-e12f99-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-ipp-a-e12f99/maas-trlp-ipp-route-e12f99\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5bfbd095\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"39c009ac2440e25e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-ipp-a-e12f99/ipp-route-e12f99-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-ipp-a-e12f99/maas-trlp-ipp-route-e12f99\"]}],\"name\":\"4c1c44ffde338d6d2a5bf0cee64abfb6db0b0697eaaf36b01199ab69d79b58aa\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-ipp-a-e12f99/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b15bc4a4062d9f6bfe6f7170937cc11df0e7c3749d42565d906a6d5e8daa2d77\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-a-e12f99-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5bfbd095\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"39c009ac2440e25e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-ipp-a-e12f99/ipp-route-e12f99-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-ipp-a-e12f99/maas-trlp-ipp-route-e12f99\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5bfbd095\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"39c009ac2440e25e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-ipp-a-e12f99/ipp-route-e12f99-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-ipp-a-e12f99/maas-trlp-ipp-route-e12f99\"]}],\"name\":\"e70b40ae8fb0ba6723eac910d9f91bbc3086feea2dabc4e7f69f4743f2164dc8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-ipp-a-e12f99/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b15bc4a4062d9f6bfe6f7170937cc11df0e7c3749d42565d906a6d5e8daa2d77\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-a-e12f99-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5bfbd095\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"39c009ac2440e25e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-ipp-a-e12f99/ipp-route-e12f99-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-ipp-a-e12f99/maas-trlp-ipp-route-e12f99\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5bfbd095\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"39c009ac2440e25e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-ipp-a-e12f99/ipp-route-e12f99-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-ipp-a-e12f99/maas-trlp-ipp-route-e12f99\"]}],\"name\":\"d3cbc6a2049b387a0856d2831ef410b548b0fb85cc07093b5a7f9950c1b6ee91\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-ipp-a-e12f99/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b15bc4a4062d9f6bfe6f7170937cc11df0e7c3749d42565d906a6d5e8daa2d77\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-a-e12f99-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5bfbd095\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"39c009ac2440e25e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-ipp-a-e12f99/ipp-route-e12f99-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-ipp-a-e12f99/maas-trlp-ipp-route-e12f99\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5bfbd095\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"39c009ac2440e25e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-ipp-a-e12f99/ipp-route-e12f99-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-ipp-a-e12f99/maas-trlp-ipp-route-e12f99\"]}],\"name\":\"e6533b3f9424f4096aaa42c631931096fff0ff2a8ef6d5354cab26884eae74e3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-ipp-a-e12f99/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b15bc4a4062d9f6bfe6f7170937cc11df0e7c3749d42565d906a6d5e8daa2d77\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-a-e12f99-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5bfbd095\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"39c009ac2440e25e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-ipp-a-e12f99/ipp-route-e12f99-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-ipp-a-e12f99/maas-trlp-ipp-route-e12f99\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5bfbd095\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"39c009ac2440e25e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-ipp-a-e12f99/ipp-route-e12f99-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-ipp-a-e12f99/maas-trlp-ipp-route-e12f99\"]}],\"name\":\"111fb6f0489e50b7a77f6676d1cb6470e1e76d12c79dcbaa15c7e7036da11e72\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-ipp-a-e12f99/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b15bc4a4062d9f6bfe6f7170937cc11df0e7c3749d42565d906a6d5e8daa2d77\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-a-e12f99-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5bfbd095\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"39c009ac2440e25e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-ipp-a-e12f99/ipp-route-e12f99-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-ipp-a-e12f99/maas-trlp-ipp-route-e12f99\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5bfbd095\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"39c009ac2440e25e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-ipp-a-e12f99/ipp-route-e12f99-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-ipp-a-e12f99/maas-trlp-ipp-route-e12f99\"]}],\"name\":\"d9e241a70ebc5bb514babd623db29d93b580fe964deaf578546abf0b499b7889\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-ipp-a-e12f99/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b15bc4a4062d9f6bfe6f7170937cc11df0e7c3749d42565d906a6d5e8daa2d77\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-a-e12f99-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5bfbd095\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"39c009ac2440e25e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-ipp-a-e12f99/ipp-route-e12f99-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-ipp-a-e12f99/maas-trlp-ipp-route-e12f99\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5bfbd095\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"39c009ac2440e25e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-ipp-a-e12f99/ipp-route-e12f99-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-ipp-a-e12f99/maas-trlp-ipp-route-e12f99\"]}],\"name\":\"1127a74db5bd7bcb7030cc34e7f103b795723216ced9ab41e88ff3c9a65c19e2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-ipp-a-e12f99/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fc1e4861794bf508710ccd5cfb530682e02b122815daf9063a3bcf7001ff8c42\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-a-e12f99-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__b10472ba\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-e12f99\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-e12f99\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__b10472ba\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-e12f99\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-e12f99\"]}],\"name\":\"711befbe67a0510d4df3ec2a5039c83fb4cb5b19a36576c3bf6ff455fc6c1bd2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"003e96a349243248e09431ae8474bd532bb07c40f974c9bc1bfad04c4062f88d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-a-e12f99-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5bfbd095\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"39c009ac2440e25e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-ipp-a-e12f99/ipp-route-e12f99-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-ipp-a-e12f99/maas-trlp-ipp-route-e12f99\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5bfbd095\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"39c009ac2440e25e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-ipp-a-e12f99/ipp-route-e12f99-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-ipp-a-e12f99/maas-trlp-ipp-route-e12f99\"]}],\"name\":\"6cceab8cd8d9a63a25c65fd34b34d036e6a7fab0150539f830bb01e188a2119d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-ipp-a-e12f99/models/facebook/opt-125m/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3f9569827298992b2b69e50061b898bd13ecda5691dc60035362fdd60a55861e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-a-e12f99-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5bfbd095\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"39c009ac2440e25e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-ipp-a-e12f99/ipp-route-e12f99-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-ipp-a-e12f99/maas-trlp-ipp-route-e12f99\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5bfbd095\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"39c009ac2440e25e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-ipp-a-e12f99/ipp-route-e12f99-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-ipp-a-e12f99/maas-trlp-ipp-route-e12f99\"]}],\"name\":\"2fad32a618658b0140f842895b7dc5a3d552d64c0be85dd46d6ec8551639adc5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-ipp-a-e12f99/models/facebook/opt-125m/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9dfa734d03faae8faf6733ec7e5c45619a0418de1ac529002f8941eed13de930\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-a-e12f99-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5bfbd095\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"39c009ac2440e25e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-ipp-a-e12f99/ipp-route-e12f99-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-ipp-a-e12f99/maas-trlp-ipp-route-e12f99\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5bfbd095\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"39c009ac2440e25e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-ipp-a-e12f99/ipp-route-e12f99-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-ipp-a-e12f99/maas-trlp-ipp-route-e12f99\"]}],\"name\":\"60c645e453492b0ba0fe5ccf344fe4a090b10af2465ef3363de120409f6fcc9d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-ipp-a-e12f99/models/facebook/opt-125m/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1ab2b03930caeb0b01e3866fe3bbb355b701f7dc9e7aef4e61231215ddeb712e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-a-e12f99-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5bfbd095\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"39c009ac2440e25e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-ipp-a-e12f99/ipp-route-e12f99-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-ipp-a-e12f99/maas-trlp-ipp-route-e12f99\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5bfbd095\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"39c009ac2440e25e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-ipp-a-e12f99/ipp-route-e12f99-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-ipp-a-e12f99/maas-trlp-ipp-route-e12f99\"]}],\"name\":\"e2524687605ead318d28a1e8d68dbe534a2ab31f499c6956888a62acff40cdf0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-ipp-a-e12f99/models/facebook/opt-125m/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"66794f8c019123d8d3fd237af6104a154aa66e7234a9f42388fd8ef3230463d9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-a-e12f99-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5bfbd095\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"39c009ac2440e25e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-ipp-a-e12f99/ipp-route-e12f99-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-ipp-a-e12f99/maas-trlp-ipp-route-e12f99\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5bfbd095\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"39c009ac2440e25e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-ipp-a-e12f99/ipp-route-e12f99-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-ipp-a-e12f99/maas-trlp-ipp-route-e12f99\"]}],\"name\":\"7d2e7bd4436d3a8a23a07bf22a5a63375b0f0ded7ebfdf1949caf0889852dffd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-ipp-a-e12f99/ipp-route-e12f99/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"123329622ef3ba90cfdb9d478795e9f94b9580e9b2de1d6a91e354b67c693e4c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-a-e12f99-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5bfbd095\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"39c009ac2440e25e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-ipp-a-e12f99/ipp-route-e12f99-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-ipp-a-e12f99/maas-trlp-ipp-route-e12f99\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5bfbd095\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"39c009ac2440e25e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-ipp-a-e12f99/ipp-route-e12f99-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-ipp-a-e12f99/maas-trlp-ipp-route-e12f99\"]}],\"name\":\"8a98a48c91150b5969a8fbceff1027dffa8cc2e620b28f33dd8c9568274518e3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-ipp-a-e12f99/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"371eddc8658a41abeabdc6abfa87ef7f16f8987ea0f9213346566ca7438b35a9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-a-e12f99-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5bfbd095\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"39c009ac2440e25e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-ipp-a-e12f99/ipp-route-e12f99-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-ipp-a-e12f99/maas-trlp-ipp-route-e12f99\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5bfbd095\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"39c009ac2440e25e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-ipp-a-e12f99/ipp-route-e12f99-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-ipp-a-e12f99/maas-trlp-ipp-route-e12f99\"]}],\"name\":\"1dbf2a8ca4944fa626e9b2cfcf3483960fcdc0720a3ba6897b49cef86e222d4e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-ipp-a-e12f99/ipp-route-e12f99/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0f578de151b1d8010d70869ca70866d16a86320456f5a59c5540e4681e25ec9b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-a-e12f99-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5bfbd095\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"39c009ac2440e25e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-ipp-a-e12f99/ipp-route-e12f99-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-ipp-a-e12f99/maas-trlp-ipp-route-e12f99\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5bfbd095\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"39c009ac2440e25e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-ipp-a-e12f99/ipp-route-e12f99-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-ipp-a-e12f99/maas-trlp-ipp-route-e12f99\"]}],\"name\":\"321804a006ddd8a740a1ec4cc6d17c055b7d04763dc6730c03b431f561e31911\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-ipp-a-e12f99/ipp-route-e12f99/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a742a522d948744d73e44cc3b6acafdfa4627da94da25a81facfa12f56f60257\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-a-e12f99-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5bfbd095\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"39c009ac2440e25e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-ipp-a-e12f99/ipp-route-e12f99-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-ipp-a-e12f99/maas-trlp-ipp-route-e12f99\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5bfbd095\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"39c009ac2440e25e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-ipp-a-e12f99/ipp-route-e12f99-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-ipp-a-e12f99/maas-trlp-ipp-route-e12f99\"]}],\"name\":\"9f580286c24afb5ab01ccced2215558b26e296c8e32f68994c91964ed382c5b0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-ipp-a-e12f99/ipp-route-e12f99/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3ff2a72657355e32eddbafc4cdddea0b439fc280dd0e5c3f5c03ef791f949e6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-a-e12f99-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5bfbd095\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"39c009ac2440e25e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-ipp-a-e12f99/ipp-route-e12f99-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-ipp-a-e12f99/maas-trlp-ipp-route-e12f99\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5bfbd095\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"39c009ac2440e25e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-ipp-a-e12f99/ipp-route-e12f99-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-ipp-a-e12f99/maas-trlp-ipp-route-e12f99\"]}],\"name\":\"9e8bb022bc144e585121d5cd4bfecfae3e12259faf5bed0176b3e6d2db7e370f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-ipp-a-e12f99/ipp-route-e12f99')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b939d14c6d500da913442bf0ae2eae702210661bada1be383e0c3a90fe89911f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-a-e12f99-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__b10472ba\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-e12f99\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-e12f99\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__b10472ba\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-e12f99\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-e12f99\"]}],\"name\":\"41a597358ed860568d04267f5ecfbdb4be05c1bcc8c921b955c3526c81cd9632\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4924b812583d5cb214dfa7b4f30534b959fa1139a89409fbc55542fbff6ef00b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-a-e12f99-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__b10472ba\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-e12f99\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-e12f99\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__b10472ba\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-e12f99\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-e12f99\"]}],\"name\":\"f91aa9677191c2ea62ab9c1fc043d6823f923f31628db0b831ef58064bddb80e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7dcea37de001b1046b7b323eae24a7f4955980cdbb1f638b6bcb7c141644504d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-a-e12f99-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__b10472ba\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-e12f99\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-e12f99\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__b10472ba\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-e12f99\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-e12f99\"]}],\"name\":\"a8f2bcca5f53acebf0ef60dfcbd9eed06508f4edeb3f039ee9c80346ead8759e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"16ec655cda4ed58fc097703b65e7d18cc8acb3ed7f71cae31f4cbfba87cfdb90\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-a-e12f99-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__b10472ba\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-e12f99\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-e12f99\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__b10472ba\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-e12f99\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-e12f99\"]}],\"name\":\"9495db98567f243daf101f53b4d8e81fde3203da58ecdc4e735049e3553e144e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b6bef48bf81237b36892ce9be6f139179845dcc51505a86074b2e83bb220bf3f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-a-e12f99-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__b10472ba\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-e12f99\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-e12f99\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__b10472ba\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-a-e12f99\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-a-e12f99\"]}],\"name\":\"4035efa6f651725a215dfa1f11fa7baa7e9cd0ceb621d248efe4db368b0fcbda\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"82db0765970933fb0040b44bdc690d9cb0141493fc84762f54d104062b6a1e49\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-a-e12f99-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5bfbd095\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"39c009ac2440e25e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-ipp-a-e12f99/ipp-route-e12f99-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-ipp-a-e12f99/maas-trlp-ipp-route-e12f99\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5bfbd095\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"39c009ac2440e25e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-ipp-a-e12f99/ipp-route-e12f99-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-ipp-a-e12f99/maas-trlp-ipp-route-e12f99\"]}],\"name\":\"0485f94af6b762496b43313f2d58306e3ff2ce0b05521398cf556ebbdc2f779f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-ipp-a-e12f99/models/facebook/opt-125m')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-ipp-a-e12f99"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-ipp-a-e12f99\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:46:25.030Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-ipp-b-aa60bc","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"name":"kuadrant-e2e-ipp-b-aa60bc","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-ipp-b-aa60bc","uid":"f4eca095-9674-4d54-a6d9-be28750a44b7"}]},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3a7b8d05\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-aa60bc\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-aa60bc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3a7b8d05\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-aa60bc\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-aa60bc\"]}],\"name\":\"ebe79da4c0b65668d5163a98a9eea314dd7cd692872b04d7378cce736ce3b514\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3a7b8d05\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-aa60bc\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-aa60bc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3a7b8d05\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-aa60bc\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-aa60bc\"]}],\"name\":\"fbfd59080de892aed216e03c35dd9cdebc7be4cc97be553eeaffa7fc532ac8f4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3a7b8d05\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-aa60bc\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-aa60bc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3a7b8d05\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-aa60bc\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-aa60bc\"]}],\"name\":\"c8eea78ae0c5421500a3465f6cdb72ab01cfd781c3dd4f276f3170596307987a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3a7b8d05\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-aa60bc\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-aa60bc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3a7b8d05\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-aa60bc\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-aa60bc\"]}],\"name\":\"be77c103bfec512a999c60581d11089a1bfa3700b475d5999becd76aecc60b5e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3a7b8d05\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-aa60bc\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-aa60bc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3a7b8d05\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-aa60bc\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-aa60bc\"]}],\"name\":\"d5e8fdc9002d14d1ee656655f9878ea8225f2eb524e57543c483765b921340f7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3a7b8d05\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-aa60bc\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-aa60bc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3a7b8d05\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-aa60bc\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-aa60bc\"]}],\"name\":\"438152e21142d6a37acda909fec1444a7e7bc9c3db0d2875de10ce97f0482ef9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-ipp-b-aa60bc"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-e2e-ipp-b-aa60bc\" already exists"}
{"level":"error","ts":"2026-11-02T21:46:25.528Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-ipp-a-e12f99","namespace":"openshift-ingress","uid":"586f6ac7-72ee-4a5c-83d6-b9b39b674005","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-ipp-a-e12f99\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:46:25.768Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-ipp-route-e12f99","namespace":"ai-tenant-e2e-ipp-a-e12f99","uid":"28f613bb-887c-4808-857e-871fe394dc1d","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-ipp-route-e12f99\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:46:26.677Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-ipp-b-aa60bc","namespace":"openshift-ingress","uid":"fe26ac78-36b0-48a3-b144-71a83a6df4d8","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-ipp-b-aa60bc\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:46:27.106Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"maas-api-route-e2e-ipp-b-aa60bc","namespace":"odh-ai-gateway-infra","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"maas-api-route-e2e-ipp-b-aa60bc\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:46:27.256Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"ipp-route-e12f99-kserve-route","namespace":"ai-tenant-e2e-ipp-a-e12f99","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"ipp-route-e12f99-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:46:27.641Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-ipp-b-aa60bc","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-ipp-b-aa60bc\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:46:32Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-praxis-a-8e90da","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-a-8e90da","reconcileID":"999d4237-36ec-4132-aa11-339ae732ff11","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-praxis-a-8e90da","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:46:32Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-a-8e90da","event":"CREATE"}
{"level":"info","ts":"2026-11-02T21:46:32Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:46:32Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-02T21:46:32Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-02T21:46:32Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:46:32Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-praxis-a-8e90da","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-a-8e90da","reconcileID":"4748212a-a2b7-4ec5-83ca-5bbb6bc1ce26","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-praxis-a-8e90da","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:46:32Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-a-8e90da","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T21:46:32Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:46:33Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-02T21:46:33Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-02T21:46:33Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-02T21:46:33Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:46:37.797Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","AuthConfig","EnvoyFilter","Limitador","HTTPRoute","ConfigMap","Gateway","AuthPolicy"],"eventTypes":{"create":10,"update":10}}
{"level":"info","ts":"2026-11-02T21:46:38.039Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:46:40.259Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:46:40.441Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:46:40.441Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:46:43.267Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:46:43.276Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:46:43.276Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:46:43.283Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:46:43.284Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:46:43.328Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"error","ts":"2026-11-02T21:46:43.455Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:46:43.455Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:46:46.168Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:46:46.168Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:46:47.524Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthPolicy","Kuadrant","TokenRateLimitPolicy","Gateway"],"eventTypes":{"create":2,"update":2}}
{"level":"info","ts":"2026-11-02T21:46:47.684Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:46:47.704Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:46:50.168Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:46:50.323Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:46:50.323Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:46:50.469Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:46:50.538Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:46:53.848Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:46:53.848Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:46:53.855Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:46:53.856Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:46:53.863Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:46:53.863Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-02T21:46:53.964Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:46:53.964Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T21:46:53.964Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-praxis-a-8e90da","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"kuadrant-auth-e2e-praxis-a-8e90da","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-praxis-a-8e90da","uid":"cb5d7624-d26b-48c0-a408-6beac8f48911"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-auth-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local","port_value":50051}}}}]}]},"name":"kuadrant-auth-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-praxis-a-8e90da"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-praxis-a-8e90da\" already exists"}
{"level":"error","ts":"2026-11-02T21:46:54.033Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-praxis-a-8e90da","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/ratelimit":"true"},"name":"kuadrant-ratelimiting-e2e-praxis-a-8e90da","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-praxis-a-8e90da","uid":"cb5d7624-d26b-48c0-a408-6beac8f48911"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"limitador-limitador.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-ratelimit-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"limitador-limitador.kuadrant-system.svc.cluster.local","port_value":8081}}}}]}]},"name":"kuadrant-ratelimit-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-praxis-a-8e90da"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-praxis-a-8e90da\" already exists"}
{"level":"error","ts":"2026-11-02T21:46:54.033Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-8e90da","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-8e90da#rule-3"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"5e8cfeb7c3f3d8b6237daf4c71a37dd6c0e47821cedb4cff5a754d897659746f","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["5e8cfeb7c3f3d8b6237daf4c71a37dd6c0e47821cedb4cff5a754d897659746f"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-a-8e90da.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-a-8e90da.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"5e8cfeb7c3f3d8b6237daf4c71a37dd6c0e47821cedb4cff5a754d897659746f\" already exists"}
{"level":"error","ts":"2026-11-02T21:46:54.142Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-8e90da","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-8e90da#rule-2"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"6ed2258cb027fdb7f4ec00145ce85863552cb64aed475789684275c31242a1b7","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["6ed2258cb027fdb7f4ec00145ce85863552cb64aed475789684275c31242a1b7"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-a-8e90da.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-a-8e90da.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"6ed2258cb027fdb7f4ec00145ce85863552cb64aed475789684275c31242a1b7\" already exists"}
{"level":"error","ts":"2026-11-02T21:46:54.217Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-8e90da","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-8e90da#rule-4"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"d61487f245736652388bdeab82bb0d1d4cd5107426b84f9b979fd65fa3c9b2a9","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d61487f245736652388bdeab82bb0d1d4cd5107426b84f9b979fd65fa3c9b2a9"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-a-8e90da.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-a-8e90da.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"d61487f245736652388bdeab82bb0d1d4cd5107426b84f9b979fd65fa3c9b2a9\" already exists"}
{"level":"error","ts":"2026-11-02T21:46:54.291Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-8e90da","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-8e90da#rule-1"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"991a459fae064d363809c7e100ee401b728b48f374cd146bfde462729141efcb","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["991a459fae064d363809c7e100ee401b728b48f374cd146bfde462729141efcb"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-a-8e90da.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-a-8e90da.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"991a459fae064d363809c7e100ee401b728b48f374cd146bfde462729141efcb\" already exists"}
{"level":"error","ts":"2026-11-02T21:46:54.364Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-8e90da","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-8e90da#rule-6"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"1ac2468d0e20bb2f4ba5b984e2c6db4aad3b48d5a08b09bf51e5c2aaa6591609","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["1ac2468d0e20bb2f4ba5b984e2c6db4aad3b48d5a08b09bf51e5c2aaa6591609"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-a-8e90da.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-a-8e90da.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"1ac2468d0e20bb2f4ba5b984e2c6db4aad3b48d5a08b09bf51e5c2aaa6591609\" already exists"}
{"level":"error","ts":"2026-11-02T21:46:54.435Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-8e90da","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-8e90da#rule-5"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"23f05c343b6591aebe44cca086e2a124f75fca58bb3aa26143e5851d42fbe1c9","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["23f05c343b6591aebe44cca086e2a124f75fca58bb3aa26143e5851d42fbe1c9"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-a-8e90da.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-a-8e90da.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"23f05c343b6591aebe44cca086e2a124f75fca58bb3aa26143e5851d42fbe1c9\" already exists"}
{"level":"error","ts":"2026-11-02T21:46:55.061Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-praxis-a-8e90da","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"name":"kuadrant-e2e-praxis-a-8e90da","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-praxis-a-8e90da","uid":"cb5d7624-d26b-48c0-a408-6beac8f48911"}]},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1ac2468d0e20bb2f4ba5b984e2c6db4aad3b48d5a08b09bf51e5c2aaa6591609\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-a-8e90da-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__cf575100\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-8e90da\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-a-8e90da\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__cf575100\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-8e90da\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-a-8e90da\"]}],\"name\":\"6feae23188281ec60c9a2db3a3d9137432adbcb76b4ee4708959e4d65337688b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6ed2258cb027fdb7f4ec00145ce85863552cb64aed475789684275c31242a1b7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-a-8e90da-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__cf575100\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-8e90da\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-a-8e90da\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__cf575100\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-8e90da\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-a-8e90da\"]}],\"name\":\"e5fbba634396f7158207649a373859cab4716de351f09d5fae9d75d5d48768a0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"23f05c343b6591aebe44cca086e2a124f75fca58bb3aa26143e5851d42fbe1c9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-a-8e90da-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__cf575100\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-8e90da\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-a-8e90da\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__cf575100\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-8e90da\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-a-8e90da\"]}],\"name\":\"fb467651d26ffc28c47781066a04d3c2507e3b4ce1a5b720c9309c552fddf093\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5e8cfeb7c3f3d8b6237daf4c71a37dd6c0e47821cedb4cff5a754d897659746f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-a-8e90da-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__cf575100\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-8e90da\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-a-8e90da\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__cf575100\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-8e90da\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-a-8e90da\"]}],\"name\":\"410470c37cbb677fd97272f279916da8205420c851d310891b53246478a19429\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d61487f245736652388bdeab82bb0d1d4cd5107426b84f9b979fd65fa3c9b2a9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-a-8e90da-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__cf575100\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-8e90da\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-a-8e90da\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__cf575100\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-8e90da\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-a-8e90da\"]}],\"name\":\"711958dba7a290cf8f42eefd68af1d0f882089645fa289f50e92179791b6b205\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"991a459fae064d363809c7e100ee401b728b48f374cd146bfde462729141efcb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-a-8e90da-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__cf575100\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-8e90da\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-a-8e90da\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__cf575100\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-8e90da\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-a-8e90da\"]}],\"name\":\"700bbd85adde3bbde014c30609a7ef3645d724f75befc11c444eb3043625bd26\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-praxis-a-8e90da"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-e2e-praxis-a-8e90da\" already exists"}
{"level":"error","ts":"2026-11-02T21:46:55.359Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-ipp-b-aa60bc","namespace":"openshift-ingress","uid":"fe26ac78-36b0-48a3-b144-71a83a6df4d8","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-ipp-b-aa60bc\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:46:55.495Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-praxis-a-8e90da-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-praxis-a-8e90da-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:46:55.773Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-praxis-a-8e90da","namespace":"openshift-ingress","uid":"41b192f0-c353-4ded-9f5f-fae654328c4d","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-praxis-a-8e90da\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:46:55.989Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-ipp-b-aa60bc-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-ipp-b-aa60bc-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:46:56.697Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:46:56.697Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T21:46:56.767Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"maas-api-route-e2e-praxis-a-8e90da","namespace":"odh-ai-gateway-infra","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"maas-api-route-e2e-praxis-a-8e90da\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:46:56.881Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-praxis-a-8e90da","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-praxis-a-8e90da\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:47:04.478Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","TokenRateLimitPolicy","Limitador","AuthPolicy","EnvoyFilter","Gateway","ConfigMap","HTTPRoute"],"eventTypes":{"create":9,"update":8}}
{"level":"info","ts":"2026-11-02T21:47:04.791Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:47:06.632Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:47:06.767Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:47:06.767Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:47:08Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-praxis-a-aa8aff","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-a-aa8aff","reconcileID":"95088c61-c4a7-43a0-9f4d-304921724937","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-praxis-a-aa8aff","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:47:08Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-a-aa8aff","event":"CREATE"}
{"level":"info","ts":"2026-11-02T21:47:08Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:47:09Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-02T21:47:09Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-02T21:47:09Z","logger":"telemetry-policy-extension-controller","msg":"Failed to update status: resource might just be outdated"}
{"level":"info","ts":"2026-11-02T21:47:09Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:47:09Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-praxis-a-aa8aff","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-a-aa8aff","reconcileID":"866fa862-01db-49b2-b74f-aa7ae9b54739","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-praxis-a-aa8aff","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:47:09Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-a-aa8aff","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T21:47:09Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:47:10.573Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:47:10.623Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:47:10.623Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:47:10.628Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:47:10.628Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:47:10.629Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:47:10.694Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:47:10Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-02T21:47:10Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-02T21:47:10Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:47:10Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-praxis-a-aa8aff","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-a-aa8aff","reconcileID":"01993a19-9585-499a-a60f-4ba43cb11c79","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-praxis-a-aa8aff","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:47:11Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-a-aa8aff","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T21:47:11Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:47:11Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-02T21:47:11Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-02T21:47:11Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-02T21:47:11Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"error","ts":"2026-11-02T21:47:12.802Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-ipp-route-e12f99","namespace":"ai-tenant-e2e-ipp-a-e12f99","uid":"28f613bb-887c-4808-857e-871fe394dc1d","error":"tokenratelimitpolicies.kuadrant.io \"maas-trlp-ipp-route-e12f99\" not found"}
{"level":"error","ts":"2026-11-02T21:47:12.873Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-ipp-a-e12f99-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-ipp-a-e12f99-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:47:13.464Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:47:13.464Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T21:47:13.585Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-praxis-a-aa8aff","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-praxis-a-aa8aff\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:47:13Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-praxis-b-cc0d6a","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-b-cc0d6a","reconcileID":"f699d3a4-d980-4ed2-9e1c-5b2efdbd0ff0","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-praxis-b-cc0d6a","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:47:13Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-b-cc0d6a","event":"CREATE"}
{"level":"info","ts":"2026-11-02T21:47:13Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-02T21:47:14.387Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-praxis-b-cc0d6a","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-praxis-b-cc0d6a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:47:14.446Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-ipp-a-e12f99","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-ipp-a-e12f99\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:47:14Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-02T21:47:14Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-02T21:47:14Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:47:14Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-praxis-b-cc0d6a","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-b-cc0d6a","reconcileID":"deeec0c6-1112-4f13-a277-94b5e8583b12","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-praxis-b-cc0d6a","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:47:14Z","logger":"telemetry-policy-extension-controller","msg":"Warning: Reconciler returned both a non-zero result and a non-nil error. The result will always be ignored if the error is non-nil and the non-nil error causes requeuing with exponential backoff. For more details, see: https://pkg.go.dev/sigs.k8s.io/controller-runtime/pkg/reconcile#Reconciler","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-praxis-b-cc0d6a","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-b-cc0d6a","reconcileID":"deeec0c6-1112-4f13-a277-94b5e8583b12"}
{"level":"error","ts":"2026-11-02T21:47:14Z","logger":"telemetry-policy-extension-controller","msg":"Reconciler error","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-praxis-b-cc0d6a","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-b-cc0d6a","reconcileID":"deeec0c6-1112-4f13-a277-94b5e8583b12","error":"Operation cannot be fulfilled on telemetrypolicies.extensions.kuadrant.io \"maas-telemetry-e2e-praxis-b-cc0d6a\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:353\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-02T21:47:14Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-praxis-b-cc0d6a","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-b-cc0d6a","reconcileID":"910df582-2c95-4d06-b29c-30b28dd03584","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-praxis-b-cc0d6a","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:47:14Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-b-cc0d6a","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T21:47:14Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:47:15Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-02T21:47:15Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-02T21:47:15Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-02T21:47:15Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:47:15Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-b-cc0d6a","event":"UNKNOWN"}
{"level":"info","ts":"2026-11-02T21:47:15Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:47:15Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-02T21:47:15Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-02T21:47:15Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-02T21:47:15Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:47:21.632Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthPolicy","Gateway","TokenRateLimitPolicy","ConfigMap","HTTPRoute","Limitador","Kuadrant"],"eventTypes":{"create":6,"delete":2,"update":9}}
{"level":"info","ts":"2026-11-02T21:47:21.981Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:47:21.990Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:47:24.771Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:47:24.772Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:47:24.868Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:47:24.938Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:47:24.938Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:47:28.068Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:47:28.071Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:47:28.129Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:47:28.136Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:47:28.136Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:47:28.136Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-11-02T21:47:28.189Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:47:28.189Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:47:31.864Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:47:31.864Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:47:39.607Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","EnvoyFilter","HTTPRoute","AuthPolicy","Gateway","TokenRateLimitPolicy","Limitador","ConfigMap"],"eventTypes":{"create":18,"delete":12,"update":19}}
{"level":"info","ts":"2026-11-02T21:47:39.956Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:47:42.328Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:47:42.535Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:47:42.536Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:47:45.385Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:47:45.395Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:47:45.395Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:47:45.432Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:47:45.432Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:47:45.442Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:47:45.625Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:47:48.434Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:47:48.434Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:47:50Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ipp-a-e12f99","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-a-e12f99","reconcileID":"ef03c0e3-bcdd-4c66-9fa4-a42ed97b573c","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-ipp-a-e12f99","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:47:50Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-a-e12f99","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T21:47:50Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:47:50Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-11-02T21:47:50Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:47:50Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-11-02T21:47:50Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ipp-a-e12f99","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-a-e12f99","reconcileID":"ef03c0e3-bcdd-4c66-9fa4-a42ed97b573c","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-ipp-a-e12f99","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:47:50Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-a-e12f99","event":"DELETE"}
{"level":"info","ts":"2026-11-02T21:47:50Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-02T21:47:50Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-ipp-a-e12f99\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-02T21:47:50Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:47:51Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ipp-a-ce2453","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-a-ce2453","reconcileID":"128485e4-24f6-4577-9dcb-9bbdb9105422","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-ipp-a-ce2453","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:47:51Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-a-ce2453","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T21:47:51Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:47:51Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-11-02T21:47:51Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:47:51Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-11-02T21:47:51Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ipp-a-ce2453","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-a-ce2453","reconcileID":"128485e4-24f6-4577-9dcb-9bbdb9105422","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-ipp-a-ce2453","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:47:51Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-a-ce2453","event":"DELETE"}
{"level":"info","ts":"2026-11-02T21:47:51Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-02T21:47:51Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-ipp-a-ce2453\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-02T21:47:51Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:47:59.968Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway","ConfigMap","TokenRateLimitPolicy","AuthPolicy","Limitador","Kuadrant","HTTPRoute"],"eventTypes":{"delete":2,"update":10}}
{"level":"info","ts":"2026-11-02T21:48:00.165Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:48:00.185Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:48:03.027Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:48:03.144Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:48:03.144Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:48:03.226Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:48:03.256Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:48:06.279Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:48:06.290Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:48:06.290Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:48:06.323Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:48:06.323Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:48:06.329Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"error","ts":"2026-11-02T21:48:06.353Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to delete envoyfilter object","envoyfilter":"openshift-ingress/kuadrant-auth-e2e-ipp-a-e12f99","error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-ipp-a-e12f99\" not found"}
{"level":"error","ts":"2026-11-02T21:48:06.353Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to delete envoyfilter object","envoyfilter":"openshift-ingress/kuadrant-ratelimiting-e2e-ipp-a-e12f99","error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-ipp-a-e12f99\" not found"}
{"level":"error","ts":"2026-11-02T21:48:06.392Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:48:06.392Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:48:08.978Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:48:08.978Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:48:10.383Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway","EnvoyFilter","TokenRateLimitPolicy","AuthPolicy"],"eventTypes":{"create":1,"delete":9}}
{"level":"info","ts":"2026-11-02T21:48:15.596Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:48:15.623Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:48:15.623Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:48:15.629Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:48:15.633Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:48:15.633Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-02T21:48:15.657Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to delete envoyfilter object","envoyfilter":"openshift-ingress/kuadrant-auth-e2e-ipp-a-e12f99","error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-ipp-a-e12f99\" not found"}
{"level":"error","ts":"2026-11-02T21:48:15.657Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to delete envoyfilter object","envoyfilter":"openshift-ingress/kuadrant-ratelimiting-e2e-ipp-a-e12f99","error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-ipp-a-e12f99\" not found"}
{"level":"error","ts":"2026-11-02T21:48:15.708Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:48:15.708Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T21:48:15.711Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/16ec655cda4ed58fc097703b65e7d18cc8acb3ed7f71cae31f4cbfba87cfdb90","error":"authconfigs.authorino.kuadrant.io \"16ec655cda4ed58fc097703b65e7d18cc8acb3ed7f71cae31f4cbfba87cfdb90\" not found"}
{"level":"error","ts":"2026-11-02T21:48:15.766Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/b939d14c6d500da913442bf0ae2eae702210661bada1be383e0c3a90fe89911f","error":"authconfigs.authorino.kuadrant.io \"b939d14c6d500da913442bf0ae2eae702210661bada1be383e0c3a90fe89911f\" not found"}
{"level":"error","ts":"2026-11-02T21:48:15.838Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/d069f1a629c4b80d835027ed5a6d6ba8d643762cf5d54b723b8880ad8b3ce68c","error":"authconfigs.authorino.kuadrant.io \"d069f1a629c4b80d835027ed5a6d6ba8d643762cf5d54b723b8880ad8b3ce68c\" not found"}
{"level":"error","ts":"2026-11-02T21:48:15.930Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/7dcea37de001b1046b7b323eae24a7f4955980cdbb1f638b6bcb7c141644504d","error":"authconfigs.authorino.kuadrant.io \"7dcea37de001b1046b7b323eae24a7f4955980cdbb1f638b6bcb7c141644504d\" not found"}
{"level":"error","ts":"2026-11-02T21:48:15.985Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/4924b812583d5cb214dfa7b4f30534b959fa1139a89409fbc55542fbff6ef00b","error":"authconfigs.authorino.kuadrant.io \"4924b812583d5cb214dfa7b4f30534b959fa1139a89409fbc55542fbff6ef00b\" not found"}
{"level":"error","ts":"2026-11-02T21:48:16.040Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/fc1e4861794bf508710ccd5cfb530682e02b122815daf9063a3bcf7001ff8c42","error":"authconfigs.authorino.kuadrant.io \"fc1e4861794bf508710ccd5cfb530682e02b122815daf9063a3bcf7001ff8c42\" not found"}
{"level":"error","ts":"2026-11-02T21:48:16.094Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/b6bef48bf81237b36892ce9be6f139179845dcc51505a86074b2e83bb220bf3f","error":"authconfigs.authorino.kuadrant.io \"b6bef48bf81237b36892ce9be6f139179845dcc51505a86074b2e83bb220bf3f\" not found"}
{"level":"error","ts":"2026-11-02T21:48:16.149Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/93b9a32c7b23acf31e43e9db9007a107c836bc0fe6a680afd16005e9deceb070","error":"authconfigs.authorino.kuadrant.io \"93b9a32c7b23acf31e43e9db9007a107c836bc0fe6a680afd16005e9deceb070\" not found"}
{"level":"error","ts":"2026-11-02T21:48:16.204Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/1af979847e61ee62f748707bd08717a112d0904feb1eac70881a949b76fa6d61","error":"authconfigs.authorino.kuadrant.io \"1af979847e61ee62f748707bd08717a112d0904feb1eac70881a949b76fa6d61\" not found"}
{"level":"error","ts":"2026-11-02T21:48:16.258Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/bd8721e9d17f5f3ba2e1fffb6978c86598bc85297f3b0e0fbd1e56adb44df1f4","error":"authconfigs.authorino.kuadrant.io \"bd8721e9d17f5f3ba2e1fffb6978c86598bc85297f3b0e0fbd1e56adb44df1f4\" not found"}
{"level":"error","ts":"2026-11-02T21:48:16.313Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/42c0502125113aac244c36c0bea7ba50a3f48d1f4bdfc0289f186ef39959831c","error":"authconfigs.authorino.kuadrant.io \"42c0502125113aac244c36c0bea7ba50a3f48d1f4bdfc0289f186ef39959831c\" not found"}
{"level":"error","ts":"2026-11-02T21:48:16.368Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/4fcb9f993f17dd0eef5d34bb0de64ef7047bfa6056410eb1e59f2f4bbf7e1a54","error":"authconfigs.authorino.kuadrant.io \"4fcb9f993f17dd0eef5d34bb0de64ef7047bfa6056410eb1e59f2f4bbf7e1a54\" not found"}
{"level":"info","ts":"2026-11-02T21:48:18.366Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:48:18.366Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:48:29.103Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Limitador","ConfigMap","AuthConfig","EnvoyFilter"],"eventTypes":{"delete":15,"update":2}}
{"level":"info","ts":"2026-11-02T21:48:29.346Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:48:31.040Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:48:31.162Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:48:31.162Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:48:34.270Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:48:34.336Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:48:34.336Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:48:34.341Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:48:34.342Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:48:34.511Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:48:37.006Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:48:37.006Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:48:37.372Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway"],"eventTypes":{"create":1}}
{"level":"info","ts":"2026-11-02T21:48:42.539Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:48:42.541Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:48:42.547Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:48:42.558Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:48:42.558Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:48:42.570Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-11-02T21:48:42.632Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:48:42.632Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:48:45.320Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:48:45.320Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:48:53.046Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","Limitador"],"eventTypes":{"update":2}}
{"level":"info","ts":"2026-11-02T21:48:53.235Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:48:54.654Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:48:54.775Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:48:54.775Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:48:57.735Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:48:57.736Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:48:57.741Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-02T21:48:57.741Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:48:59.222Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:48:59.222Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:49:02Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-praxis-a-be6df0","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-a-be6df0","reconcileID":"f7237954-dcc1-4261-a30d-0d4ecd55c297","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-praxis-a-be6df0","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:49:02Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-a-be6df0","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T21:49:02Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:49:02Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-11-02T21:49:02Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:49:02Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-11-02T21:49:02Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-praxis-a-be6df0","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-a-be6df0","reconcileID":"f7237954-dcc1-4261-a30d-0d4ecd55c297","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-praxis-a-be6df0","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:49:02Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-a-be6df0","event":"DELETE"}
{"level":"info","ts":"2026-11-02T21:49:02Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-02T21:49:02Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-praxis-a-be6df0\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-02T21:49:02Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:49:08Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-praxis-b-942164","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-b-942164","reconcileID":"733a2dba-a94d-4e95-b70f-15ece5e4d2f5","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-praxis-b-942164","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:49:08Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-b-942164","event":"CREATE"}
{"level":"info","ts":"2026-11-02T21:49:08Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:49:08Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-02T21:49:08Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-02T21:49:08Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:49:08Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-praxis-b-942164","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-b-942164","reconcileID":"edb5deb0-6317-4991-aabf-47956c16f0d5","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-praxis-b-942164","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:49:08Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-b-942164","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T21:49:08Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:49:09Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-02T21:49:09Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-02T21:49:09Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-02T21:49:09Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:49:09Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ipp-b-3e3997","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-b-3e3997","reconcileID":"e10d1e46-4594-4f93-89bc-ae08435ddcad","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-ipp-b-3e3997","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:49:09Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-b-3e3997","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T21:49:09Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:49:09Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-11-02T21:49:09Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:49:09.402Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","ConfigMap","Limitador"],"eventTypes":{"update":20}}
{"level":"info","ts":"2026-11-02T21:49:09Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-11-02T21:49:09Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ipp-b-3e3997","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-b-3e3997","reconcileID":"e10d1e46-4594-4f93-89bc-ae08435ddcad","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-ipp-b-3e3997","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:49:09Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-b-3e3997","event":"DELETE"}
{"level":"info","ts":"2026-11-02T21:49:09Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-02T21:49:09Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-ipp-b-3e3997\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-02T21:49:09Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:49:09.589Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:49:10Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ipp-b-aa60bc","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-b-aa60bc","reconcileID":"4f5f4b4a-d7ed-4644-82df-da02ca46ba4f","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-ipp-b-aa60bc","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:49:10Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-b-aa60bc","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T21:49:10Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:49:10Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-11-02T21:49:10Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:49:10Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-11-02T21:49:10Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-ipp-b-aa60bc","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-b-aa60bc","reconcileID":"4f5f4b4a-d7ed-4644-82df-da02ca46ba4f","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-ipp-b-aa60bc","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:49:10Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-ipp-b-aa60bc","event":"DELETE"}
{"level":"info","ts":"2026-11-02T21:49:10Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-02T21:49:10Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-ipp-b-aa60bc\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-02T21:49:10Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:49:11.358Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:49:11.434Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:49:11.434Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:49:14.566Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:49:14.572Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:49:14.573Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:49:14.577Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:49:14.577Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-02T21:49:14.623Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to delete envoyfilter object","envoyfilter":"openshift-ingress/kuadrant-ratelimiting-e2e-praxis-a-be6df0","error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-praxis-a-be6df0\" not found"}
{"level":"info","ts":"2026-11-02T21:49:14.740Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T21:49:15.154Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to delete envoyfilter object","gateway":"openshift-ingress/e2e-praxis-a-be6df0","envoyfilter":"openshift-ingress/kuadrant-e2e-praxis-a-be6df0","error":"envoyfilters.networking.istio.io \"kuadrant-e2e-praxis-a-be6df0\" not found"}
{"level":"error","ts":"2026-11-02T21:49:16.806Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-ipp-b-aa60bc","namespace":"openshift-ingress","uid":"fe26ac78-36b0-48a3-b144-71a83a6df4d8","error":"tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-ipp-b-aa60bc\" not found"}
{"level":"error","ts":"2026-11-02T21:49:17.174Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-ipp-b-3e3997","namespace":"openshift-ingress","uid":"b3699a22-0612-4e54-b536-47bce1c563f6","error":"tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-ipp-b-3e3997\" not found"}
{"level":"info","ts":"2026-11-02T21:49:17.479Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:49:17.479Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T21:49:17.637Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-ipp-b-aa60bc","error":"gateways.gateway.networking.k8s.io \"e2e-ipp-b-aa60bc\" not found"}
{"level":"error","ts":"2026-11-02T21:49:17.842Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-praxis-a-be6df0","error":"gateways.gateway.networking.k8s.io \"e2e-praxis-a-be6df0\" not found"}
{"level":"error","ts":"2026-11-02T21:49:17.902Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-ipp-b-3e3997","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-ipp-b-3e3997\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:49:18.959Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["HTTPRoute","Gateway","Kuadrant","AuthPolicy","TokenRateLimitPolicy"],"eventTypes":{"create":1,"delete":3,"update":3}}
{"level":"info","ts":"2026-11-02T21:49:19.294Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:49:19.335Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:49:22.223Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:49:22.473Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:49:22.559Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:49:22.640Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:49:22.640Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:49:25.656Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:49:25.663Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:49:25.670Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:49:25.670Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:49:25.656Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:49:25.678Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-11-02T21:49:25.736Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to delete envoyfilter object","envoyfilter":"openshift-ingress/kuadrant-auth-e2e-praxis-a-be6df0","error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-praxis-a-be6df0\" not found"}
{"level":"error","ts":"2026-11-02T21:49:25.736Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to delete envoyfilter object","envoyfilter":"openshift-ingress/kuadrant-ratelimiting-e2e-praxis-a-be6df0","error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-praxis-a-be6df0\" not found"}
{"level":"error","ts":"2026-11-02T21:49:25.770Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:49:25.770Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T21:49:26.583Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to delete envoyfilter object","gateway":"openshift-ingress/e2e-praxis-a-be6df0","envoyfilter":"openshift-ingress/kuadrant-e2e-praxis-a-be6df0","error":"envoyfilters.networking.istio.io \"kuadrant-e2e-praxis-a-be6df0\" not found"}
{"level":"error","ts":"2026-11-02T21:49:26.696Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-ipp-b-aa60bc","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T21:46:15Z","generation":1,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"f4eca095-9674-4d54-a6d9-be28750a44b7\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:46:15Z"}],"name":"kuadrant-e2e-ipp-b-aa60bc","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-ipp-b-aa60bc","uid":"f4eca095-9674-4d54-a6d9-be28750a44b7"}],"resourceVersion":"68774","uid":"3c023dc8-8920-4925-b015-33e3ca2a3949"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9d1821eb80e4f763fce3df3a2bdba2ae6e930db49f5ae24440e9d796e13b14de\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-b-aa60bc-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3a7b8d05\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-aa60bc\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-aa60bc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3a7b8d05\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-aa60bc\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-aa60bc\"]}],\"name\":\"ebe79da4c0b65668d5163a98a9eea314dd7cd692872b04d7378cce736ce3b514\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5663113cbb4fa8752826e21c1d0f7bc58e5f96de930bafc7221e49bf49236add\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-b-aa60bc-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3a7b8d05\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-aa60bc\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-aa60bc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3a7b8d05\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-aa60bc\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-aa60bc\"]}],\"name\":\"fbfd59080de892aed216e03c35dd9cdebc7be4cc97be553eeaffa7fc532ac8f4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ed0ec0be67209a15517e5729f5a4e5e06bfb62279fc425d2de4cfb692a1fcd75\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-b-aa60bc-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3a7b8d05\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-aa60bc\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-aa60bc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3a7b8d05\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-aa60bc\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-aa60bc\"]}],\"name\":\"c8eea78ae0c5421500a3465f6cdb72ab01cfd781c3dd4f276f3170596307987a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e16e7f66db3ec261b8ac2c61b6cf845808c3168876a706a0cca014a544ad17f4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-b-aa60bc-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3a7b8d05\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-aa60bc\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-aa60bc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3a7b8d05\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-aa60bc\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-aa60bc\"]}],\"name\":\"be77c103bfec512a999c60581d11089a1bfa3700b475d5999becd76aecc60b5e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6187dc42fdd16d98a1412e9bc77c936731d7ad1eef04173fac2d0e644b31e828\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-b-aa60bc-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3a7b8d05\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-aa60bc\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-aa60bc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3a7b8d05\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-aa60bc\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-aa60bc\"]}],\"name\":\"d5e8fdc9002d14d1ee656655f9878ea8225f2eb524e57543c483765b921340f7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0c61e1405d3db34aaf18482cdb337747bbc01aaadcb487074d2f846b365eaa0a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-b-aa60bc-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3a7b8d05\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-aa60bc\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-aa60bc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__3a7b8d05\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-aa60bc\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-aa60bc\"]}],\"name\":\"438152e21142d6a37acda909fec1444a7e7bc9c3db0d2875de10ce97f0482ef9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}}],\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-ipp-b-aa60bc"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-e2e-ipp-b-aa60bc\" not found"}
{"level":"error","ts":"2026-11-02T21:49:26.811Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-ipp-b-3e3997","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T21:42:32Z","generation":1,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"d4555b21-a5a6-4f8f-88e3-6fceb96b4880\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:42:32Z"}],"name":"kuadrant-e2e-ipp-b-3e3997","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-ipp-b-3e3997","uid":"d4555b21-a5a6-4f8f-88e3-6fceb96b4880"}],"resourceVersion":"62099","uid":"997d9eac-dad7-4d06-af88-c80b515a7a6d"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1e66a4e6d17568c52e7b06fa6d621c6466518c88dfb2880898fe25d9655af1e7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-b-3e3997-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a8ba8349\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-3e3997\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-3e3997\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a8ba8349\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-3e3997\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-3e3997\"]}],\"name\":\"fa4b44bf20c8800817d98abfa43fca29ec5868213d9112bd518bf24e3901b24f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d8da36b7758fd1de602c8be2c960876c883ec283d0d7ea0721ab2e89a12f3ad8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-b-3e3997-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a8ba8349\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-3e3997\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-3e3997\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a8ba8349\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-3e3997\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-3e3997\"]}],\"name\":\"c3ef39d1c2a994727500f0a524c286ad316fcdcce5223838c2a2cd4a65fa177c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0c14201eefc11d8e0dded839ed0e19ee9386e5ff76b26f2d009b916044c67615\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-b-3e3997-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a8ba8349\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-3e3997\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-3e3997\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a8ba8349\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-3e3997\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-3e3997\"]}],\"name\":\"50178e2db12715428ce396837bfc797f6c3f7bd9342624e2275fbff783f9f5e9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"90d396467a190c4a418b30817a9cf6e399b86fc496f7002762eec5307cb3c88a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-b-3e3997-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a8ba8349\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-3e3997\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-3e3997\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a8ba8349\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-3e3997\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-3e3997\"]}],\"name\":\"16829b25eb605647af2fc25cb676aa592b4e57b2c7aa4a68481a9f16f690ea79\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4accd1018c1aa66b09763cbe7f3deaaad79163ba8dd28b58e75515e2ae9b5e66\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-b-3e3997-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a8ba8349\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-3e3997\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-3e3997\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a8ba8349\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-3e3997\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-3e3997\"]}],\"name\":\"8a9b1f1dbc59ef79b37dcb2e55b8ec0f0dd92a446b6f2909c5845597068e82b8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"02bbb73a2236d093faf818418d3d320cb046d293b44a160d5493975cc5cee8cb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-ipp-b-3e3997-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a8ba8349\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-3e3997\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-3e3997\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a8ba8349\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-ipp-b-3e3997\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-ipp-b-3e3997\"]}],\"name\":\"2c7d328857d58b4f4422158425b6a3c81241fb3158c7a4f5172c9ced2739106e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}}],\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-ipp-b-3e3997"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-e2e-ipp-b-3e3997\" not found"}
{"level":"error","ts":"2026-11-02T21:49:27.279Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w2-6fa533","namespace":"e2e-models-e2e-worker-w2-6fa533","uid":"2ff73667-c2c3-4579-9503-b6ca098f1021","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w2-6fa533\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:49:27.455Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-praxis-a-8e90da","namespace":"openshift-ingress","uid":"41b192f0-c353-4ded-9f5f-fae654328c4d","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-praxis-a-8e90da\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:49:27.568Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-ipp-b-3e3997-maas-auth","namespace":"openshift-ingress","error":"authpolicies.kuadrant.io \"e2e-ipp-b-3e3997-maas-auth\" not found"}
{"level":"error","ts":"2026-11-02T21:49:27.571Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-simulated-simulated-premium","namespace":"llm","uid":"447993be-3c57-4e68-8ffa-6fc998a39c77","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-simulated-simulated-premium\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:49:27.629Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w0-0c9014","namespace":"e2e-models-e2e-worker-w0-0c9014","uid":"dcb5a0e4-7049-4ddc-91de-e14d55b09789","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w0-0c9014\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:49:27.748Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w1-5f765a","namespace":"e2e-models-e2e-worker-w1-5f765a","uid":"9c852546-ee7c-4e72-855c-111315f7bf82","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w1-5f765a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:49:27.806Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w3-f51151","namespace":"e2e-models-e2e-worker-w3-f51151","uid":"c78aa03a-e3ca-4797-8a09-ab0d9cd88148","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w3-f51151\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:49:27.839Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-ipp-b-aa60bc-maas-auth","namespace":"openshift-ingress","error":"authpolicies.kuadrant.io \"e2e-ipp-b-aa60bc-maas-auth\" not found"}
{"level":"error","ts":"2026-11-02T21:49:27.864Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w2-6fa533","namespace":"e2e-models-e2e-worker-w2-6fa533","uid":"3a128bb2-de88-49aa-ab9e-c8626107a077","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w2-6fa533\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:49:27.921Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-ipp-b-aa60bc","namespace":"openshift-ingress","uid":"fe26ac78-36b0-48a3-b144-71a83a6df4d8","error":"tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-ipp-b-aa60bc\" not found"}
{"level":"error","ts":"2026-11-02T21:49:28.038Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w3-f51151","namespace":"e2e-models-e2e-worker-w3-f51151","uid":"e3340067-224a-43ad-8020-ca9e00ead152","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w3-f51151\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:49:28.097Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w1-5f765a","namespace":"e2e-models-e2e-worker-w1-5f765a","uid":"7188eadc-9748-4be8-a5e2-d904cf5b6130","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w1-5f765a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:49:28.156Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-facebook-opt-125m-simulated","namespace":"llm","uid":"da8edb1a-ed61-454d-939f-fc7cd235d9fb","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-facebook-opt-125m-simulated\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:49:28.214Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-praxis-b-cc0d6a","namespace":"openshift-ingress","uid":"1db97fb4-dadc-44ef-981c-d597b8e474f7","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-praxis-b-cc0d6a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:49:28.272Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w4-d6cb38","namespace":"e2e-models-e2e-worker-w4-d6cb38","uid":"486176e6-7786-40c4-9ce0-6f4a68b408b2","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w4-d6cb38\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:49:28.329Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-ipp-b-3e3997","namespace":"openshift-ingress","uid":"b3699a22-0612-4e54-b536-47bce1c563f6","error":"tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-ipp-b-3e3997\" not found"}
{"level":"error","ts":"2026-11-02T21:49:28.388Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w4-d6cb38","namespace":"e2e-models-e2e-worker-w4-d6cb38","uid":"0d3ebd35-5005-4ee4-a055-ff95546e3673","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w4-d6cb38\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:49:28.446Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w0-0c9014","namespace":"e2e-models-e2e-worker-w0-0c9014","uid":"4f647df6-1d5b-433b-b4fc-1279ff1755f7","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w0-0c9014\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:49:28.505Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-praxis-a-aa8aff","namespace":"openshift-ingress","uid":"35c18d3c-7dd9-4528-af0f-0ffed5359ea0","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-praxis-a-aa8aff\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:49:28.505Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:49:28.505Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T21:49:29.007Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-praxis-a-be6df0","error":"gateways.gateway.networking.k8s.io \"e2e-praxis-a-be6df0\" not found"}
{"level":"error","ts":"2026-11-02T21:49:29.063Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-ipp-b-aa60bc","error":"gateways.gateway.networking.k8s.io \"e2e-ipp-b-aa60bc\" not found"}
{"level":"error","ts":"2026-11-02T21:49:29.119Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-ipp-b-3e3997","error":"gateways.gateway.networking.k8s.io \"e2e-ipp-b-3e3997\" not found"}
{"level":"error","ts":"2026-11-02T21:49:29.481Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"data-science-gateway","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"data-science-gateway\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:49:32Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-praxis-b-bb45bc","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-b-bb45bc","reconcileID":"56aeed9d-c0e4-4da5-94b3-bce8f8871546","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-praxis-b-bb45bc","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:49:32.973Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","Kuadrant","HTTPRoute","Gateway","Limitador","AuthPolicy","ConfigMap","AuthConfig","EnvoyFilter"],"eventTypes":{"create":4,"delete":24,"update":20}}
{"level":"info","ts":"2026-11-02T21:49:32Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-b-bb45bc","event":"CREATE"}
{"level":"info","ts":"2026-11-02T21:49:32Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:49:33.139Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:49:33.159Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:49:34Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-02T21:49:34Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-02T21:49:34Z","logger":"telemetry-policy-extension-controller","msg":"Failed to update status: resource might just be outdated"}
{"level":"info","ts":"2026-11-02T21:49:34Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:49:34Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-praxis-b-bb45bc","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-b-bb45bc","reconcileID":"87dc2c4e-532c-4765-a354-cf165aaa5c8d","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-praxis-b-bb45bc","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:49:34Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-b-bb45bc","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T21:49:34Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:49:35.649Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:49:35.669Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:49:35.752Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:49:35.924Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:49:35.924Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:49:36Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-02T21:49:36Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-02T21:49:36Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:49:36Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-praxis-b-bb45bc","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-b-bb45bc","reconcileID":"dadf27ee-1ea6-478d-9922-1ccbebdaae42","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-praxis-b-bb45bc","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:49:36Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-b-bb45bc","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T21:49:36Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:49:38Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-02T21:49:38Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-02T21:49:38Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-02T21:49:38Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:49:38.887Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:49:38.896Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:49:38.896Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:49:38.898Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:49:38.901Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:49:38.905Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:49:39.028Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T21:49:41.008Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w3-f51151","namespace":"e2e-models-e2e-worker-w3-f51151","uid":"e3340067-224a-43ad-8020-ca9e00ead152","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w3-f51151\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:49:41.544Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:49:41.544Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:49:52.065Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","EnvoyFilter","AuthPolicy","HTTPRoute","TokenRateLimitPolicy","Kuadrant","Gateway","ConfigMap","Limitador"],"eventTypes":{"create":11,"delete":12,"update":8}}
{"level":"info","ts":"2026-11-02T21:49:52.410Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:49:52.419Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:49:55.043Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:49:55.123Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:49:55.127Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:49:55.264Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:49:55.264Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:49:58.003Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:49:58.008Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:49:58.028Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:49:58.030Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:49:58.030Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:49:58.030Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-11-02T21:49:58.124Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:49:58.124Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:50:00.847Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:50:00.847Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:50:02.102Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy"],"eventTypes":{"update":2}}
{"level":"info","ts":"2026-11-02T21:50:06.345Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:50:06.350Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:50:06.350Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:50:06.355Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"error","ts":"2026-11-02T21:50:06.403Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-praxis-b-bb45bc","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/ratelimit":"true"},"name":"kuadrant-ratelimiting-e2e-praxis-b-bb45bc","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-praxis-b-bb45bc","uid":"188b7eba-1e78-42a1-ab26-1e46f3712d64"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"limitador-limitador.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-ratelimit-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"limitador-limitador.kuadrant-system.svc.cluster.local","port_value":8081}}}}]}]},"name":"kuadrant-ratelimit-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-praxis-b-bb45bc"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-praxis-b-bb45bc\" already exists"}
{"level":"error","ts":"2026-11-02T21:50:06.456Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:50:06.456Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T21:50:07.048Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-worker-w3-f51151","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T21:21:31Z","generation":11,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"8871137c-7f6a-401d-a6db-2983aea5ba22\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:33:43Z"}],"name":"kuadrant-e2e-worker-w3-f51151","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-worker-w3-f51151","uid":"8871137c-7f6a-401d-a6db-2983aea5ba22"}],"resourceVersion":"47060","uid":"c24c0550-6758-4dca-8d2b-3fe32740d122"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a05d7e315cc7cde173ab18a777672d3a18ce0a96f8f52d505404dcf8d1e51c20\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"0e7c31c41adb0d3f9efc929ae631573fe0c783a2fa7edb7a4b135081c2969bbf\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6c73e108ce3d5ef8ece11651aca73aa00bd88530b6aba861d23ca7b6ff89ba5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2577de9e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"fccea68a78205480\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2577de9e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"fccea68a78205480\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"aedbd7ef0308fd9494e9a3a1386b732923d5d060acf5a188601898d4867d320f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7b56d8e34a0de188e49dc0ae60057e421eb8bc4643546e49b2fe810120869498\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"b6389ab82133347e2514a4ad1cbd9d34042edc9a4ad044714155dbb2aecf38d4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a942d85d233c0e2e8932f598b5b8c9b97eda0ae826b5a80a742559b36fa56979\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"85e7f37f931469abe1b396a1a44b52a8b72e6a4dc98ed0ebdd61e43f0486de13\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a05d7e315cc7cde173ab18a777672d3a18ce0a96f8f52d505404dcf8d1e51c20\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"ec8a1b6bbf984a67cda63e2d923bfa9d2d66a7537f676f6198c12cbca9103517\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6c73e108ce3d5ef8ece11651aca73aa00bd88530b6aba861d23ca7b6ff89ba5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2577de9e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"fccea68a78205480\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2577de9e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"fccea68a78205480\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"5c9b9ac2bc33c747eb54045ee2511e3c8b2ee9737a3f347afb75903f43d74fb7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7b56d8e34a0de188e49dc0ae60057e421eb8bc4643546e49b2fe810120869498\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"f82b9432930517e02d229f4fdbdd8b6700b061d5d333fe35b064a3bb85f58e76\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a942d85d233c0e2e8932f598b5b8c9b97eda0ae826b5a80a742559b36fa56979\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"6d321a24ed09abad642dee549f0c7cbf98ce40481beb85ca79bd3d4eeb89b77e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a05d7e315cc7cde173ab18a777672d3a18ce0a96f8f52d505404dcf8d1e51c20\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"a54bd689e670e5f8bbee0a66c2585a4d4adce9a5a7fc297449ee3b816a0c2695\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6c73e108ce3d5ef8ece11651aca73aa00bd88530b6aba861d23ca7b6ff89ba5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2577de9e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"fccea68a78205480\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2577de9e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"fccea68a78205480\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"ad845c31a125851bf4cc5ae7e83bb4a011cf98484d99780ab16df250ca9dd41c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7b56d8e34a0de188e49dc0ae60057e421eb8bc4643546e49b2fe810120869498\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"9eefe22cd9d7f4d324cc07e6422d998261fea96e9069bc938fe66a94e8c8cadb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a942d85d233c0e2e8932f598b5b8c9b97eda0ae826b5a80a742559b36fa56979\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"b00ec38cf5be980b160374be347b182afaa16e0dc99314a5e990f20cef6d57ed\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a05d7e315cc7cde173ab18a777672d3a18ce0a96f8f52d505404dcf8d1e51c20\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"6d5d9aca320022f0f8b70c3f9b34b5922adf537f5da717ec79924566febf6df1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6c73e108ce3d5ef8ece11651aca73aa00bd88530b6aba861d23ca7b6ff89ba5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2577de9e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"fccea68a78205480\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2577de9e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"fccea68a78205480\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"346e75cab49a1cf8ae89d90cfb32099256f44d7909e40cdc730e951946a411e2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7b56d8e34a0de188e49dc0ae60057e421eb8bc4643546e49b2fe810120869498\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"ae0a4172fa23a6e8857123675126f34bcaf4e08f94c05663e2913801fda46401\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a942d85d233c0e2e8932f598b5b8c9b97eda0ae826b5a80a742559b36fa56979\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"ee0931c3dc206732c58bab1add9bf2cb602a2eb21bfa9272c2df596197dceb3e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a05d7e315cc7cde173ab18a777672d3a18ce0a96f8f52d505404dcf8d1e51c20\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"3f6b6643d5731a355a44968b83b24169ff3e0c1b36737d8be7f9d42e1def7c3e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6c73e108ce3d5ef8ece11651aca73aa00bd88530b6aba861d23ca7b6ff89ba5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2577de9e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"fccea68a78205480\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2577de9e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"fccea68a78205480\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"cd8ab5f89e71494c8d176f9668b8ed279bd244e6f70d1a5c87603877b4b7182d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7b56d8e34a0de188e49dc0ae60057e421eb8bc4643546e49b2fe810120869498\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"09df06c068a0d1324c44679ca0c022e74cd18bae1497d0087fb2184f9401d63b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a942d85d233c0e2e8932f598b5b8c9b97eda0ae826b5a80a742559b36fa56979\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"821121f5584e938a01b323996203984576204f894f2c9f09f5ececcdc058373e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a05d7e315cc7cde173ab18a777672d3a18ce0a96f8f52d505404dcf8d1e51c20\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"e00f3dfbbce60a718137b415a42cbf1e65a7b226437cc4600d9fa76b264e3b4d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a05d7e315cc7cde173ab18a777672d3a18ce0a96f8f52d505404dcf8d1e51c20\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"7ddf0d6bdcfc6aa206cdc0919b1d5b7545c903aafbb0e16d393016b1a83bd29a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6c73e108ce3d5ef8ece11651aca73aa00bd88530b6aba861d23ca7b6ff89ba5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2577de9e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"fccea68a78205480\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2577de9e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"fccea68a78205480\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"fe3b37fdd5d3f9d3bdf7d03b186d964b283bfbe7d3ffa720457517666c3070a2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6c73e108ce3d5ef8ece11651aca73aa00bd88530b6aba861d23ca7b6ff89ba5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2577de9e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"fccea68a78205480\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2577de9e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"fccea68a78205480\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"7dd9491b4755b4900c5bc55b4dd9aff38f99899f0236e4d21bf7c94e5769cbb1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7b56d8e34a0de188e49dc0ae60057e421eb8bc4643546e49b2fe810120869498\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"fa5430186b33e56d19e4d2e0209b4f2215d17b488745cd8061eb5ecaf96ecafa\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7b56d8e34a0de188e49dc0ae60057e421eb8bc4643546e49b2fe810120869498\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"cd88af3d71345ad9b32dfae02550fa9bf6aa0cddfac2d0464a60cd90b9898d74\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a942d85d233c0e2e8932f598b5b8c9b97eda0ae826b5a80a742559b36fa56979\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"2182ac070ac99ffbeb246624e36aa202ce8c626bd38aaa3191f5e60a408bc782\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a942d85d233c0e2e8932f598b5b8c9b97eda0ae826b5a80a742559b36fa56979\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"97e41dd7c810563f2cac2a1c963d220c840d6b756c6c76b0cf97113387aab38b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a05d7e315cc7cde173ab18a777672d3a18ce0a96f8f52d505404dcf8d1e51c20\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"a00edc25239da061cd0457625d6046ede5f9d09507c78c2209e1e992795831c9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6c73e108ce3d5ef8ece11651aca73aa00bd88530b6aba861d23ca7b6ff89ba5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2577de9e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"fccea68a78205480\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2577de9e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"fccea68a78205480\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"fbd557cfa232fb43236e5864400cd1522fbf21d014450df4a714ea2d3608e863\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7b56d8e34a0de188e49dc0ae60057e421eb8bc4643546e49b2fe810120869498\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"f809ccd15563984c9befad8f50ee38613b9c34eda0af01f561e75be88cba33ab\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a942d85d233c0e2e8932f598b5b8c9b97eda0ae826b5a80a742559b36fa56979\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"749b6bc66485455bb3cc5a0d552c38935bb446a6be85e306d894e6cbb4d92c08\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b31ddb7ef02e35e9d172430b50a004a3047564232880010bd3e581bf0dc547f8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"a1ec0f0592798b3996117a17734b0936906621077ceec69c81d8fb77e89a142a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"75a5abd89bb4e6258c7f7c7be472e6131799539dbbb87686c1010afe2791e45e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"3ca8a6339da3e4298e514bea168ac30f6c718d158fa0efc5e0fd85f06754a528\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"72bb4e3923485ca35015ee8655bc43ee332eea77f2cd8effbd48b21828f89f80\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"879fe62fbbe8b0a130140cda7f546611c758fb8fa416f173d2b0cf3da17d7941\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ed162da516e04d5229dc1d49e1c785e9db374ba4ba028ecabbdccdcb33acd1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"b43372d2a0820427086903362809a4a0c757cd1d6f593ba48a755e5fb972575d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f9603ac54a5668b179c6ba3dcda3951e57253a5ad5ad80214b563f50337f3a9c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2577de9e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"fccea68a78205480\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2577de9e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"fccea68a78205480\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"7caf859dfb9739029a8c1b13adba06164610495beddbda8e01fd7b432b15f4c3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"775fdec32977b769224a6d9530e33a1b93a2948f54e3f459e979da99f7def4ea\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"5cebae68b5e59e34a98c9c038f83d877f079732894ec3403d349e0b7ae0c9099\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6ab1b21b6f75f2c1ef86f9bcf36a6c25244e88430832e3ac86a839cf10bb8dcd\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"15ecb8224cf6049c2e831c815cc4f0aed954432b967d01d55ea637294f3ea87e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8b2fbdc0f4b402fd19fb549b70da796c6867a52206fa0420df2d6debc0db70b7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"7cb303fae9824d31834d539772c1840fd2991481566b7d07635c9284c524ae4d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a649343311197c716e0b6f502bb8ad21ecf4e207e16ffc6e0b74b1dc4f05f7fb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"699e8723136e653d04a8800a9289a3543f733ebfd0f99efbedfd18d22de4c281\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a6267fc785126adca5b68df13f95ef1fa08e1d72b66fbff01b54f8d61edaf7ba\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"9a72bfcef40a8da2865b02b6123c023d9f4f17c11a2ff674e3ed24af23e468e2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a6d41f4e9f57ec1e6bb4423e49991033d85f00a2a3303e02b25d1eedb67be3c9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2577de9e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"fccea68a78205480\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2577de9e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"fccea68a78205480\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"ad4137b1e753fd100088742941c8aaee9eaddc158bbaf221eb0d7318bdb8dfb5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6610d72af8a18be17c09082b4389a248d739315be17e0e146375e82e8d76261d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"66a5afc61110ab52ae4b9c9d79944467f91c4a2bd7b954ed8f59e651c215c630\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aea6441051c6a7490e44d5f7bab0e4bf7cf461c9597675611789e8d9141a446c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"c871ffab27f7ed925d56fae005e70fd3716aab799f0484d7d44519e915491d11\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"be7879d2a6daa00da89abfe5895a77787208f1af5b8582c79c8dd2849ef7906c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"461ea56b8a105dbd1d386b531c80b5a86960df99b24b6f6668520921b280a609\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7f4456bc894bf7ab59ba02c25915a8db007a89ffdd1efcace437a7761c68b3f9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2577de9e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"fccea68a78205480\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2577de9e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"fccea68a78205480\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"aedfea0f1dceed2b1af07ebf6e7dbc55cdc958ea5a084291f6216a19f63eae8a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f23dfebb92a3f3d59997030cce08899533ec20be47590cd866dd896392db04de\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"f42d6cbc7a49b6c1c4f0668dc536500321a8f658d1ab1a3a8b2ad8c0a95b272c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c57cda59d33d438c637a64dce8619a9616880a275363557ccc83d2cbc4920e14\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2577de9e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"fccea68a78205480\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2577de9e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"fccea68a78205480\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"1a3df8e6f6ad36c3eb928970ca2e746005e16b25405fc6eb9f44977b07d56905\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"086314a2fc965880bf769a18d3353909b6a1e5544e7eb514174994ba24387652\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"8e63847006a8d1952318fe3b6d2707027991d1c00d7959d051b3baf72690aecf\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f1def6d908410a124665ecd632ae01e5ba977920643dab1a35d25277292bae55\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"1199947fd30f0d1dab3db5846b8d27e36b6284be94834b798e4004120ec52532\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"676709317386301aa762cc48b7aa0064bc03adc00abbddfda8d0294046751d34\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"8a51327014eb82d6df6700b3f79ae6010cc76b2ee750f56ac5cb49c5b6f975ed\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d8557b9861d48e5714a954e0a885ecc7e55e6b9f034fc9f24f4c5c2f6dafce5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"91c8ce1078dc4a26a7cb0af054981aa28b4768dcd87a9a167f98e9b4e4b60325\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d63de28626482cf5fa2aaf12cb9aa3def86d637d4c98f193819331c36fa73b21\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"fae01409c891b630fc644ebf1b8bc640438a1fc79de2b0750d34e2a6388d4ca6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f86615df74e8d3814df8817b06dc7578a4b0af0817397c5bdddb1daaaeb1df4e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2577de9e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"fccea68a78205480\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2577de9e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"fccea68a78205480\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"2d972852e655bb76327ea47e134854d589cf64538813171d00544a81dc138f4f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ca57331ce8d0c8497c210605ffe8878f757d572164898f4f870b89fcf2f9f1ed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"1ef135f8dcdcaa663d4184fa6364518f7001a744380301035f254e16acdad0b7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"06c1a51758821d18e14577dc995b939fe472579672223b3bf0c1a312b23f23c4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2577de9e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"fccea68a78205480\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2577de9e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"fccea68a78205480\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"a90d5652afa4bbc65c24ada88ebb0df97a9c759ab0004d0c85d28f7e4c012bb9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/premium-w3-f51151/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"acbe19c11dc0fe08b370bbe647de6ecce77849e75c774c3e46f4a7af09e2861f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"b1fa0497afe070203ab9c23aef75e896659b83c8305ca7a56664d1717528e732\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7b5f8cd8dfbddc7109fd206805e23a6ae21c18bf406c0001927759ff1a39122f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"64238089f4803f45c8353b0d5d05ac6a23d6a3647106591fdc2bd5299c0b0759\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fd143bc18213c3c4682bcced572bcf84c1cbc8cd87ea188e96c990f164fd5ade\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"3ede2f522e381a5e5b8affa5afed6ede7d3894cf263c247dca9b3f3f3ad4a676\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cf25727b6a9419d97ed5dc9613d3b6a26e590c05f01b5c4038461accc96bc026\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"fb213d7be796970427643a4a818af11356ba854b3a0477e3c48bc2ef3332c7d5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cb9167704c77a112808785ad099bc015c57786c61e7befec251b029ce378a0c6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"ef8b5b3a53f3de47fd70ccb56be2422e84d7fb1f10a03b64c032baca50a33c79\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9a4beabc5e6770b1db0aae064836730685e70fcacd601193f69aafe8156d41a4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2577de9e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"fccea68a78205480\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2577de9e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"fccea68a78205480\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"667e44e20cda74056b10928af7322c52f17d044dda1b5aded34df466201c3e4d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/premium-w3-f51151/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fdd358955bc325dacf4ae3d584d9dfaa236b2605d42014543bcddb868221d0fa\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"0a4335c7c536062bc1f3c4f55fad89ef387858062864c877a3014c384192a4f5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"91d11ef27666b7f1f85063266e00a4add2242586a1e8a4bac5447b3f4ec7925d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"26827917812d006281f7f7ba6e53d3573012708364624693432b2cbdd0f434b5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"79bf752ac34000e70b4860b3a87054e1aab2babf35019e7e24d203c82f5f1c70\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"e8683890d73b71f6556b533ec6f92b30804817a025abb3d3c716a89f9b3f85d9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"707f7a9a5bb373d466ca8ba9e6220842edd61bdf74768cdb8760aca4648a21b3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2577de9e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"fccea68a78205480\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2577de9e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"fccea68a78205480\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"b90f395e8ebaa67a3ab9ee2a967d88bbf981033415dedacddf2e76a8347bfd39\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/premium-w3-f51151/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a40304ff6b4a0f6c57da3d4a6bcc549a18c94ce2ed3356df2ce4c4621e7d5231\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"ff65bd9a43408c55f0593fcb41763d9030c7823704d875b6050eb2c39b500d75\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ab3c6da9622dba177dfaf10df58f987a09c5bd12e35f73cca3f03ce632140cd4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2577de9e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"fccea68a78205480\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2577de9e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"fccea68a78205480\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"9ec2510ba7c20be712eae31e88eb54985eedbb6ce61783804c05db0582107bc2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/premium-w3-f51151/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5d4b7dc290bd7cb2c0c574a9869b31b45107252e6aaf512691b5c665967d6821\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"f6fff5f3b2673f2810cddb2b65518e70b74aad58e6c27ef1faf828a9cdef8c14\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d896bcdf40d08e0bef242ce04aa58467e96c672450af890adda6941c53a574d3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"69bd1c4b3e1b36f5d5d62283b221b7026a4e53da339ac7c470f75cb4334435f6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"16bf1b94bcdc2b222ee7ef5dfdb45298f40e57fcf65f862a63a7b2d64b143143\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"ec2b739c69e9a51aedc6a2ee8ed6e7bbcb37f4eff66695b2c6d1bf4950a2ecb3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3fdafb69d9c72b7e3c78e50b30f01adec907957097c6a1e811ceff68d93d7c23\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2577de9e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"fccea68a78205480\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2577de9e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"fccea68a78205480\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"a31568314e38d20d12f5921c57463100edd3022d5f9f3c0b36033d9a4dee9193\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e11ba50523ae86c5c06c5b76176154ed9ba57c3ed13fa43133b1ac7249ce345f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"67192e2ead59827b5990f7b4cbc2aece4271402ddcdfaa76f7cf95d2d4552c43\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b6344fa6f672d55d2eb4fbf6449de24a41dbf664f8e9d3c01ecde50e9d46e233\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"3c429336b45d9712bfdb0d99ecd41baa0dde1570067b941b5927e1894931c254\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d1f3365185f5fcfe92899c5f49af1b579baab97128b8afee3eed4350859c3f14\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"2f17c508c987cffd0b45ebd164fcee3ad66819a39900f83fbeda518ccf619183\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"85124e62247f9234752fedfc382ba93d6f839dab53f49c16951446afa3e613aa\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"6d2c4320e5eae8e51596e1c62f1c7494e1c5f9cd5d374e73b3ddae65dd071a92\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"461f0fb3ed9e91195eaa488b65b6f04cb4bff62087edbcf0d4c2186d180ba0ab\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"994b30d96390325263d89c2da7554eadd9d4fd1811371afabaf057df68e19205\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d13670b5b1696edcb191c925fa86dd729eeb7447f2230e160d9cc03e0117604d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"f70585dfa8966b9748a8978bfdf51d589a9d85f553359b47bfa09ad8bb266b02\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"18b02d50add3a7c29ec6127eedab648f22d172b48224a97365a7798a612dcd01\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2577de9e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"fccea68a78205480\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2577de9e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"fccea68a78205480\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"1e0c9c02fbbf3d69df4286ba8224f5543dfc90c1df5aa687b5b6f1c00dce4d56\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3f0daf8882dbe2b0594c2bb310f151a319cec601c5028d24f0d4557684bfb5f1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"4d8ba792ec63f5d46b5589f993126734f136e3569a1b7639aaea8768dc2c0f57\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a8ad3ccfafcc25ea959dd98788332d9514ad2d762423f3039adff91a3381329f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"b159e4d34dc2a1f6fe05bc0d616c2ebb2d3306defc93bfb6d4035e2f842e1b91\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-worker-w3-f51151"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-worker-w3-f51151\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:50:07.169Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-praxis-b-bb45bc","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"name":"kuadrant-e2e-praxis-b-bb45bc","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-praxis-b-bb45bc","uid":"188b7eba-1e78-42a1-ab26-1e46f3712d64"}]},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a2f4c985\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-bb45bc\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-bb45bc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a2f4c985\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-bb45bc\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-bb45bc\"]}],\"name\":\"c55bd69a722c710ef82c7b5b3fc86031e1739cd46af64ea4ad370507773a35fe\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a2f4c985\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-bb45bc\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-bb45bc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a2f4c985\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-bb45bc\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-bb45bc\"]}],\"name\":\"6ea9d526c0cca7b2a34225f1cec5cc0609911db1a5599701f94694b6b289cc1b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a2f4c985\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-bb45bc\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-bb45bc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a2f4c985\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-bb45bc\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-bb45bc\"]}],\"name\":\"52eead7b433b2db8e3c716842544e50ac1a6968745c545b7e5d4f871dd3ce6f7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a2f4c985\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-bb45bc\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-bb45bc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a2f4c985\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-bb45bc\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-bb45bc\"]}],\"name\":\"c48364b40c431a1c7783d04136051c6e99761079062a79f9a6c0321dd7a448f0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a2f4c985\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-bb45bc\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-bb45bc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a2f4c985\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-bb45bc\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-bb45bc\"]}],\"name\":\"6cb72ef5ddf61ad5c80931fddb489a3f4007a90a2ce3a3f1392466a80bd6101b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a2f4c985\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-bb45bc\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-bb45bc\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a2f4c985\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-bb45bc\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-bb45bc\"]}],\"name\":\"33687a22d833609133beca3f646ef4635fac0df679a70bba23154bb56803a6c9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-praxis-b-bb45bc"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-e2e-praxis-b-bb45bc\" already exists"}
{"level":"error","ts":"2026-11-02T21:50:07.908Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-praxis-b-bb45bc","namespace":"openshift-ingress","uid":"66889525-16ed-4175-84b2-b9c4e9b2628e","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-praxis-b-bb45bc\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:50:08.504Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w3-f51151","namespace":"e2e-models-e2e-worker-w3-f51151","uid":"c78aa03a-e3ca-4797-8a09-ab0d9cd88148","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w3-f51151\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:50:08.562Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w3-f51151","namespace":"e2e-models-e2e-worker-w3-f51151","uid":"e3340067-224a-43ad-8020-ca9e00ead152","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w3-f51151\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:50:09.159Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-praxis-b-942164","namespace":"openshift-ingress","uid":"6cf09360-0475-460a-ad78-6bbaa45fbd6a","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-praxis-b-942164\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:50:09.220Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-praxis-b-bb45bc","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-praxis-b-bb45bc\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:50:09.255Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"maas-api-route-e2e-praxis-b-bb45bc","namespace":"odh-ai-gateway-infra","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"maas-api-route-e2e-praxis-b-bb45bc\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:50:15Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-praxis-b-cc0d6a","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-b-cc0d6a","reconcileID":"c87748d8-ee84-40e2-bd95-d68283057109","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-praxis-b-cc0d6a","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:50:15Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-b-cc0d6a","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T21:50:15Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:50:15Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-11-02T21:50:15Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:50:15Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-11-02T21:50:15Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-praxis-b-cc0d6a","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-b-cc0d6a","reconcileID":"c87748d8-ee84-40e2-bd95-d68283057109","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-praxis-b-cc0d6a","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:50:15Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-b-cc0d6a","event":"DELETE"}
{"level":"info","ts":"2026-11-02T21:50:15Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-02T21:50:15Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-praxis-b-cc0d6a\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-02T21:50:15Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:50:19.479Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["EnvoyFilter","TokenRateLimitPolicy","AuthConfig","AuthPolicy","Limitador","ConfigMap","Gateway","HTTPRoute"],"eventTypes":{"create":9,"update":11}}
{"level":"info","ts":"2026-11-02T21:50:19.685Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:50:21.568Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:50:21.670Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:50:21.671Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:50:24.470Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:50:24.470Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:50:24.482Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:50:24.488Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:50:24.491Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:50:24.491Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:50:24.736Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T21:50:26.258Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-praxis-b-cc0d6a-maas-auth","namespace":"openshift-ingress","error":"authpolicies.kuadrant.io \"e2e-praxis-b-cc0d6a-maas-auth\" not found"}
{"level":"error","ts":"2026-11-02T21:50:27.427Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w3-f51151","namespace":"e2e-models-e2e-worker-w3-f51151","uid":"c78aa03a-e3ca-4797-8a09-ab0d9cd88148","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w3-f51151\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:50:27.488Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:50:27.488Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T21:50:27.836Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-praxis-b-cc0d6a","error":"gateways.gateway.networking.k8s.io \"e2e-praxis-b-cc0d6a\" not found"}
{"level":"info","ts":"2026-11-02T21:50:28.644Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway","Kuadrant","HTTPRoute","TokenRateLimitPolicy"],"eventTypes":{"delete":2,"update":2}}
{"level":"info","ts":"2026-11-02T21:50:28.815Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:50:28.833Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:50:31.335Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:50:31.439Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:50:31.753Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:50:31.935Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:50:31.935Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:50:32Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-praxis-a-eabda2","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-a-eabda2","reconcileID":"59b6c3c8-7ee1-4399-b725-a45e2129b671","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-praxis-a-eabda2","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:50:32Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-a-eabda2","event":"CREATE"}
{"level":"info","ts":"2026-11-02T21:50:32Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:50:33Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-02T21:50:33Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-02T21:50:33Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:50:33Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-praxis-a-eabda2","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-a-eabda2","reconcileID":"71371bdb-a375-4fe9-b5ad-bdd90ecc4e7f","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-praxis-a-eabda2","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:50:33Z","logger":"telemetry-policy-extension-controller","msg":"Warning: Reconciler returned both a non-zero result and a non-nil error. The result will always be ignored if the error is non-nil and the non-nil error causes requeuing with exponential backoff. For more details, see: https://pkg.go.dev/sigs.k8s.io/controller-runtime/pkg/reconcile#Reconciler","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-praxis-a-eabda2","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-a-eabda2","reconcileID":"71371bdb-a375-4fe9-b5ad-bdd90ecc4e7f"}
{"level":"error","ts":"2026-11-02T21:50:33Z","logger":"telemetry-policy-extension-controller","msg":"Reconciler error","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-praxis-a-eabda2","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-a-eabda2","reconcileID":"71371bdb-a375-4fe9-b5ad-bdd90ecc4e7f","error":"Operation cannot be fulfilled on telemetrypolicies.extensions.kuadrant.io \"maas-telemetry-e2e-praxis-a-eabda2\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:353\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-02T21:50:33Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-praxis-a-eabda2","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-a-eabda2","reconcileID":"ab1639ba-f405-4413-b294-593422edb9ec","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-praxis-a-eabda2","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:50:34Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-a-eabda2","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T21:50:34Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:50:34.632Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:50:34.632Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:50:34.638Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:50:34.650Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:50:34.650Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:50:34.660Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-11-02T21:50:34.733Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to delete envoyfilter object","envoyfilter":"openshift-ingress/kuadrant-auth-e2e-praxis-b-cc0d6a","error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-praxis-b-cc0d6a\" not found"}
{"level":"error","ts":"2026-11-02T21:50:34.733Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/b5c7cde39402e0feef6dedb8a85f65a09963788890b5d2f11d0889874feff1e5","error":"authconfigs.authorino.kuadrant.io \"b5c7cde39402e0feef6dedb8a85f65a09963788890b5d2f11d0889874feff1e5\" not found"}
{"level":"error","ts":"2026-11-02T21:50:34.733Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to delete envoyfilter object","envoyfilter":"openshift-ingress/kuadrant-ratelimiting-e2e-praxis-b-cc0d6a","error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-praxis-b-cc0d6a\" not found"}
{"level":"error","ts":"2026-11-02T21:50:34.735Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:50:34.735Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T21:50:34.789Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/1c2ca39f7c7ea318d4db17de6d877f5b0d98a5203ae1d187430b77bc6980990e","error":"authconfigs.authorino.kuadrant.io \"1c2ca39f7c7ea318d4db17de6d877f5b0d98a5203ae1d187430b77bc6980990e\" not found"}
{"level":"error","ts":"2026-11-02T21:50:34.844Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/41c10e5ce4c0005d889fe214ce527ff3283a6cc7d6a72e791b2e6d12aaebe662","error":"authconfigs.authorino.kuadrant.io \"41c10e5ce4c0005d889fe214ce527ff3283a6cc7d6a72e791b2e6d12aaebe662\" not found"}
{"level":"error","ts":"2026-11-02T21:50:34.935Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/56250a598206d06b154f17be56128839ddb188b05997c93b803afc567b80e3d0","error":"authconfigs.authorino.kuadrant.io \"56250a598206d06b154f17be56128839ddb188b05997c93b803afc567b80e3d0\" not found"}
{"level":"info","ts":"2026-11-02T21:50:34Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-02T21:50:34Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-02T21:50:34Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-02T21:50:34Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:50:34Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-a-eabda2","event":"UNKNOWN"}
{"level":"info","ts":"2026-11-02T21:50:34Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-02T21:50:34.992Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/a6148beb3bdc8819b98ca064ead168e788010a97690b838db80c14663bd4592f","error":"authconfigs.authorino.kuadrant.io \"a6148beb3bdc8819b98ca064ead168e788010a97690b838db80c14663bd4592f\" not found"}
{"level":"error","ts":"2026-11-02T21:50:35.047Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/46b5cdb8f9be5b8a58910c84a4dfeb5784454c96a76ba74c49749160d3346dcc","error":"authconfigs.authorino.kuadrant.io \"46b5cdb8f9be5b8a58910c84a4dfeb5784454c96a76ba74c49749160d3346dcc\" not found"}
{"level":"info","ts":"2026-11-02T21:50:35Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-02T21:50:35Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-02T21:50:35Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-02T21:50:35Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"error","ts":"2026-11-02T21:50:35.725Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-worker-w3-f51151","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T21:21:31Z","generation":12,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"8871137c-7f6a-401d-a6db-2983aea5ba22\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:49:59Z"}],"name":"kuadrant-e2e-worker-w3-f51151","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-worker-w3-f51151","uid":"8871137c-7f6a-401d-a6db-2983aea5ba22"}],"resourceVersion":"74165","uid":"c24c0550-6758-4dca-8d2b-3fe32740d122"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a05d7e315cc7cde173ab18a777672d3a18ce0a96f8f52d505404dcf8d1e51c20\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"0e7c31c41adb0d3f9efc929ae631573fe0c783a2fa7edb7a4b135081c2969bbf\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6c73e108ce3d5ef8ece11651aca73aa00bd88530b6aba861d23ca7b6ff89ba5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2577de9e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c7b57757426e2da5\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2577de9e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c7b57757426e2da5\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"aedbd7ef0308fd9494e9a3a1386b732923d5d060acf5a188601898d4867d320f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7b56d8e34a0de188e49dc0ae60057e421eb8bc4643546e49b2fe810120869498\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"b6389ab82133347e2514a4ad1cbd9d34042edc9a4ad044714155dbb2aecf38d4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a942d85d233c0e2e8932f598b5b8c9b97eda0ae826b5a80a742559b36fa56979\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"85e7f37f931469abe1b396a1a44b52a8b72e6a4dc98ed0ebdd61e43f0486de13\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a05d7e315cc7cde173ab18a777672d3a18ce0a96f8f52d505404dcf8d1e51c20\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"ec8a1b6bbf984a67cda63e2d923bfa9d2d66a7537f676f6198c12cbca9103517\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6c73e108ce3d5ef8ece11651aca73aa00bd88530b6aba861d23ca7b6ff89ba5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2577de9e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c7b57757426e2da5\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2577de9e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c7b57757426e2da5\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"5c9b9ac2bc33c747eb54045ee2511e3c8b2ee9737a3f347afb75903f43d74fb7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7b56d8e34a0de188e49dc0ae60057e421eb8bc4643546e49b2fe810120869498\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"f82b9432930517e02d229f4fdbdd8b6700b061d5d333fe35b064a3bb85f58e76\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a942d85d233c0e2e8932f598b5b8c9b97eda0ae826b5a80a742559b36fa56979\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"6d321a24ed09abad642dee549f0c7cbf98ce40481beb85ca79bd3d4eeb89b77e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a05d7e315cc7cde173ab18a777672d3a18ce0a96f8f52d505404dcf8d1e51c20\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"a54bd689e670e5f8bbee0a66c2585a4d4adce9a5a7fc297449ee3b816a0c2695\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6c73e108ce3d5ef8ece11651aca73aa00bd88530b6aba861d23ca7b6ff89ba5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2577de9e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c7b57757426e2da5\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2577de9e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c7b57757426e2da5\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"ad845c31a125851bf4cc5ae7e83bb4a011cf98484d99780ab16df250ca9dd41c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7b56d8e34a0de188e49dc0ae60057e421eb8bc4643546e49b2fe810120869498\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"9eefe22cd9d7f4d324cc07e6422d998261fea96e9069bc938fe66a94e8c8cadb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a942d85d233c0e2e8932f598b5b8c9b97eda0ae826b5a80a742559b36fa56979\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"b00ec38cf5be980b160374be347b182afaa16e0dc99314a5e990f20cef6d57ed\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a05d7e315cc7cde173ab18a777672d3a18ce0a96f8f52d505404dcf8d1e51c20\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"6d5d9aca320022f0f8b70c3f9b34b5922adf537f5da717ec79924566febf6df1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6c73e108ce3d5ef8ece11651aca73aa00bd88530b6aba861d23ca7b6ff89ba5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2577de9e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c7b57757426e2da5\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2577de9e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c7b57757426e2da5\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"346e75cab49a1cf8ae89d90cfb32099256f44d7909e40cdc730e951946a411e2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7b56d8e34a0de188e49dc0ae60057e421eb8bc4643546e49b2fe810120869498\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"ae0a4172fa23a6e8857123675126f34bcaf4e08f94c05663e2913801fda46401\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a942d85d233c0e2e8932f598b5b8c9b97eda0ae826b5a80a742559b36fa56979\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"ee0931c3dc206732c58bab1add9bf2cb602a2eb21bfa9272c2df596197dceb3e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a05d7e315cc7cde173ab18a777672d3a18ce0a96f8f52d505404dcf8d1e51c20\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"3f6b6643d5731a355a44968b83b24169ff3e0c1b36737d8be7f9d42e1def7c3e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6c73e108ce3d5ef8ece11651aca73aa00bd88530b6aba861d23ca7b6ff89ba5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2577de9e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c7b57757426e2da5\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2577de9e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c7b57757426e2da5\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"cd8ab5f89e71494c8d176f9668b8ed279bd244e6f70d1a5c87603877b4b7182d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7b56d8e34a0de188e49dc0ae60057e421eb8bc4643546e49b2fe810120869498\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"09df06c068a0d1324c44679ca0c022e74cd18bae1497d0087fb2184f9401d63b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a942d85d233c0e2e8932f598b5b8c9b97eda0ae826b5a80a742559b36fa56979\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"821121f5584e938a01b323996203984576204f894f2c9f09f5ececcdc058373e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a05d7e315cc7cde173ab18a777672d3a18ce0a96f8f52d505404dcf8d1e51c20\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"e00f3dfbbce60a718137b415a42cbf1e65a7b226437cc4600d9fa76b264e3b4d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a05d7e315cc7cde173ab18a777672d3a18ce0a96f8f52d505404dcf8d1e51c20\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"7ddf0d6bdcfc6aa206cdc0919b1d5b7545c903aafbb0e16d393016b1a83bd29a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6c73e108ce3d5ef8ece11651aca73aa00bd88530b6aba861d23ca7b6ff89ba5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2577de9e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c7b57757426e2da5\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2577de9e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c7b57757426e2da5\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"fe3b37fdd5d3f9d3bdf7d03b186d964b283bfbe7d3ffa720457517666c3070a2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6c73e108ce3d5ef8ece11651aca73aa00bd88530b6aba861d23ca7b6ff89ba5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2577de9e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c7b57757426e2da5\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2577de9e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c7b57757426e2da5\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"7dd9491b4755b4900c5bc55b4dd9aff38f99899f0236e4d21bf7c94e5769cbb1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7b56d8e34a0de188e49dc0ae60057e421eb8bc4643546e49b2fe810120869498\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"fa5430186b33e56d19e4d2e0209b4f2215d17b488745cd8061eb5ecaf96ecafa\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7b56d8e34a0de188e49dc0ae60057e421eb8bc4643546e49b2fe810120869498\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"cd88af3d71345ad9b32dfae02550fa9bf6aa0cddfac2d0464a60cd90b9898d74\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a942d85d233c0e2e8932f598b5b8c9b97eda0ae826b5a80a742559b36fa56979\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"2182ac070ac99ffbeb246624e36aa202ce8c626bd38aaa3191f5e60a408bc782\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a942d85d233c0e2e8932f598b5b8c9b97eda0ae826b5a80a742559b36fa56979\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"97e41dd7c810563f2cac2a1c963d220c840d6b756c6c76b0cf97113387aab38b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a05d7e315cc7cde173ab18a777672d3a18ce0a96f8f52d505404dcf8d1e51c20\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"a00edc25239da061cd0457625d6046ede5f9d09507c78c2209e1e992795831c9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6c73e108ce3d5ef8ece11651aca73aa00bd88530b6aba861d23ca7b6ff89ba5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2577de9e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c7b57757426e2da5\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2577de9e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c7b57757426e2da5\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"fbd557cfa232fb43236e5864400cd1522fbf21d014450df4a714ea2d3608e863\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7b56d8e34a0de188e49dc0ae60057e421eb8bc4643546e49b2fe810120869498\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"f809ccd15563984c9befad8f50ee38613b9c34eda0af01f561e75be88cba33ab\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a942d85d233c0e2e8932f598b5b8c9b97eda0ae826b5a80a742559b36fa56979\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"749b6bc66485455bb3cc5a0d552c38935bb446a6be85e306d894e6cbb4d92c08\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b31ddb7ef02e35e9d172430b50a004a3047564232880010bd3e581bf0dc547f8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"a1ec0f0592798b3996117a17734b0936906621077ceec69c81d8fb77e89a142a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"75a5abd89bb4e6258c7f7c7be472e6131799539dbbb87686c1010afe2791e45e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"3ca8a6339da3e4298e514bea168ac30f6c718d158fa0efc5e0fd85f06754a528\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"72bb4e3923485ca35015ee8655bc43ee332eea77f2cd8effbd48b21828f89f80\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"879fe62fbbe8b0a130140cda7f546611c758fb8fa416f173d2b0cf3da17d7941\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ed162da516e04d5229dc1d49e1c785e9db374ba4ba028ecabbdccdcb33acd1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"b43372d2a0820427086903362809a4a0c757cd1d6f593ba48a755e5fb972575d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f9603ac54a5668b179c6ba3dcda3951e57253a5ad5ad80214b563f50337f3a9c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2577de9e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c7b57757426e2da5\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2577de9e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c7b57757426e2da5\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"7caf859dfb9739029a8c1b13adba06164610495beddbda8e01fd7b432b15f4c3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"775fdec32977b769224a6d9530e33a1b93a2948f54e3f459e979da99f7def4ea\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"5cebae68b5e59e34a98c9c038f83d877f079732894ec3403d349e0b7ae0c9099\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6ab1b21b6f75f2c1ef86f9bcf36a6c25244e88430832e3ac86a839cf10bb8dcd\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"15ecb8224cf6049c2e831c815cc4f0aed954432b967d01d55ea637294f3ea87e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8b2fbdc0f4b402fd19fb549b70da796c6867a52206fa0420df2d6debc0db70b7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"7cb303fae9824d31834d539772c1840fd2991481566b7d07635c9284c524ae4d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a649343311197c716e0b6f502bb8ad21ecf4e207e16ffc6e0b74b1dc4f05f7fb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"699e8723136e653d04a8800a9289a3543f733ebfd0f99efbedfd18d22de4c281\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a6267fc785126adca5b68df13f95ef1fa08e1d72b66fbff01b54f8d61edaf7ba\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"9a72bfcef40a8da2865b02b6123c023d9f4f17c11a2ff674e3ed24af23e468e2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a6d41f4e9f57ec1e6bb4423e49991033d85f00a2a3303e02b25d1eedb67be3c9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2577de9e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c7b57757426e2da5\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2577de9e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c7b57757426e2da5\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"ad4137b1e753fd100088742941c8aaee9eaddc158bbaf221eb0d7318bdb8dfb5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6610d72af8a18be17c09082b4389a248d739315be17e0e146375e82e8d76261d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"66a5afc61110ab52ae4b9c9d79944467f91c4a2bd7b954ed8f59e651c215c630\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aea6441051c6a7490e44d5f7bab0e4bf7cf461c9597675611789e8d9141a446c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"c871ffab27f7ed925d56fae005e70fd3716aab799f0484d7d44519e915491d11\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"be7879d2a6daa00da89abfe5895a77787208f1af5b8582c79c8dd2849ef7906c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"461ea56b8a105dbd1d386b531c80b5a86960df99b24b6f6668520921b280a609\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7f4456bc894bf7ab59ba02c25915a8db007a89ffdd1efcace437a7761c68b3f9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2577de9e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c7b57757426e2da5\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2577de9e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c7b57757426e2da5\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"aedfea0f1dceed2b1af07ebf6e7dbc55cdc958ea5a084291f6216a19f63eae8a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f23dfebb92a3f3d59997030cce08899533ec20be47590cd866dd896392db04de\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"f42d6cbc7a49b6c1c4f0668dc536500321a8f658d1ab1a3a8b2ad8c0a95b272c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c57cda59d33d438c637a64dce8619a9616880a275363557ccc83d2cbc4920e14\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2577de9e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c7b57757426e2da5\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2577de9e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c7b57757426e2da5\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"1a3df8e6f6ad36c3eb928970ca2e746005e16b25405fc6eb9f44977b07d56905\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"086314a2fc965880bf769a18d3353909b6a1e5544e7eb514174994ba24387652\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"8e63847006a8d1952318fe3b6d2707027991d1c00d7959d051b3baf72690aecf\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f1def6d908410a124665ecd632ae01e5ba977920643dab1a35d25277292bae55\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"1199947fd30f0d1dab3db5846b8d27e36b6284be94834b798e4004120ec52532\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"676709317386301aa762cc48b7aa0064bc03adc00abbddfda8d0294046751d34\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"8a51327014eb82d6df6700b3f79ae6010cc76b2ee750f56ac5cb49c5b6f975ed\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d8557b9861d48e5714a954e0a885ecc7e55e6b9f034fc9f24f4c5c2f6dafce5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"91c8ce1078dc4a26a7cb0af054981aa28b4768dcd87a9a167f98e9b4e4b60325\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d63de28626482cf5fa2aaf12cb9aa3def86d637d4c98f193819331c36fa73b21\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"fae01409c891b630fc644ebf1b8bc640438a1fc79de2b0750d34e2a6388d4ca6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f86615df74e8d3814df8817b06dc7578a4b0af0817397c5bdddb1daaaeb1df4e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2577de9e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c7b57757426e2da5\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2577de9e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c7b57757426e2da5\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"2d972852e655bb76327ea47e134854d589cf64538813171d00544a81dc138f4f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ca57331ce8d0c8497c210605ffe8878f757d572164898f4f870b89fcf2f9f1ed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"1ef135f8dcdcaa663d4184fa6364518f7001a744380301035f254e16acdad0b7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"06c1a51758821d18e14577dc995b939fe472579672223b3bf0c1a312b23f23c4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2577de9e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c7b57757426e2da5\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2577de9e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c7b57757426e2da5\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"a90d5652afa4bbc65c24ada88ebb0df97a9c759ab0004d0c85d28f7e4c012bb9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/premium-w3-f51151/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"acbe19c11dc0fe08b370bbe647de6ecce77849e75c774c3e46f4a7af09e2861f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"b1fa0497afe070203ab9c23aef75e896659b83c8305ca7a56664d1717528e732\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7b5f8cd8dfbddc7109fd206805e23a6ae21c18bf406c0001927759ff1a39122f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"64238089f4803f45c8353b0d5d05ac6a23d6a3647106591fdc2bd5299c0b0759\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fd143bc18213c3c4682bcced572bcf84c1cbc8cd87ea188e96c990f164fd5ade\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"3ede2f522e381a5e5b8affa5afed6ede7d3894cf263c247dca9b3f3f3ad4a676\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cf25727b6a9419d97ed5dc9613d3b6a26e590c05f01b5c4038461accc96bc026\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"fb213d7be796970427643a4a818af11356ba854b3a0477e3c48bc2ef3332c7d5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cb9167704c77a112808785ad099bc015c57786c61e7befec251b029ce378a0c6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"ef8b5b3a53f3de47fd70ccb56be2422e84d7fb1f10a03b64c032baca50a33c79\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9a4beabc5e6770b1db0aae064836730685e70fcacd601193f69aafe8156d41a4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2577de9e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c7b57757426e2da5\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2577de9e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c7b57757426e2da5\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"667e44e20cda74056b10928af7322c52f17d044dda1b5aded34df466201c3e4d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/premium-w3-f51151/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fdd358955bc325dacf4ae3d584d9dfaa236b2605d42014543bcddb868221d0fa\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"0a4335c7c536062bc1f3c4f55fad89ef387858062864c877a3014c384192a4f5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"91d11ef27666b7f1f85063266e00a4add2242586a1e8a4bac5447b3f4ec7925d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"26827917812d006281f7f7ba6e53d3573012708364624693432b2cbdd0f434b5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"79bf752ac34000e70b4860b3a87054e1aab2babf35019e7e24d203c82f5f1c70\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"e8683890d73b71f6556b533ec6f92b30804817a025abb3d3c716a89f9b3f85d9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"707f7a9a5bb373d466ca8ba9e6220842edd61bdf74768cdb8760aca4648a21b3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2577de9e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c7b57757426e2da5\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2577de9e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c7b57757426e2da5\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"b90f395e8ebaa67a3ab9ee2a967d88bbf981033415dedacddf2e76a8347bfd39\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/premium-w3-f51151/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a40304ff6b4a0f6c57da3d4a6bcc549a18c94ce2ed3356df2ce4c4621e7d5231\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"ff65bd9a43408c55f0593fcb41763d9030c7823704d875b6050eb2c39b500d75\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ab3c6da9622dba177dfaf10df58f987a09c5bd12e35f73cca3f03ce632140cd4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2577de9e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c7b57757426e2da5\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2577de9e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c7b57757426e2da5\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"9ec2510ba7c20be712eae31e88eb54985eedbb6ce61783804c05db0582107bc2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/premium-w3-f51151/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5d4b7dc290bd7cb2c0c574a9869b31b45107252e6aaf512691b5c665967d6821\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"f6fff5f3b2673f2810cddb2b65518e70b74aad58e6c27ef1faf828a9cdef8c14\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d896bcdf40d08e0bef242ce04aa58467e96c672450af890adda6941c53a574d3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"69bd1c4b3e1b36f5d5d62283b221b7026a4e53da339ac7c470f75cb4334435f6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"16bf1b94bcdc2b222ee7ef5dfdb45298f40e57fcf65f862a63a7b2d64b143143\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"ec2b739c69e9a51aedc6a2ee8ed6e7bbcb37f4eff66695b2c6d1bf4950a2ecb3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3fdafb69d9c72b7e3c78e50b30f01adec907957097c6a1e811ceff68d93d7c23\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2577de9e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c7b57757426e2da5\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2577de9e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c7b57757426e2da5\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"a31568314e38d20d12f5921c57463100edd3022d5f9f3c0b36033d9a4dee9193\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e11ba50523ae86c5c06c5b76176154ed9ba57c3ed13fa43133b1ac7249ce345f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"67192e2ead59827b5990f7b4cbc2aece4271402ddcdfaa76f7cf95d2d4552c43\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b6344fa6f672d55d2eb4fbf6449de24a41dbf664f8e9d3c01ecde50e9d46e233\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"3c429336b45d9712bfdb0d99ecd41baa0dde1570067b941b5927e1894931c254\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d1f3365185f5fcfe92899c5f49af1b579baab97128b8afee3eed4350859c3f14\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"2f17c508c987cffd0b45ebd164fcee3ad66819a39900f83fbeda518ccf619183\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"85124e62247f9234752fedfc382ba93d6f839dab53f49c16951446afa3e613aa\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"6d2c4320e5eae8e51596e1c62f1c7494e1c5f9cd5d374e73b3ddae65dd071a92\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"461f0fb3ed9e91195eaa488b65b6f04cb4bff62087edbcf0d4c2186d180ba0ab\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"994b30d96390325263d89c2da7554eadd9d4fd1811371afabaf057df68e19205\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d13670b5b1696edcb191c925fa86dd729eeb7447f2230e160d9cc03e0117604d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"f70585dfa8966b9748a8978bfdf51d589a9d85f553359b47bfa09ad8bb266b02\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"18b02d50add3a7c29ec6127eedab648f22d172b48224a97365a7798a612dcd01\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2577de9e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c7b57757426e2da5\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2577de9e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c7b57757426e2da5\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"1e0c9c02fbbf3d69df4286ba8224f5543dfc90c1df5aa687b5b6f1c00dce4d56\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3f0daf8882dbe2b0594c2bb310f151a319cec601c5028d24f0d4557684bfb5f1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"4d8ba792ec63f5d46b5589f993126734f136e3569a1b7639aaea8768dc2c0f57\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a8ad3ccfafcc25ea959dd98788332d9514ad2d762423f3039adff91a3381329f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"b159e4d34dc2a1f6fe05bc0d616c2ebb2d3306defc93bfb6d4035e2f842e1b91\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-worker-w3-f51151"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-worker-w3-f51151\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:50:35.835Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to delete envoyfilter object","gateway":"openshift-ingress/e2e-praxis-b-cc0d6a","envoyfilter":"openshift-ingress/kuadrant-e2e-praxis-b-cc0d6a","error":"envoyfilters.networking.istio.io \"kuadrant-e2e-praxis-b-cc0d6a\" not found"}
{"level":"error","ts":"2026-11-02T21:50:36.238Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w3-f51151","namespace":"e2e-models-e2e-worker-w3-f51151","uid":"c78aa03a-e3ca-4797-8a09-ab0d9cd88148","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w3-f51151\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:50:36.452Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-praxis-b-cc0d6a-maas-auth","namespace":"openshift-ingress","error":"authpolicies.kuadrant.io \"e2e-praxis-b-cc0d6a-maas-auth\" not found"}
{"level":"error","ts":"2026-11-02T21:50:36.515Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-praxis-b-bb45bc-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-praxis-b-bb45bc-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:50:37.206Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w0-0c9014","namespace":"e2e-models-e2e-worker-w0-0c9014","uid":"4f647df6-1d5b-433b-b4fc-1279ff1755f7","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w0-0c9014\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:50:37.383Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-praxis-b-bb45bc","namespace":"openshift-ingress","uid":"66889525-16ed-4175-84b2-b9c4e9b2628e","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-praxis-b-bb45bc\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:50:37.446Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:50:37.446Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T21:50:37.823Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-praxis-a-eabda2","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-praxis-a-eabda2\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:50:38.313Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-praxis-b-cc0d6a","error":"gateways.gateway.networking.k8s.io \"e2e-praxis-b-cc0d6a\" not found"}
{"level":"info","ts":"2026-11-02T21:50:44.952Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","AuthPolicy","Gateway","HTTPRoute","TokenRateLimitPolicy","EnvoyFilter","Limitador","Kuadrant","AuthConfig"],"eventTypes":{"create":4,"delete":11,"update":11}}
{"level":"info","ts":"2026-11-02T21:50:45.254Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:50:45.274Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:50:47.735Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:50:47.826Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:50:47.947Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:50:47.947Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:50:48.068Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:50:51.048Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:50:51.050Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:50:51.060Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:50:51.065Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:50:51.069Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:50:51.069Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:50:51.224Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T21:50:53.439Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w0-0c9014","namespace":"e2e-models-e2e-worker-w0-0c9014","uid":"4f647df6-1d5b-433b-b4fc-1279ff1755f7","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w0-0c9014\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:50:53.558Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w3-f51151","namespace":"e2e-models-e2e-worker-w3-f51151","uid":"e3340067-224a-43ad-8020-ca9e00ead152","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w3-f51151\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:50:53.981Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w0-0c9014","namespace":"e2e-models-e2e-worker-w0-0c9014","uid":"dcb5a0e4-7049-4ddc-91de-e14d55b09789","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w0-0c9014\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:50:53.982Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:50:53.982Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:50:58Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-praxis-a-8e90da","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-a-8e90da","reconcileID":"59cfe368-4bd4-4c4f-923d-559ade17ec28","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-praxis-a-8e90da","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:50:58Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-a-8e90da","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T21:50:58Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:50:58Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-11-02T21:50:58Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:50:58Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-11-02T21:50:58Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-praxis-a-8e90da","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-a-8e90da","reconcileID":"59cfe368-4bd4-4c4f-923d-559ade17ec28","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-praxis-a-8e90da","namespace":"openshift-ingress"}
{"level":"error","ts":"2026-11-02T21:50:59Z","logger":"telemetry-policy-extension-controller","msg":"Reconciler error","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-praxis-a-8e90da","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-a-8e90da","reconcileID":"eb67d9b9-b7af-4894-bce6-0a2e59677460","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-praxis-a-8e90da\" not found","stacktrace":"sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:353\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-02T21:50:59Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-a-8e90da","event":"DELETE"}
{"level":"info","ts":"2026-11-02T21:50:59Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-02T21:50:59Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-praxis-a-8e90da\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-02T21:50:59Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:51:04.442Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["EnvoyFilter","AuthConfig","TokenRateLimitPolicy","ConfigMap","AuthPolicy","Limitador","HTTPRoute","Gateway"],"eventTypes":{"create":21,"update":15}}
{"level":"info","ts":"2026-11-02T21:51:04.686Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:51:06.543Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:51:06.763Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:51:06.763Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:51:09.896Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:51:09.905Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:51:09.905Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:51:09.924Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:51:09.926Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:51:09.934Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"error","ts":"2026-11-02T21:51:09.968Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to delete envoyfilter object","envoyfilter":"openshift-ingress/kuadrant-ratelimiting-e2e-praxis-a-8e90da","error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-praxis-a-8e90da\" not found"}
{"level":"error","ts":"2026-11-02T21:51:10.023Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to delete envoyfilter object","envoyfilter":"openshift-ingress/kuadrant-auth-e2e-praxis-a-8e90da","error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-praxis-a-8e90da\" not found"}
{"level":"error","ts":"2026-11-02T21:51:10.035Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:51:10.035Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T21:51:10.715Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to delete envoyfilter object","gateway":"openshift-ingress/e2e-praxis-a-8e90da","envoyfilter":"openshift-ingress/kuadrant-e2e-praxis-a-8e90da","error":"envoyfilters.networking.istio.io \"kuadrant-e2e-praxis-a-8e90da\" not found"}
{"level":"error","ts":"2026-11-02T21:51:11.570Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w0-0c9014","namespace":"e2e-models-e2e-worker-w0-0c9014","uid":"dcb5a0e4-7049-4ddc-91de-e14d55b09789","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w0-0c9014\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:51:12.066Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-praxis-a-8e90da-maas-auth","namespace":"openshift-ingress","error":"authpolicies.kuadrant.io \"e2e-praxis-a-8e90da-maas-auth\" not found"}
{"level":"error","ts":"2026-11-02T21:51:12.360Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w3-f51151","namespace":"e2e-models-e2e-worker-w3-f51151","uid":"e3340067-224a-43ad-8020-ca9e00ead152","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w3-f51151\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:51:12.838Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:51:12.838Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T21:51:13.525Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-praxis-a-8e90da","error":"gateways.gateway.networking.k8s.io \"e2e-praxis-a-8e90da\" not found"}
{"level":"info","ts":"2026-11-02T21:51:14.072Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway","AuthConfig","Kuadrant","TokenRateLimitPolicy","HTTPRoute"],"eventTypes":{"delete":2,"update":6}}
{"level":"info","ts":"2026-11-02T21:51:14.257Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:51:14.358Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:51:16.963Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:51:17.063Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:51:17.251Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:51:17.359Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:51:17.359Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:51:20.325Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:51:20.338Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:51:20.348Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:51:20.367Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:51:20.367Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:51:20.369Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-11-02T21:51:20.457Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to delete envoyfilter object","envoyfilter":"openshift-ingress/kuadrant-auth-e2e-praxis-a-8e90da","error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-praxis-a-8e90da\" not found"}
{"level":"error","ts":"2026-11-02T21:51:20.457Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to delete envoyfilter object","envoyfilter":"openshift-ingress/kuadrant-ratelimiting-e2e-praxis-a-8e90da","error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-praxis-a-8e90da\" not found"}
{"level":"error","ts":"2026-11-02T21:51:20.469Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:51:20.469Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T21:51:20.527Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/1ac2468d0e20bb2f4ba5b984e2c6db4aad3b48d5a08b09bf51e5c2aaa6591609","error":"authconfigs.authorino.kuadrant.io \"1ac2468d0e20bb2f4ba5b984e2c6db4aad3b48d5a08b09bf51e5c2aaa6591609\" not found"}
{"level":"error","ts":"2026-11-02T21:51:20.582Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/991a459fae064d363809c7e100ee401b728b48f374cd146bfde462729141efcb","error":"authconfigs.authorino.kuadrant.io \"991a459fae064d363809c7e100ee401b728b48f374cd146bfde462729141efcb\" not found"}
{"level":"error","ts":"2026-11-02T21:51:20.637Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/5e8cfeb7c3f3d8b6237daf4c71a37dd6c0e47821cedb4cff5a754d897659746f","error":"authconfigs.authorino.kuadrant.io \"5e8cfeb7c3f3d8b6237daf4c71a37dd6c0e47821cedb4cff5a754d897659746f\" not found"}
{"level":"error","ts":"2026-11-02T21:51:20.691Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/d61487f245736652388bdeab82bb0d1d4cd5107426b84f9b979fd65fa3c9b2a9","error":"authconfigs.authorino.kuadrant.io \"d61487f245736652388bdeab82bb0d1d4cd5107426b84f9b979fd65fa3c9b2a9\" not found"}
{"level":"error","ts":"2026-11-02T21:51:20.745Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/6ed2258cb027fdb7f4ec00145ce85863552cb64aed475789684275c31242a1b7","error":"authconfigs.authorino.kuadrant.io \"6ed2258cb027fdb7f4ec00145ce85863552cb64aed475789684275c31242a1b7\" not found"}
{"level":"error","ts":"2026-11-02T21:51:20.800Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/23f05c343b6591aebe44cca086e2a124f75fca58bb3aa26143e5851d42fbe1c9","error":"authconfigs.authorino.kuadrant.io \"23f05c343b6591aebe44cca086e2a124f75fca58bb3aa26143e5851d42fbe1c9\" not found"}
{"level":"error","ts":"2026-11-02T21:51:20.899Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to delete envoyfilter object","gateway":"openshift-ingress/e2e-praxis-a-8e90da","envoyfilter":"openshift-ingress/kuadrant-e2e-praxis-a-8e90da","error":"envoyfilters.networking.istio.io \"kuadrant-e2e-praxis-a-8e90da\" not found"}
{"level":"error","ts":"2026-11-02T21:51:21.273Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-worker-w0-0c9014","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T21:21:39Z","generation":11,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"ddb57683-c2b1-4246-8c87-c1833e256a52\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:50:52Z"}],"name":"kuadrant-e2e-worker-w0-0c9014","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-worker-w0-0c9014","uid":"ddb57683-c2b1-4246-8c87-c1833e256a52"}],"resourceVersion":"75681","uid":"3a59a593-1a36-4e21-9529-ff8f3620d431"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"86115b8156c50eab2036378ac37ec53b33537f0eef44a4aa5d81752c24254c82\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"c69d9902b654dc255ef5aa6007c01753aa727fc097ae6b83d952cc0cf913761b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bdc9387e460a2dc1a85bc42d8ce6440788e8331159ace91b443c9628ef7c1fed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__dff531b6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"076b3968095c1cf2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__dff531b6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"076b3968095c1cf2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"2f68643a3c63d5b17fdfef48d85bd91a0973501f0d563a896e4b380a0b00d185\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e1cab00a309f6035001c6bed21b280b9cd6d81b83072c8f351fbe860f69886ad\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"d886729ca10572769b8b41e68ee56fb12942ea073f0b48ede22b1cc50bfcc40f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fe65e47ea66e64f823a934786806a737bfe3ca692bad4019774d91daeb2348d1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"e10af8f1a2640cf1de04932f79e79764db98097340db6ec566b3ab0af709d0d8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"86115b8156c50eab2036378ac37ec53b33537f0eef44a4aa5d81752c24254c82\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"34720a2e4d6ed7817a277e99c8b6c63bea050141799be3b70b3690e8575a06a6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bdc9387e460a2dc1a85bc42d8ce6440788e8331159ace91b443c9628ef7c1fed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__dff531b6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"076b3968095c1cf2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__dff531b6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"076b3968095c1cf2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"3a712e9256a22351eb20be5c7695beb1ebb8fb8ce2b2061a380c7829f310a235\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e1cab00a309f6035001c6bed21b280b9cd6d81b83072c8f351fbe860f69886ad\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"24d4dc5eb03a2701700ed1da77fab5dada30f4d5f19acc2aeb784ab7c2913842\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fe65e47ea66e64f823a934786806a737bfe3ca692bad4019774d91daeb2348d1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"95b56d1eb3f5f986a8dcd4728f616565f9664996c1a434f44f7b87c3972457ca\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"86115b8156c50eab2036378ac37ec53b33537f0eef44a4aa5d81752c24254c82\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"f831f6710914a69194c3f7c48e2651f7e183a1e62afcb27c73307245ab045f93\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bdc9387e460a2dc1a85bc42d8ce6440788e8331159ace91b443c9628ef7c1fed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__dff531b6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"076b3968095c1cf2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__dff531b6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"076b3968095c1cf2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"ad3a2d8079306ff1eeb9734837c5b71f0724eb8028848f90dbf05b80557a363c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e1cab00a309f6035001c6bed21b280b9cd6d81b83072c8f351fbe860f69886ad\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"44114992b7dce232405acd1cfada4b72839265de04c15b8c8b12cba013144276\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fe65e47ea66e64f823a934786806a737bfe3ca692bad4019774d91daeb2348d1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"a594b6f1c0a2b22e4714c27e98575eda080192ee3760bdfca9b4ad6aa516eee0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"86115b8156c50eab2036378ac37ec53b33537f0eef44a4aa5d81752c24254c82\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"de21a6b7dab6f53ab9e521b41625d35020e107d76ddb50e2958e0e2a412d9e40\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bdc9387e460a2dc1a85bc42d8ce6440788e8331159ace91b443c9628ef7c1fed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__dff531b6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"076b3968095c1cf2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__dff531b6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"076b3968095c1cf2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"9d9413f8be4dfb8834299266127fb239516760f378a7601605194b5533f62a28\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e1cab00a309f6035001c6bed21b280b9cd6d81b83072c8f351fbe860f69886ad\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"b608ac3153414f90d7bc1d459d441fc96968144e3d07d2286f28927e15b1e621\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fe65e47ea66e64f823a934786806a737bfe3ca692bad4019774d91daeb2348d1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"31897c718cc142df0d5d16918dfaf37807fffedaa54950878ada2e28c78ed1ea\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"86115b8156c50eab2036378ac37ec53b33537f0eef44a4aa5d81752c24254c82\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"0f90af4971cd47ea5ddd60d45eba18a900b5cf23592a3f0ecd9d46778e3738e0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bdc9387e460a2dc1a85bc42d8ce6440788e8331159ace91b443c9628ef7c1fed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__dff531b6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"076b3968095c1cf2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__dff531b6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"076b3968095c1cf2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"93ac09aaab9c4f036a2bdd254b8b96a4151063abefd4189c40778e53ebecdc09\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e1cab00a309f6035001c6bed21b280b9cd6d81b83072c8f351fbe860f69886ad\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"8791484f6beb20141c5c557cf7cec8b4649b67a98f43b54539a6ee6a88bceb5f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fe65e47ea66e64f823a934786806a737bfe3ca692bad4019774d91daeb2348d1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"5009bcd6ede0ee206f1c68b91ea406216f5da58a2b1c5f056ba6778c5f13d641\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"86115b8156c50eab2036378ac37ec53b33537f0eef44a4aa5d81752c24254c82\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"140e618f0bcaa91b635c87d4f29e5f8813bf0436d1f6e9b36373faecbdec61eb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"86115b8156c50eab2036378ac37ec53b33537f0eef44a4aa5d81752c24254c82\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"6acbaeb49e85ee3cb000f040214618990342fd0a59de5b2c5a1f90647758a246\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bdc9387e460a2dc1a85bc42d8ce6440788e8331159ace91b443c9628ef7c1fed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__dff531b6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"076b3968095c1cf2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__dff531b6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"076b3968095c1cf2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"5b6e6a7f7dc5f0d34eb857ca49303262b3c223fe67458805f41c060248c5dbfe\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bdc9387e460a2dc1a85bc42d8ce6440788e8331159ace91b443c9628ef7c1fed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__dff531b6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"076b3968095c1cf2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__dff531b6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"076b3968095c1cf2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"2127668fa8fef2292ac1484bc4a37390a4f7d56256dc3e5dbee6c3e5a11a9b76\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e1cab00a309f6035001c6bed21b280b9cd6d81b83072c8f351fbe860f69886ad\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"0aa314d93ee3acda2c2d9263c7d5271f8931007a465cca802fa4f97f82de8fea\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e1cab00a309f6035001c6bed21b280b9cd6d81b83072c8f351fbe860f69886ad\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"cb70a8e00aa575e704bd5c438dfcc5d7f8961efe6033fd93fae3fc6eca018120\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fe65e47ea66e64f823a934786806a737bfe3ca692bad4019774d91daeb2348d1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"1acbce7018705c04168bda5187e037e60c0fe47f186f10f96e84266e33b5b034\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fe65e47ea66e64f823a934786806a737bfe3ca692bad4019774d91daeb2348d1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"52baf0b74be4e68628b5b4ef71a9d95dad1cf739658ce467c9b24c3165eac562\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"86115b8156c50eab2036378ac37ec53b33537f0eef44a4aa5d81752c24254c82\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"a9b1a49056b3283c82e0d4f88ad61bed5b6f4b736a70f1bb2ef4ba19a80a05e0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bdc9387e460a2dc1a85bc42d8ce6440788e8331159ace91b443c9628ef7c1fed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__dff531b6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"076b3968095c1cf2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__dff531b6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"076b3968095c1cf2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"30c85ca7419d0f9a695b73530b16cb571b50e9dde62c1210e8c4fe44c14e4def\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e1cab00a309f6035001c6bed21b280b9cd6d81b83072c8f351fbe860f69886ad\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"5a52f00c07e5813093290d1bee011f0120610619cb82666a79b0139919644d6e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fe65e47ea66e64f823a934786806a737bfe3ca692bad4019774d91daeb2348d1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"309ad48f4f9314f702e5565256eb6d81567787f6737820f7ffb21a6d85a92b93\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"00c4d48b9f06a2f5dbb9cbe22ae3dcc9e10401b038e62058849dcebe2769e4f1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-0c9014\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-0c9014\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"02e0339b7fefd72794f04b407e26149d4822a36b0c408bf1129e0f7ccdc0cfdb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"884ebceaf8f5da21059151f97834277770ed77023feb57f83fc8c75e495f8d1c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"bb55cf856b87c0953ba4478213144ef02787b3cbbf80cc32e530521407ee40b0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7da280ddad70ebcc1b84b8a595244d0682cd0302755439371683331c4562cfe5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"23b1ef8cd3219264f8227915650891004d0dbf97a799031e0e6e6967fcd5f1c8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fe169ab2014a705a54df2fda4ec719f7132fd6bba54202f7531ce8df8da2bdf6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"5f4fc30622e992160dd04a2ed38f7e44c1794374d6682ae9f1f7ca01be3ee831\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8cb0b0d9cbe25e4182aea7d2ed6f3ca636a7d0c9be364f722b182dde26da45e1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__dff531b6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"076b3968095c1cf2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__dff531b6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"076b3968095c1cf2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"ca6fe2da7884bdf4da7e4fad467882fb9f7b1a542ef29da25c93b58c0a2facf5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5f8a52baf63f9e4c9ea31b6e22c9076262e33bc06968bbcb213439af05ae3a21\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"4e45e802c43f08adeba0b390be3827705a757991fe469c439db480762890906f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9a7eea6dc0fbfacc7f1b1980a90d1b04de88692dd5758d6a6457477b77a64673\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"0657b3667bafd18f07dc410bc515b76f51256e8c487baf4fe36409a313e6191e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ece9796b491eeaad9788ab6c426bb54d8cbb85433a9010ef2c4d3f579cca0db0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"5b95fd1a3cba680d3078cbfcc3ed349106804d68df9ff279d7829f1ce54c9fcb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3d645f3ac772a0cc5a9a71b4e6a542a2b2ab9962190903cb5d89d3e8e45b7f9d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"d61768c90b21a96135005ba91b0f0abbf7ffc2bd4f372c506a740a4d2280118a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bcf1ddf402fe28df1f45e616a2e2380b51177c45a7f8dcdd03bc2aa6b5814d26\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"0d7aee7ae66dd59feb746b56375d3063a0a395dd032211e5f6fd8a79acc4c534\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4cc208f8f31098b1cdf91b5776a85b52bae0339e659b20995e8ad11208703993\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__dff531b6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"076b3968095c1cf2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__dff531b6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"076b3968095c1cf2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"d480cd881add8aa6a454eefd0ff4a4f1883e0f31dd0af2c4fc8d49930dfd988a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"096fbc9d544918ac5b9d60464268ef3b1f03546e96ed130c743da74445576f52\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"862991ab77df3e7a553882c71a94c90c8006da4badbb5d62b2523a0c2ae8397b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"228ec96802a09009d984b3728e4e96175fefb32ba2e3b918071e85b3f8ec79d0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"1174da5781e0d01a3f99ec7d577f0c792e9d2f3d97450b0297d625c782aae7c6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6d14c0784badaddad1e95c3697462cedd1c5a5cf32d3a98f16155abc0721429e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"c6601f905085efd63830b0439c759fd2e17f4b3a0625b37e6ca853dfb418a3fe\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"669fd13dfb6f84f6e255bbee071a63253e1d5bd80a372cb6a445299b3c53a1a6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__dff531b6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"076b3968095c1cf2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__dff531b6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"076b3968095c1cf2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"aae79ba1b6eabe4b8be62d566c21c48755697af6a5a955ca0108115f218409f6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b0bfe3b1d3a080ff25e482046cf0d1df0ca30a090ef9f8424787467410af7627\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"cfedc7f35c0353d53fec0474975ad5e05c19ec8b2ac4718a77f59ccd7fb1233c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b0476fc7cd4ea3306c893f375fa8b815ad5c84676dd8000109732b76fc6c9e7d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__dff531b6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"076b3968095c1cf2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__dff531b6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"076b3968095c1cf2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"2fc0502446287f4669be2a416f781c0acba21256ff9eb15861862053f18d0e29\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4dcc64ddad4ef375730fe33c8b8925944bf0c1750f66d8a3347219a51dd190d3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"fe7515ad4af2d0fbe432bcf9bb564a76c332dd67819f108c4e0ccd547ada4eb1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a24eea90cd520665ff61391c71ddaf8965158b1b42c4e6f9fe99dd03dfa7c401\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"2036d4e41537afdd08f850cbe0bbe0d23c83b572c0c1f917f2cd718904dfce6d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1cd65b24c576b1e8f7a954fffca2225dfb109bf5a068107003d4f72206723e55\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"909bedc4bbf04ca094fb3d369cf7cb3b15d83ab3e98ef27c04ee79b787659c95\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"be088898c71049f4ea232cae6dd479dfab1a9947fba6b17e7353ce14e639507c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"cfc0c9b5c46987f78f689a5a334275694f4c03653d50c2fbe6e969e238c7f8cb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"03e9bc99c98697160f9a6db2252bc0ba9e88e4ed113a3d5d851256f6cee3dcab\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"642d89c776f69505ff2a885b3a3e0374200ad36c578ca4799ed899b1dc0cf546\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0e0bbf1b6879cb3f68f7ea7f2afda47c74a88c5d3cb97fdf3e110cdc54718649\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__dff531b6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"076b3968095c1cf2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__dff531b6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"076b3968095c1cf2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"f05bad08945108f9026112e207cee46af50e92faf4445f0e991b27b9412c4c58\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ad6b1369f6065e5d01605f83113ef1c7c93ed4b3fa8d01ad81d870c4a418f675\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"9eb0cbcb37fa43674c71b90f27589d7260b93ced662c1ceb0efe4cb1f91dab4c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4b932ff2b149c42a260b63c5bdd2b0515a398d1964de7381e0735756ee620b8e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__dff531b6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"076b3968095c1cf2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__dff531b6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"076b3968095c1cf2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"6fbda76757cae53d56b898432e232fb51847f0a1452503c1d53bf530847020ed\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a8ba5320fff14c281f32c2b0a9e757f0e205aace00c294b0d13fa46185724d35\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"8d788326bd35d2b328ba885da80b8eac2f0f1f55930d0bd275aa0c5fd637e227\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0ad1aa31e975e4b569a9617aed9c37982646578e71674b0d96896f60dc232a90\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"c8ee3691fdd0cb6a376274ca4ee98e52cb5718f985d4f539fb764ae6116296f6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0be4b31b8961f89b18ef02b2a56a0b76e7cb0d94a4440a467414ac2d9a504010\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"235df022eefeafa48d660af3720c4cb0c0fec34ddef36d3c467db88f9a57b07f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"69645d92530f5991fb0c1154aa418715dafc9eb9b4b827c33aa742687b00c4fc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"b449a8480f629d5de320a05efeec5a558221dbb03b4dac7572367202e5ec4e3a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"96d049688a520cd26e12f2232f544b815eac1611ab00713e2f641e57b40e5f84\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"bc1544ecfcc1a9c24b532fcd9001124011a4a99e354877a6f611310592c512dc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fbfa7264341556b62c34307c6c836c7e015aeca2df10913c89f8c2d9d38fd28d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__dff531b6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"076b3968095c1cf2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__dff531b6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"076b3968095c1cf2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"787567c7ebc18db7ec0598b9dbf1466caebf9a1d07f97cfb4afbc3f8bc3fd0e4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"03938d68f68953b697b7b9ec3a9bb3205251dab0d8c28c8488a51872990c74d6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"0d7a95a011dd25d93bb4476331e0b43d38df072b07b758073c5e89ae27e7c6e3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea4599ace477623ac871dedf5650245e6a589cd60cb7c50944431b6bd5453ebc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"06aff6eabb02cda098099e156015c1b3f2389b929e7df774b34188d1589de73e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"463f896d9e9b5a3f2518e764053718a018fbe93828587f90cc4250e5a67a2236\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"88eb8224ce85abcb39e51aee14e03c01d32d86bc4f686e66279e969a1413d263\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d2e0eee1c8e9f13da0b4cd4af8a834f482ac80e1620cc44747922a7c61d6a51b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__dff531b6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"076b3968095c1cf2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__dff531b6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"076b3968095c1cf2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"203a868aa43281568c0e425caebe830e36d9bb16cabaf6e7dd92722711d4e496\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0dcf2663d1fa4c3fb5056f3703d9d1a316345e3f4ea0e2503f77738258a9e6a2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"c4e555c424bbb24fa529375505443d3163dbb2379b150d3ae00c6689e4123fae\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"29a6e78291fb6eb1600fcc523c35316897713ec3a1f3092074998de0701a2bff\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__dff531b6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"076b3968095c1cf2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__dff531b6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"076b3968095c1cf2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"220018b07e05f37b279946d5b903a8c5295a21774b20d317b40db4ae44ab089f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea78fba3abdfbae2cfbad8389b4c97d45d924dfb8eebd29422ca7a2b62f9564f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"86fdf51aa1b29a978535560d7a45ad778e5802bfe467d27e1295c743248d1507\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"dcddce6770eda2db3f8f60d8b51b5ed927194e11c56d328f35000b6f5e92dbdf\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"df9a2fd989201e2d0ef8377583b501f9afac6836df894071bbae9e6b6b2598f4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b8e8a49e358e54b12e2aba59e563ba17bcf32315bebde13a721f3b7ebfae18ba\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"742ed2fd7d94f5d252aeaa965657e054bac8691ea31b81375ab8a5488c2f2888\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"327ad026e5a9c61ed15c52c9e2fb0c219e4d9a636a17ed736f525f2b42ebfd6d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__dff531b6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"076b3968095c1cf2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__dff531b6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"076b3968095c1cf2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"8b45807e9f971b175f77e49aa0f5e281c0245f33f6942f95c36aedfd7d419199\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"59093ab44195ceb3a72fd7400b422644d3d7c840cd3e838bafbbcf827cbcc073\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-0c9014\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-0c9014\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"bde801ad48bcba39a3cf88516077f8fad94dd2ce0692d0f274ab650cb9cc6614\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fbf5e5a312486cd624620a8628b976f89d3b75ffa1d3e47224c08e003294432f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-0c9014\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-0c9014\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"047906c5f7db776a9bd905e481a3347b0c84bd6edf626dc5626ed91115c7408a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cbaea0f78f7b655ed1c234a9fbf7020e12e29bee546d39c314b814aa1692620f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-0c9014\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-0c9014\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"1e414f5eaffdbc43cdaeda8552267e2b46abc1a6b41adfdb24735f3843a9c51f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2ab986aa56245948b966f417e9db684ac2bae70862e05b68a996c57de4d7c4c9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-0c9014\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-0c9014\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"3f61be5c1cb2e788fb6ec123b23519795a5d4fa05fbf9eb842b61931843e1834\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"83f9aef31a325eccb5ee1ca5935289e892a53f7f9d05ac2a6d2b8a973624d6db\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-0c9014\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-0c9014\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"ead8e640f12ec2a2a5b9632dbacd377499d067469c52a5e5c7791f29393639d3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"93867ab0bab47561de7ff57c3a2f54a4e134cfb5a3ee35d78ee703589d669077\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"760f6f0b0f0dfc05ff96616a7ebd6878ae6a8e384823348a74bc46e7ee6e70ab\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"06c24ca69f585351676e3a47fdf7a96df9b9a8fe85641e1c3348c8cfdfe446cb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__dff531b6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"076b3968095c1cf2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__dff531b6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"076b3968095c1cf2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"2089b2caaee71efefb7e26192d15a3376881340fd07cbc304d192587b50b0c07\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f713c09235fdc689702761ce6f8fb3c2c03ea75f66382e5121160a24cf7aee9d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"78522ace7509d509793c07978801f1f4bab7d64f1ad59df33af972c953cd6851\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6b6f55f762b51c1f46156308a7f509359377c543fd3789f104b3416ff46e3216\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"06aab5232bb89b6e09b9780286eb3fceeee4557f3ea4efd5ede8278ad6c21170\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-worker-w0-0c9014"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-worker-w0-0c9014\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:51:21.685Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-worker-w3-f51151","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T21:21:31Z","generation":14,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"8871137c-7f6a-401d-a6db-2983aea5ba22\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:50:52Z"}],"name":"kuadrant-e2e-worker-w3-f51151","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-worker-w3-f51151","uid":"8871137c-7f6a-401d-a6db-2983aea5ba22"}],"resourceVersion":"75697","uid":"c24c0550-6758-4dca-8d2b-3fe32740d122"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a05d7e315cc7cde173ab18a777672d3a18ce0a96f8f52d505404dcf8d1e51c20\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"57daad42fe0b41b0\\\" || auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"57daad42fe0b41b0\\\" || auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"0e7c31c41adb0d3f9efc929ae631573fe0c783a2fa7edb7a4b135081c2969bbf\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6c73e108ce3d5ef8ece11651aca73aa00bd88530b6aba861d23ca7b6ff89ba5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"aedbd7ef0308fd9494e9a3a1386b732923d5d060acf5a188601898d4867d320f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7b56d8e34a0de188e49dc0ae60057e421eb8bc4643546e49b2fe810120869498\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"b6389ab82133347e2514a4ad1cbd9d34042edc9a4ad044714155dbb2aecf38d4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a942d85d233c0e2e8932f598b5b8c9b97eda0ae826b5a80a742559b36fa56979\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"85e7f37f931469abe1b396a1a44b52a8b72e6a4dc98ed0ebdd61e43f0486de13\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a05d7e315cc7cde173ab18a777672d3a18ce0a96f8f52d505404dcf8d1e51c20\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"57daad42fe0b41b0\\\" || auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"57daad42fe0b41b0\\\" || auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"ec8a1b6bbf984a67cda63e2d923bfa9d2d66a7537f676f6198c12cbca9103517\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6c73e108ce3d5ef8ece11651aca73aa00bd88530b6aba861d23ca7b6ff89ba5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"5c9b9ac2bc33c747eb54045ee2511e3c8b2ee9737a3f347afb75903f43d74fb7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7b56d8e34a0de188e49dc0ae60057e421eb8bc4643546e49b2fe810120869498\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"f82b9432930517e02d229f4fdbdd8b6700b061d5d333fe35b064a3bb85f58e76\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a942d85d233c0e2e8932f598b5b8c9b97eda0ae826b5a80a742559b36fa56979\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"6d321a24ed09abad642dee549f0c7cbf98ce40481beb85ca79bd3d4eeb89b77e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a05d7e315cc7cde173ab18a777672d3a18ce0a96f8f52d505404dcf8d1e51c20\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"57daad42fe0b41b0\\\" || auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"57daad42fe0b41b0\\\" || auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"a54bd689e670e5f8bbee0a66c2585a4d4adce9a5a7fc297449ee3b816a0c2695\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6c73e108ce3d5ef8ece11651aca73aa00bd88530b6aba861d23ca7b6ff89ba5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"ad845c31a125851bf4cc5ae7e83bb4a011cf98484d99780ab16df250ca9dd41c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7b56d8e34a0de188e49dc0ae60057e421eb8bc4643546e49b2fe810120869498\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"9eefe22cd9d7f4d324cc07e6422d998261fea96e9069bc938fe66a94e8c8cadb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a942d85d233c0e2e8932f598b5b8c9b97eda0ae826b5a80a742559b36fa56979\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"b00ec38cf5be980b160374be347b182afaa16e0dc99314a5e990f20cef6d57ed\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a05d7e315cc7cde173ab18a777672d3a18ce0a96f8f52d505404dcf8d1e51c20\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"57daad42fe0b41b0\\\" || auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"57daad42fe0b41b0\\\" || auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"6d5d9aca320022f0f8b70c3f9b34b5922adf537f5da717ec79924566febf6df1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6c73e108ce3d5ef8ece11651aca73aa00bd88530b6aba861d23ca7b6ff89ba5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"346e75cab49a1cf8ae89d90cfb32099256f44d7909e40cdc730e951946a411e2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7b56d8e34a0de188e49dc0ae60057e421eb8bc4643546e49b2fe810120869498\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"ae0a4172fa23a6e8857123675126f34bcaf4e08f94c05663e2913801fda46401\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a942d85d233c0e2e8932f598b5b8c9b97eda0ae826b5a80a742559b36fa56979\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"ee0931c3dc206732c58bab1add9bf2cb602a2eb21bfa9272c2df596197dceb3e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a05d7e315cc7cde173ab18a777672d3a18ce0a96f8f52d505404dcf8d1e51c20\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"57daad42fe0b41b0\\\" || auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"57daad42fe0b41b0\\\" || auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"3f6b6643d5731a355a44968b83b24169ff3e0c1b36737d8be7f9d42e1def7c3e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6c73e108ce3d5ef8ece11651aca73aa00bd88530b6aba861d23ca7b6ff89ba5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"cd8ab5f89e71494c8d176f9668b8ed279bd244e6f70d1a5c87603877b4b7182d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7b56d8e34a0de188e49dc0ae60057e421eb8bc4643546e49b2fe810120869498\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"09df06c068a0d1324c44679ca0c022e74cd18bae1497d0087fb2184f9401d63b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a942d85d233c0e2e8932f598b5b8c9b97eda0ae826b5a80a742559b36fa56979\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"821121f5584e938a01b323996203984576204f894f2c9f09f5ececcdc058373e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a05d7e315cc7cde173ab18a777672d3a18ce0a96f8f52d505404dcf8d1e51c20\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"57daad42fe0b41b0\\\" || auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"57daad42fe0b41b0\\\" || auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"e00f3dfbbce60a718137b415a42cbf1e65a7b226437cc4600d9fa76b264e3b4d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a05d7e315cc7cde173ab18a777672d3a18ce0a96f8f52d505404dcf8d1e51c20\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"57daad42fe0b41b0\\\" || auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"57daad42fe0b41b0\\\" || auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"7ddf0d6bdcfc6aa206cdc0919b1d5b7545c903aafbb0e16d393016b1a83bd29a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6c73e108ce3d5ef8ece11651aca73aa00bd88530b6aba861d23ca7b6ff89ba5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"fe3b37fdd5d3f9d3bdf7d03b186d964b283bfbe7d3ffa720457517666c3070a2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6c73e108ce3d5ef8ece11651aca73aa00bd88530b6aba861d23ca7b6ff89ba5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"7dd9491b4755b4900c5bc55b4dd9aff38f99899f0236e4d21bf7c94e5769cbb1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7b56d8e34a0de188e49dc0ae60057e421eb8bc4643546e49b2fe810120869498\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"fa5430186b33e56d19e4d2e0209b4f2215d17b488745cd8061eb5ecaf96ecafa\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7b56d8e34a0de188e49dc0ae60057e421eb8bc4643546e49b2fe810120869498\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"cd88af3d71345ad9b32dfae02550fa9bf6aa0cddfac2d0464a60cd90b9898d74\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a942d85d233c0e2e8932f598b5b8c9b97eda0ae826b5a80a742559b36fa56979\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"2182ac070ac99ffbeb246624e36aa202ce8c626bd38aaa3191f5e60a408bc782\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a942d85d233c0e2e8932f598b5b8c9b97eda0ae826b5a80a742559b36fa56979\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"97e41dd7c810563f2cac2a1c963d220c840d6b756c6c76b0cf97113387aab38b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a05d7e315cc7cde173ab18a777672d3a18ce0a96f8f52d505404dcf8d1e51c20\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"57daad42fe0b41b0\\\" || auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"57daad42fe0b41b0\\\" || auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"a00edc25239da061cd0457625d6046ede5f9d09507c78c2209e1e992795831c9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6c73e108ce3d5ef8ece11651aca73aa00bd88530b6aba861d23ca7b6ff89ba5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"fbd557cfa232fb43236e5864400cd1522fbf21d014450df4a714ea2d3608e863\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7b56d8e34a0de188e49dc0ae60057e421eb8bc4643546e49b2fe810120869498\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"f809ccd15563984c9befad8f50ee38613b9c34eda0af01f561e75be88cba33ab\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a942d85d233c0e2e8932f598b5b8c9b97eda0ae826b5a80a742559b36fa56979\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"749b6bc66485455bb3cc5a0d552c38935bb446a6be85e306d894e6cbb4d92c08\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b31ddb7ef02e35e9d172430b50a004a3047564232880010bd3e581bf0dc547f8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"a1ec0f0592798b3996117a17734b0936906621077ceec69c81d8fb77e89a142a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"75a5abd89bb4e6258c7f7c7be472e6131799539dbbb87686c1010afe2791e45e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"3ca8a6339da3e4298e514bea168ac30f6c718d158fa0efc5e0fd85f06754a528\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"72bb4e3923485ca35015ee8655bc43ee332eea77f2cd8effbd48b21828f89f80\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"57daad42fe0b41b0\\\" || auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"57daad42fe0b41b0\\\" || auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"879fe62fbbe8b0a130140cda7f546611c758fb8fa416f173d2b0cf3da17d7941\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ed162da516e04d5229dc1d49e1c785e9db374ba4ba028ecabbdccdcb33acd1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"b43372d2a0820427086903362809a4a0c757cd1d6f593ba48a755e5fb972575d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f9603ac54a5668b179c6ba3dcda3951e57253a5ad5ad80214b563f50337f3a9c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"7caf859dfb9739029a8c1b13adba06164610495beddbda8e01fd7b432b15f4c3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"775fdec32977b769224a6d9530e33a1b93a2948f54e3f459e979da99f7def4ea\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"5cebae68b5e59e34a98c9c038f83d877f079732894ec3403d349e0b7ae0c9099\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6ab1b21b6f75f2c1ef86f9bcf36a6c25244e88430832e3ac86a839cf10bb8dcd\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"57daad42fe0b41b0\\\" || auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"57daad42fe0b41b0\\\" || auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"15ecb8224cf6049c2e831c815cc4f0aed954432b967d01d55ea637294f3ea87e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8b2fbdc0f4b402fd19fb549b70da796c6867a52206fa0420df2d6debc0db70b7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"7cb303fae9824d31834d539772c1840fd2991481566b7d07635c9284c524ae4d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a649343311197c716e0b6f502bb8ad21ecf4e207e16ffc6e0b74b1dc4f05f7fb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"699e8723136e653d04a8800a9289a3543f733ebfd0f99efbedfd18d22de4c281\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a6267fc785126adca5b68df13f95ef1fa08e1d72b66fbff01b54f8d61edaf7ba\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"57daad42fe0b41b0\\\" || auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"57daad42fe0b41b0\\\" || auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"9a72bfcef40a8da2865b02b6123c023d9f4f17c11a2ff674e3ed24af23e468e2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a6d41f4e9f57ec1e6bb4423e49991033d85f00a2a3303e02b25d1eedb67be3c9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"ad4137b1e753fd100088742941c8aaee9eaddc158bbaf221eb0d7318bdb8dfb5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6610d72af8a18be17c09082b4389a248d739315be17e0e146375e82e8d76261d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"66a5afc61110ab52ae4b9c9d79944467f91c4a2bd7b954ed8f59e651c215c630\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aea6441051c6a7490e44d5f7bab0e4bf7cf461c9597675611789e8d9141a446c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"57daad42fe0b41b0\\\" || auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"57daad42fe0b41b0\\\" || auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"c871ffab27f7ed925d56fae005e70fd3716aab799f0484d7d44519e915491d11\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"be7879d2a6daa00da89abfe5895a77787208f1af5b8582c79c8dd2849ef7906c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"461ea56b8a105dbd1d386b531c80b5a86960df99b24b6f6668520921b280a609\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7f4456bc894bf7ab59ba02c25915a8db007a89ffdd1efcace437a7761c68b3f9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"aedfea0f1dceed2b1af07ebf6e7dbc55cdc958ea5a084291f6216a19f63eae8a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f23dfebb92a3f3d59997030cce08899533ec20be47590cd866dd896392db04de\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"f42d6cbc7a49b6c1c4f0668dc536500321a8f658d1ab1a3a8b2ad8c0a95b272c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c57cda59d33d438c637a64dce8619a9616880a275363557ccc83d2cbc4920e14\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"1a3df8e6f6ad36c3eb928970ca2e746005e16b25405fc6eb9f44977b07d56905\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"086314a2fc965880bf769a18d3353909b6a1e5544e7eb514174994ba24387652\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"8e63847006a8d1952318fe3b6d2707027991d1c00d7959d051b3baf72690aecf\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f1def6d908410a124665ecd632ae01e5ba977920643dab1a35d25277292bae55\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"57daad42fe0b41b0\\\" || auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"57daad42fe0b41b0\\\" || auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"1199947fd30f0d1dab3db5846b8d27e36b6284be94834b798e4004120ec52532\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"676709317386301aa762cc48b7aa0064bc03adc00abbddfda8d0294046751d34\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"8a51327014eb82d6df6700b3f79ae6010cc76b2ee750f56ac5cb49c5b6f975ed\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d8557b9861d48e5714a954e0a885ecc7e55e6b9f034fc9f24f4c5c2f6dafce5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"91c8ce1078dc4a26a7cb0af054981aa28b4768dcd87a9a167f98e9b4e4b60325\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d63de28626482cf5fa2aaf12cb9aa3def86d637d4c98f193819331c36fa73b21\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"57daad42fe0b41b0\\\" || auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"57daad42fe0b41b0\\\" || auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"fae01409c891b630fc644ebf1b8bc640438a1fc79de2b0750d34e2a6388d4ca6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f86615df74e8d3814df8817b06dc7578a4b0af0817397c5bdddb1daaaeb1df4e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"2d972852e655bb76327ea47e134854d589cf64538813171d00544a81dc138f4f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ca57331ce8d0c8497c210605ffe8878f757d572164898f4f870b89fcf2f9f1ed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"1ef135f8dcdcaa663d4184fa6364518f7001a744380301035f254e16acdad0b7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"06c1a51758821d18e14577dc995b939fe472579672223b3bf0c1a312b23f23c4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"a90d5652afa4bbc65c24ada88ebb0df97a9c759ab0004d0c85d28f7e4c012bb9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/premium-w3-f51151/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"acbe19c11dc0fe08b370bbe647de6ecce77849e75c774c3e46f4a7af09e2861f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"b1fa0497afe070203ab9c23aef75e896659b83c8305ca7a56664d1717528e732\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7b5f8cd8dfbddc7109fd206805e23a6ae21c18bf406c0001927759ff1a39122f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"57daad42fe0b41b0\\\" || auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"57daad42fe0b41b0\\\" || auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"64238089f4803f45c8353b0d5d05ac6a23d6a3647106591fdc2bd5299c0b0759\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fd143bc18213c3c4682bcced572bcf84c1cbc8cd87ea188e96c990f164fd5ade\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"3ede2f522e381a5e5b8affa5afed6ede7d3894cf263c247dca9b3f3f3ad4a676\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cf25727b6a9419d97ed5dc9613d3b6a26e590c05f01b5c4038461accc96bc026\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"fb213d7be796970427643a4a818af11356ba854b3a0477e3c48bc2ef3332c7d5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cb9167704c77a112808785ad099bc015c57786c61e7befec251b029ce378a0c6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"57daad42fe0b41b0\\\" || auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"57daad42fe0b41b0\\\" || auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"ef8b5b3a53f3de47fd70ccb56be2422e84d7fb1f10a03b64c032baca50a33c79\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9a4beabc5e6770b1db0aae064836730685e70fcacd601193f69aafe8156d41a4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"667e44e20cda74056b10928af7322c52f17d044dda1b5aded34df466201c3e4d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/premium-w3-f51151/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fdd358955bc325dacf4ae3d584d9dfaa236b2605d42014543bcddb868221d0fa\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"0a4335c7c536062bc1f3c4f55fad89ef387858062864c877a3014c384192a4f5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"91d11ef27666b7f1f85063266e00a4add2242586a1e8a4bac5447b3f4ec7925d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"57daad42fe0b41b0\\\" || auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"57daad42fe0b41b0\\\" || auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"26827917812d006281f7f7ba6e53d3573012708364624693432b2cbdd0f434b5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"79bf752ac34000e70b4860b3a87054e1aab2babf35019e7e24d203c82f5f1c70\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"e8683890d73b71f6556b533ec6f92b30804817a025abb3d3c716a89f9b3f85d9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"707f7a9a5bb373d466ca8ba9e6220842edd61bdf74768cdb8760aca4648a21b3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"b90f395e8ebaa67a3ab9ee2a967d88bbf981033415dedacddf2e76a8347bfd39\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/premium-w3-f51151/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a40304ff6b4a0f6c57da3d4a6bcc549a18c94ce2ed3356df2ce4c4621e7d5231\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"ff65bd9a43408c55f0593fcb41763d9030c7823704d875b6050eb2c39b500d75\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ab3c6da9622dba177dfaf10df58f987a09c5bd12e35f73cca3f03ce632140cd4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"9ec2510ba7c20be712eae31e88eb54985eedbb6ce61783804c05db0582107bc2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/premium-w3-f51151/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5d4b7dc290bd7cb2c0c574a9869b31b45107252e6aaf512691b5c665967d6821\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"f6fff5f3b2673f2810cddb2b65518e70b74aad58e6c27ef1faf828a9cdef8c14\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d896bcdf40d08e0bef242ce04aa58467e96c672450af890adda6941c53a574d3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"57daad42fe0b41b0\\\" || auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"57daad42fe0b41b0\\\" || auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"69bd1c4b3e1b36f5d5d62283b221b7026a4e53da339ac7c470f75cb4334435f6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"16bf1b94bcdc2b222ee7ef5dfdb45298f40e57fcf65f862a63a7b2d64b143143\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"ec2b739c69e9a51aedc6a2ee8ed6e7bbcb37f4eff66695b2c6d1bf4950a2ecb3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3fdafb69d9c72b7e3c78e50b30f01adec907957097c6a1e811ceff68d93d7c23\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"a31568314e38d20d12f5921c57463100edd3022d5f9f3c0b36033d9a4dee9193\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e11ba50523ae86c5c06c5b76176154ed9ba57c3ed13fa43133b1ac7249ce345f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"67192e2ead59827b5990f7b4cbc2aece4271402ddcdfaa76f7cf95d2d4552c43\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b6344fa6f672d55d2eb4fbf6449de24a41dbf664f8e9d3c01ecde50e9d46e233\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"3c429336b45d9712bfdb0d99ecd41baa0dde1570067b941b5927e1894931c254\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d1f3365185f5fcfe92899c5f49af1b579baab97128b8afee3eed4350859c3f14\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"2f17c508c987cffd0b45ebd164fcee3ad66819a39900f83fbeda518ccf619183\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"85124e62247f9234752fedfc382ba93d6f839dab53f49c16951446afa3e613aa\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"6d2c4320e5eae8e51596e1c62f1c7494e1c5f9cd5d374e73b3ddae65dd071a92\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"461f0fb3ed9e91195eaa488b65b6f04cb4bff62087edbcf0d4c2186d180ba0ab\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"994b30d96390325263d89c2da7554eadd9d4fd1811371afabaf057df68e19205\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d13670b5b1696edcb191c925fa86dd729eeb7447f2230e160d9cc03e0117604d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"57daad42fe0b41b0\\\" || auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"57daad42fe0b41b0\\\" || auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"f70585dfa8966b9748a8978bfdf51d589a9d85f553359b47bfa09ad8bb266b02\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"18b02d50add3a7c29ec6127eedab648f22d172b48224a97365a7798a612dcd01\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"1e0c9c02fbbf3d69df4286ba8224f5543dfc90c1df5aa687b5b6f1c00dce4d56\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3f0daf8882dbe2b0594c2bb310f151a319cec601c5028d24f0d4557684bfb5f1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"4d8ba792ec63f5d46b5589f993126734f136e3569a1b7639aaea8768dc2c0f57\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a8ad3ccfafcc25ea959dd98788332d9514ad2d762423f3039adff91a3381329f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"b159e4d34dc2a1f6fe05bc0d616c2ebb2d3306defc93bfb6d4035e2f842e1b91\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-worker-w3-f51151"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-worker-w3-f51151\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:51:22.045Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-praxis-a-eabda2-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-praxis-a-eabda2-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:51:22.337Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-praxis-a-eabda2","namespace":"openshift-ingress","uid":"4812c33f-016c-4de8-b682-807639c9a87c","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-praxis-a-eabda2\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:51:22.354Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-praxis-a-8e90da-maas-auth","namespace":"openshift-ingress","error":"authpolicies.kuadrant.io \"e2e-praxis-a-8e90da-maas-auth\" not found"}
{"level":"error","ts":"2026-11-02T21:51:22.558Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-praxis-a-aa8aff-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-praxis-a-aa8aff-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:51:22.631Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w3-f51151","namespace":"e2e-models-e2e-worker-w3-f51151","uid":"e3340067-224a-43ad-8020-ca9e00ead152","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w3-f51151\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:51:22.807Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w0-0c9014","namespace":"e2e-models-e2e-worker-w0-0c9014","uid":"4f647df6-1d5b-433b-b4fc-1279ff1755f7","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w0-0c9014\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:51:23.222Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w0-0c9014","namespace":"e2e-models-e2e-worker-w0-0c9014","uid":"dcb5a0e4-7049-4ddc-91de-e14d55b09789","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w0-0c9014\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:51:23.281Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:51:23.281Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T21:51:23.987Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-praxis-a-8e90da","error":"gateways.gateway.networking.k8s.io \"e2e-praxis-a-8e90da\" not found"}
{"level":"info","ts":"2026-11-02T21:51:33.814Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["EnvoyFilter","TokenRateLimitPolicy","Limitador","AuthPolicy","ConfigMap","AuthConfig","Gateway"],"eventTypes":{"delete":11,"update":10}}
{"level":"info","ts":"2026-11-02T21:51:34.009Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:51:36.536Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:51:36.735Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:51:36.735Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:51:40.379Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:51:40.379Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:51:40.425Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:51:40.435Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:51:40.435Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:51:40.441Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:51:40.625Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T21:51:42.239Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-praxis-a-aa8aff-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-praxis-a-aa8aff-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:51:42.269Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w0-0c9014","namespace":"e2e-models-e2e-worker-w0-0c9014","uid":"4f647df6-1d5b-433b-b4fc-1279ff1755f7","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w0-0c9014\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:51:43.371Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:51:43.371Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T21:51:43.614Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-praxis-b-3c7706","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-praxis-b-3c7706\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:51:44.579Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","Gateway"],"eventTypes":{"create":2,"update":1}}
{"level":"info","ts":"2026-11-02T21:51:49.266Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:51:49.269Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:51:49.334Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:51:49.336Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:51:49.336Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:51:49.425Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"error","ts":"2026-11-02T21:51:49.533Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:51:49.533Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T21:51:50.018Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-worker-w0-0c9014","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T21:21:39Z","generation":12,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"ddb57683-c2b1-4246-8c87-c1833e256a52\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:51:11Z"}],"name":"kuadrant-e2e-worker-w0-0c9014","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-worker-w0-0c9014","uid":"ddb57683-c2b1-4246-8c87-c1833e256a52"}],"resourceVersion":"76258","uid":"3a59a593-1a36-4e21-9529-ff8f3620d431"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"86115b8156c50eab2036378ac37ec53b33537f0eef44a4aa5d81752c24254c82\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"c69d9902b654dc255ef5aa6007c01753aa727fc097ae6b83d952cc0cf913761b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bdc9387e460a2dc1a85bc42d8ce6440788e8331159ace91b443c9628ef7c1fed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"2f68643a3c63d5b17fdfef48d85bd91a0973501f0d563a896e4b380a0b00d185\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e1cab00a309f6035001c6bed21b280b9cd6d81b83072c8f351fbe860f69886ad\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"d886729ca10572769b8b41e68ee56fb12942ea073f0b48ede22b1cc50bfcc40f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fe65e47ea66e64f823a934786806a737bfe3ca692bad4019774d91daeb2348d1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"e10af8f1a2640cf1de04932f79e79764db98097340db6ec566b3ab0af709d0d8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"86115b8156c50eab2036378ac37ec53b33537f0eef44a4aa5d81752c24254c82\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"34720a2e4d6ed7817a277e99c8b6c63bea050141799be3b70b3690e8575a06a6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bdc9387e460a2dc1a85bc42d8ce6440788e8331159ace91b443c9628ef7c1fed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"3a712e9256a22351eb20be5c7695beb1ebb8fb8ce2b2061a380c7829f310a235\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e1cab00a309f6035001c6bed21b280b9cd6d81b83072c8f351fbe860f69886ad\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"24d4dc5eb03a2701700ed1da77fab5dada30f4d5f19acc2aeb784ab7c2913842\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fe65e47ea66e64f823a934786806a737bfe3ca692bad4019774d91daeb2348d1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"95b56d1eb3f5f986a8dcd4728f616565f9664996c1a434f44f7b87c3972457ca\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"86115b8156c50eab2036378ac37ec53b33537f0eef44a4aa5d81752c24254c82\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"f831f6710914a69194c3f7c48e2651f7e183a1e62afcb27c73307245ab045f93\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bdc9387e460a2dc1a85bc42d8ce6440788e8331159ace91b443c9628ef7c1fed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"ad3a2d8079306ff1eeb9734837c5b71f0724eb8028848f90dbf05b80557a363c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e1cab00a309f6035001c6bed21b280b9cd6d81b83072c8f351fbe860f69886ad\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"44114992b7dce232405acd1cfada4b72839265de04c15b8c8b12cba013144276\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fe65e47ea66e64f823a934786806a737bfe3ca692bad4019774d91daeb2348d1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"a594b6f1c0a2b22e4714c27e98575eda080192ee3760bdfca9b4ad6aa516eee0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"86115b8156c50eab2036378ac37ec53b33537f0eef44a4aa5d81752c24254c82\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"de21a6b7dab6f53ab9e521b41625d35020e107d76ddb50e2958e0e2a412d9e40\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bdc9387e460a2dc1a85bc42d8ce6440788e8331159ace91b443c9628ef7c1fed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"9d9413f8be4dfb8834299266127fb239516760f378a7601605194b5533f62a28\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e1cab00a309f6035001c6bed21b280b9cd6d81b83072c8f351fbe860f69886ad\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"b608ac3153414f90d7bc1d459d441fc96968144e3d07d2286f28927e15b1e621\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fe65e47ea66e64f823a934786806a737bfe3ca692bad4019774d91daeb2348d1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"31897c718cc142df0d5d16918dfaf37807fffedaa54950878ada2e28c78ed1ea\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"86115b8156c50eab2036378ac37ec53b33537f0eef44a4aa5d81752c24254c82\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"0f90af4971cd47ea5ddd60d45eba18a900b5cf23592a3f0ecd9d46778e3738e0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bdc9387e460a2dc1a85bc42d8ce6440788e8331159ace91b443c9628ef7c1fed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"93ac09aaab9c4f036a2bdd254b8b96a4151063abefd4189c40778e53ebecdc09\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e1cab00a309f6035001c6bed21b280b9cd6d81b83072c8f351fbe860f69886ad\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"8791484f6beb20141c5c557cf7cec8b4649b67a98f43b54539a6ee6a88bceb5f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fe65e47ea66e64f823a934786806a737bfe3ca692bad4019774d91daeb2348d1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"5009bcd6ede0ee206f1c68b91ea406216f5da58a2b1c5f056ba6778c5f13d641\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"86115b8156c50eab2036378ac37ec53b33537f0eef44a4aa5d81752c24254c82\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"140e618f0bcaa91b635c87d4f29e5f8813bf0436d1f6e9b36373faecbdec61eb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"86115b8156c50eab2036378ac37ec53b33537f0eef44a4aa5d81752c24254c82\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"6acbaeb49e85ee3cb000f040214618990342fd0a59de5b2c5a1f90647758a246\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bdc9387e460a2dc1a85bc42d8ce6440788e8331159ace91b443c9628ef7c1fed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"5b6e6a7f7dc5f0d34eb857ca49303262b3c223fe67458805f41c060248c5dbfe\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bdc9387e460a2dc1a85bc42d8ce6440788e8331159ace91b443c9628ef7c1fed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"2127668fa8fef2292ac1484bc4a37390a4f7d56256dc3e5dbee6c3e5a11a9b76\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e1cab00a309f6035001c6bed21b280b9cd6d81b83072c8f351fbe860f69886ad\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"0aa314d93ee3acda2c2d9263c7d5271f8931007a465cca802fa4f97f82de8fea\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e1cab00a309f6035001c6bed21b280b9cd6d81b83072c8f351fbe860f69886ad\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"cb70a8e00aa575e704bd5c438dfcc5d7f8961efe6033fd93fae3fc6eca018120\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fe65e47ea66e64f823a934786806a737bfe3ca692bad4019774d91daeb2348d1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"1acbce7018705c04168bda5187e037e60c0fe47f186f10f96e84266e33b5b034\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fe65e47ea66e64f823a934786806a737bfe3ca692bad4019774d91daeb2348d1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"52baf0b74be4e68628b5b4ef71a9d95dad1cf739658ce467c9b24c3165eac562\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"86115b8156c50eab2036378ac37ec53b33537f0eef44a4aa5d81752c24254c82\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"a9b1a49056b3283c82e0d4f88ad61bed5b6f4b736a70f1bb2ef4ba19a80a05e0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bdc9387e460a2dc1a85bc42d8ce6440788e8331159ace91b443c9628ef7c1fed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"30c85ca7419d0f9a695b73530b16cb571b50e9dde62c1210e8c4fe44c14e4def\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e1cab00a309f6035001c6bed21b280b9cd6d81b83072c8f351fbe860f69886ad\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"5a52f00c07e5813093290d1bee011f0120610619cb82666a79b0139919644d6e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fe65e47ea66e64f823a934786806a737bfe3ca692bad4019774d91daeb2348d1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"309ad48f4f9314f702e5565256eb6d81567787f6737820f7ffb21a6d85a92b93\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"00c4d48b9f06a2f5dbb9cbe22ae3dcc9e10401b038e62058849dcebe2769e4f1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-0c9014\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-0c9014\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"02e0339b7fefd72794f04b407e26149d4822a36b0c408bf1129e0f7ccdc0cfdb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"884ebceaf8f5da21059151f97834277770ed77023feb57f83fc8c75e495f8d1c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"bb55cf856b87c0953ba4478213144ef02787b3cbbf80cc32e530521407ee40b0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7da280ddad70ebcc1b84b8a595244d0682cd0302755439371683331c4562cfe5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"23b1ef8cd3219264f8227915650891004d0dbf97a799031e0e6e6967fcd5f1c8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fe169ab2014a705a54df2fda4ec719f7132fd6bba54202f7531ce8df8da2bdf6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"5f4fc30622e992160dd04a2ed38f7e44c1794374d6682ae9f1f7ca01be3ee831\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8cb0b0d9cbe25e4182aea7d2ed6f3ca636a7d0c9be364f722b182dde26da45e1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"ca6fe2da7884bdf4da7e4fad467882fb9f7b1a542ef29da25c93b58c0a2facf5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5f8a52baf63f9e4c9ea31b6e22c9076262e33bc06968bbcb213439af05ae3a21\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"4e45e802c43f08adeba0b390be3827705a757991fe469c439db480762890906f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9a7eea6dc0fbfacc7f1b1980a90d1b04de88692dd5758d6a6457477b77a64673\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"0657b3667bafd18f07dc410bc515b76f51256e8c487baf4fe36409a313e6191e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ece9796b491eeaad9788ab6c426bb54d8cbb85433a9010ef2c4d3f579cca0db0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"5b95fd1a3cba680d3078cbfcc3ed349106804d68df9ff279d7829f1ce54c9fcb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3d645f3ac772a0cc5a9a71b4e6a542a2b2ab9962190903cb5d89d3e8e45b7f9d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"d61768c90b21a96135005ba91b0f0abbf7ffc2bd4f372c506a740a4d2280118a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bcf1ddf402fe28df1f45e616a2e2380b51177c45a7f8dcdd03bc2aa6b5814d26\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"0d7aee7ae66dd59feb746b56375d3063a0a395dd032211e5f6fd8a79acc4c534\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4cc208f8f31098b1cdf91b5776a85b52bae0339e659b20995e8ad11208703993\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"d480cd881add8aa6a454eefd0ff4a4f1883e0f31dd0af2c4fc8d49930dfd988a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"096fbc9d544918ac5b9d60464268ef3b1f03546e96ed130c743da74445576f52\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"862991ab77df3e7a553882c71a94c90c8006da4badbb5d62b2523a0c2ae8397b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"228ec96802a09009d984b3728e4e96175fefb32ba2e3b918071e85b3f8ec79d0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"1174da5781e0d01a3f99ec7d577f0c792e9d2f3d97450b0297d625c782aae7c6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6d14c0784badaddad1e95c3697462cedd1c5a5cf32d3a98f16155abc0721429e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"c6601f905085efd63830b0439c759fd2e17f4b3a0625b37e6ca853dfb418a3fe\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"669fd13dfb6f84f6e255bbee071a63253e1d5bd80a372cb6a445299b3c53a1a6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"aae79ba1b6eabe4b8be62d566c21c48755697af6a5a955ca0108115f218409f6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b0bfe3b1d3a080ff25e482046cf0d1df0ca30a090ef9f8424787467410af7627\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"cfedc7f35c0353d53fec0474975ad5e05c19ec8b2ac4718a77f59ccd7fb1233c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b0476fc7cd4ea3306c893f375fa8b815ad5c84676dd8000109732b76fc6c9e7d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"2fc0502446287f4669be2a416f781c0acba21256ff9eb15861862053f18d0e29\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4dcc64ddad4ef375730fe33c8b8925944bf0c1750f66d8a3347219a51dd190d3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"fe7515ad4af2d0fbe432bcf9bb564a76c332dd67819f108c4e0ccd547ada4eb1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a24eea90cd520665ff61391c71ddaf8965158b1b42c4e6f9fe99dd03dfa7c401\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"2036d4e41537afdd08f850cbe0bbe0d23c83b572c0c1f917f2cd718904dfce6d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1cd65b24c576b1e8f7a954fffca2225dfb109bf5a068107003d4f72206723e55\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"909bedc4bbf04ca094fb3d369cf7cb3b15d83ab3e98ef27c04ee79b787659c95\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"be088898c71049f4ea232cae6dd479dfab1a9947fba6b17e7353ce14e639507c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"cfc0c9b5c46987f78f689a5a334275694f4c03653d50c2fbe6e969e238c7f8cb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"03e9bc99c98697160f9a6db2252bc0ba9e88e4ed113a3d5d851256f6cee3dcab\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"642d89c776f69505ff2a885b3a3e0374200ad36c578ca4799ed899b1dc0cf546\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0e0bbf1b6879cb3f68f7ea7f2afda47c74a88c5d3cb97fdf3e110cdc54718649\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"f05bad08945108f9026112e207cee46af50e92faf4445f0e991b27b9412c4c58\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ad6b1369f6065e5d01605f83113ef1c7c93ed4b3fa8d01ad81d870c4a418f675\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"9eb0cbcb37fa43674c71b90f27589d7260b93ced662c1ceb0efe4cb1f91dab4c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4b932ff2b149c42a260b63c5bdd2b0515a398d1964de7381e0735756ee620b8e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"6fbda76757cae53d56b898432e232fb51847f0a1452503c1d53bf530847020ed\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a8ba5320fff14c281f32c2b0a9e757f0e205aace00c294b0d13fa46185724d35\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"8d788326bd35d2b328ba885da80b8eac2f0f1f55930d0bd275aa0c5fd637e227\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0ad1aa31e975e4b569a9617aed9c37982646578e71674b0d96896f60dc232a90\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"c8ee3691fdd0cb6a376274ca4ee98e52cb5718f985d4f539fb764ae6116296f6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0be4b31b8961f89b18ef02b2a56a0b76e7cb0d94a4440a467414ac2d9a504010\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"235df022eefeafa48d660af3720c4cb0c0fec34ddef36d3c467db88f9a57b07f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"69645d92530f5991fb0c1154aa418715dafc9eb9b4b827c33aa742687b00c4fc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"b449a8480f629d5de320a05efeec5a558221dbb03b4dac7572367202e5ec4e3a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"96d049688a520cd26e12f2232f544b815eac1611ab00713e2f641e57b40e5f84\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"bc1544ecfcc1a9c24b532fcd9001124011a4a99e354877a6f611310592c512dc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fbfa7264341556b62c34307c6c836c7e015aeca2df10913c89f8c2d9d38fd28d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"787567c7ebc18db7ec0598b9dbf1466caebf9a1d07f97cfb4afbc3f8bc3fd0e4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"03938d68f68953b697b7b9ec3a9bb3205251dab0d8c28c8488a51872990c74d6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"0d7a95a011dd25d93bb4476331e0b43d38df072b07b758073c5e89ae27e7c6e3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea4599ace477623ac871dedf5650245e6a589cd60cb7c50944431b6bd5453ebc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"06aff6eabb02cda098099e156015c1b3f2389b929e7df774b34188d1589de73e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"463f896d9e9b5a3f2518e764053718a018fbe93828587f90cc4250e5a67a2236\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"88eb8224ce85abcb39e51aee14e03c01d32d86bc4f686e66279e969a1413d263\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d2e0eee1c8e9f13da0b4cd4af8a834f482ac80e1620cc44747922a7c61d6a51b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"203a868aa43281568c0e425caebe830e36d9bb16cabaf6e7dd92722711d4e496\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0dcf2663d1fa4c3fb5056f3703d9d1a316345e3f4ea0e2503f77738258a9e6a2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"c4e555c424bbb24fa529375505443d3163dbb2379b150d3ae00c6689e4123fae\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"29a6e78291fb6eb1600fcc523c35316897713ec3a1f3092074998de0701a2bff\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"220018b07e05f37b279946d5b903a8c5295a21774b20d317b40db4ae44ab089f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea78fba3abdfbae2cfbad8389b4c97d45d924dfb8eebd29422ca7a2b62f9564f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"86fdf51aa1b29a978535560d7a45ad778e5802bfe467d27e1295c743248d1507\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"dcddce6770eda2db3f8f60d8b51b5ed927194e11c56d328f35000b6f5e92dbdf\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"df9a2fd989201e2d0ef8377583b501f9afac6836df894071bbae9e6b6b2598f4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b8e8a49e358e54b12e2aba59e563ba17bcf32315bebde13a721f3b7ebfae18ba\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"742ed2fd7d94f5d252aeaa965657e054bac8691ea31b81375ab8a5488c2f2888\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"327ad026e5a9c61ed15c52c9e2fb0c219e4d9a636a17ed736f525f2b42ebfd6d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"8b45807e9f971b175f77e49aa0f5e281c0245f33f6942f95c36aedfd7d419199\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"59093ab44195ceb3a72fd7400b422644d3d7c840cd3e838bafbbcf827cbcc073\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-0c9014\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-0c9014\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"bde801ad48bcba39a3cf88516077f8fad94dd2ce0692d0f274ab650cb9cc6614\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fbf5e5a312486cd624620a8628b976f89d3b75ffa1d3e47224c08e003294432f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-0c9014\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-0c9014\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"047906c5f7db776a9bd905e481a3347b0c84bd6edf626dc5626ed91115c7408a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cbaea0f78f7b655ed1c234a9fbf7020e12e29bee546d39c314b814aa1692620f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-0c9014\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-0c9014\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"1e414f5eaffdbc43cdaeda8552267e2b46abc1a6b41adfdb24735f3843a9c51f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2ab986aa56245948b966f417e9db684ac2bae70862e05b68a996c57de4d7c4c9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-0c9014\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-0c9014\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"3f61be5c1cb2e788fb6ec123b23519795a5d4fa05fbf9eb842b61931843e1834\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"83f9aef31a325eccb5ee1ca5935289e892a53f7f9d05ac2a6d2b8a973624d6db\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-0c9014\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-0c9014\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"ead8e640f12ec2a2a5b9632dbacd377499d067469c52a5e5c7791f29393639d3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"93867ab0bab47561de7ff57c3a2f54a4e134cfb5a3ee35d78ee703589d669077\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"760f6f0b0f0dfc05ff96616a7ebd6878ae6a8e384823348a74bc46e7ee6e70ab\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"06c24ca69f585351676e3a47fdf7a96df9b9a8fe85641e1c3348c8cfdfe446cb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"2089b2caaee71efefb7e26192d15a3376881340fd07cbc304d192587b50b0c07\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f713c09235fdc689702761ce6f8fb3c2c03ea75f66382e5121160a24cf7aee9d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"78522ace7509d509793c07978801f1f4bab7d64f1ad59df33af972c953cd6851\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6b6f55f762b51c1f46156308a7f509359377c543fd3789f104b3416ff46e3216\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"06aab5232bb89b6e09b9780286eb3fceeee4557f3ea4efd5ede8278ad6c21170\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-worker-w0-0c9014"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-worker-w0-0c9014\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:51:50.379Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-worker-w3-f51151","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T21:21:31Z","generation":15,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"8871137c-7f6a-401d-a6db-2983aea5ba22\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:51:10Z"}],"name":"kuadrant-e2e-worker-w3-f51151","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-worker-w3-f51151","uid":"8871137c-7f6a-401d-a6db-2983aea5ba22"}],"resourceVersion":"76231","uid":"c24c0550-6758-4dca-8d2b-3fe32740d122"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a05d7e315cc7cde173ab18a777672d3a18ce0a96f8f52d505404dcf8d1e51c20\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"0e7c31c41adb0d3f9efc929ae631573fe0c783a2fa7edb7a4b135081c2969bbf\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6c73e108ce3d5ef8ece11651aca73aa00bd88530b6aba861d23ca7b6ff89ba5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"aedbd7ef0308fd9494e9a3a1386b732923d5d060acf5a188601898d4867d320f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7b56d8e34a0de188e49dc0ae60057e421eb8bc4643546e49b2fe810120869498\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__4747dfc7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f462f4dcd8c7efdf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-e2e-temp-model-status\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__4747dfc7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f462f4dcd8c7efdf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-e2e-temp-model-status\"]}],\"name\":\"b6389ab82133347e2514a4ad1cbd9d34042edc9a4ad044714155dbb2aecf38d4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a942d85d233c0e2e8932f598b5b8c9b97eda0ae826b5a80a742559b36fa56979\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"85e7f37f931469abe1b396a1a44b52a8b72e6a4dc98ed0ebdd61e43f0486de13\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a05d7e315cc7cde173ab18a777672d3a18ce0a96f8f52d505404dcf8d1e51c20\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"ec8a1b6bbf984a67cda63e2d923bfa9d2d66a7537f676f6198c12cbca9103517\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6c73e108ce3d5ef8ece11651aca73aa00bd88530b6aba861d23ca7b6ff89ba5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"5c9b9ac2bc33c747eb54045ee2511e3c8b2ee9737a3f347afb75903f43d74fb7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7b56d8e34a0de188e49dc0ae60057e421eb8bc4643546e49b2fe810120869498\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__4747dfc7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f462f4dcd8c7efdf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-e2e-temp-model-status\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__4747dfc7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f462f4dcd8c7efdf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-e2e-temp-model-status\"]}],\"name\":\"f82b9432930517e02d229f4fdbdd8b6700b061d5d333fe35b064a3bb85f58e76\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a942d85d233c0e2e8932f598b5b8c9b97eda0ae826b5a80a742559b36fa56979\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"6d321a24ed09abad642dee549f0c7cbf98ce40481beb85ca79bd3d4eeb89b77e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a05d7e315cc7cde173ab18a777672d3a18ce0a96f8f52d505404dcf8d1e51c20\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"a54bd689e670e5f8bbee0a66c2585a4d4adce9a5a7fc297449ee3b816a0c2695\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6c73e108ce3d5ef8ece11651aca73aa00bd88530b6aba861d23ca7b6ff89ba5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"ad845c31a125851bf4cc5ae7e83bb4a011cf98484d99780ab16df250ca9dd41c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7b56d8e34a0de188e49dc0ae60057e421eb8bc4643546e49b2fe810120869498\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__4747dfc7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f462f4dcd8c7efdf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-e2e-temp-model-status\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__4747dfc7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f462f4dcd8c7efdf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-e2e-temp-model-status\"]}],\"name\":\"9eefe22cd9d7f4d324cc07e6422d998261fea96e9069bc938fe66a94e8c8cadb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a942d85d233c0e2e8932f598b5b8c9b97eda0ae826b5a80a742559b36fa56979\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"b00ec38cf5be980b160374be347b182afaa16e0dc99314a5e990f20cef6d57ed\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a05d7e315cc7cde173ab18a777672d3a18ce0a96f8f52d505404dcf8d1e51c20\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"6d5d9aca320022f0f8b70c3f9b34b5922adf537f5da717ec79924566febf6df1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6c73e108ce3d5ef8ece11651aca73aa00bd88530b6aba861d23ca7b6ff89ba5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"346e75cab49a1cf8ae89d90cfb32099256f44d7909e40cdc730e951946a411e2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7b56d8e34a0de188e49dc0ae60057e421eb8bc4643546e49b2fe810120869498\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__4747dfc7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f462f4dcd8c7efdf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-e2e-temp-model-status\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__4747dfc7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f462f4dcd8c7efdf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-e2e-temp-model-status\"]}],\"name\":\"ae0a4172fa23a6e8857123675126f34bcaf4e08f94c05663e2913801fda46401\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a942d85d233c0e2e8932f598b5b8c9b97eda0ae826b5a80a742559b36fa56979\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"ee0931c3dc206732c58bab1add9bf2cb602a2eb21bfa9272c2df596197dceb3e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a05d7e315cc7cde173ab18a777672d3a18ce0a96f8f52d505404dcf8d1e51c20\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"3f6b6643d5731a355a44968b83b24169ff3e0c1b36737d8be7f9d42e1def7c3e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6c73e108ce3d5ef8ece11651aca73aa00bd88530b6aba861d23ca7b6ff89ba5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"cd8ab5f89e71494c8d176f9668b8ed279bd244e6f70d1a5c87603877b4b7182d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7b56d8e34a0de188e49dc0ae60057e421eb8bc4643546e49b2fe810120869498\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__4747dfc7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f462f4dcd8c7efdf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-e2e-temp-model-status\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__4747dfc7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f462f4dcd8c7efdf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-e2e-temp-model-status\"]}],\"name\":\"09df06c068a0d1324c44679ca0c022e74cd18bae1497d0087fb2184f9401d63b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a942d85d233c0e2e8932f598b5b8c9b97eda0ae826b5a80a742559b36fa56979\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"821121f5584e938a01b323996203984576204f894f2c9f09f5ececcdc058373e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a05d7e315cc7cde173ab18a777672d3a18ce0a96f8f52d505404dcf8d1e51c20\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"e00f3dfbbce60a718137b415a42cbf1e65a7b226437cc4600d9fa76b264e3b4d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a05d7e315cc7cde173ab18a777672d3a18ce0a96f8f52d505404dcf8d1e51c20\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"7ddf0d6bdcfc6aa206cdc0919b1d5b7545c903aafbb0e16d393016b1a83bd29a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6c73e108ce3d5ef8ece11651aca73aa00bd88530b6aba861d23ca7b6ff89ba5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"fe3b37fdd5d3f9d3bdf7d03b186d964b283bfbe7d3ffa720457517666c3070a2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6c73e108ce3d5ef8ece11651aca73aa00bd88530b6aba861d23ca7b6ff89ba5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"7dd9491b4755b4900c5bc55b4dd9aff38f99899f0236e4d21bf7c94e5769cbb1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7b56d8e34a0de188e49dc0ae60057e421eb8bc4643546e49b2fe810120869498\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__4747dfc7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f462f4dcd8c7efdf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-e2e-temp-model-status\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__4747dfc7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f462f4dcd8c7efdf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-e2e-temp-model-status\"]}],\"name\":\"fa5430186b33e56d19e4d2e0209b4f2215d17b488745cd8061eb5ecaf96ecafa\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7b56d8e34a0de188e49dc0ae60057e421eb8bc4643546e49b2fe810120869498\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__4747dfc7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f462f4dcd8c7efdf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-e2e-temp-model-status\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__4747dfc7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f462f4dcd8c7efdf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-e2e-temp-model-status\"]}],\"name\":\"cd88af3d71345ad9b32dfae02550fa9bf6aa0cddfac2d0464a60cd90b9898d74\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a942d85d233c0e2e8932f598b5b8c9b97eda0ae826b5a80a742559b36fa56979\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"2182ac070ac99ffbeb246624e36aa202ce8c626bd38aaa3191f5e60a408bc782\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a942d85d233c0e2e8932f598b5b8c9b97eda0ae826b5a80a742559b36fa56979\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"97e41dd7c810563f2cac2a1c963d220c840d6b756c6c76b0cf97113387aab38b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a05d7e315cc7cde173ab18a777672d3a18ce0a96f8f52d505404dcf8d1e51c20\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"a00edc25239da061cd0457625d6046ede5f9d09507c78c2209e1e992795831c9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6c73e108ce3d5ef8ece11651aca73aa00bd88530b6aba861d23ca7b6ff89ba5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"fbd557cfa232fb43236e5864400cd1522fbf21d014450df4a714ea2d3608e863\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7b56d8e34a0de188e49dc0ae60057e421eb8bc4643546e49b2fe810120869498\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__4747dfc7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f462f4dcd8c7efdf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-e2e-temp-model-status\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__4747dfc7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f462f4dcd8c7efdf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-e2e-temp-model-status\"]}],\"name\":\"f809ccd15563984c9befad8f50ee38613b9c34eda0af01f561e75be88cba33ab\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a942d85d233c0e2e8932f598b5b8c9b97eda0ae826b5a80a742559b36fa56979\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"749b6bc66485455bb3cc5a0d552c38935bb446a6be85e306d894e6cbb4d92c08\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b31ddb7ef02e35e9d172430b50a004a3047564232880010bd3e581bf0dc547f8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"a1ec0f0592798b3996117a17734b0936906621077ceec69c81d8fb77e89a142a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"75a5abd89bb4e6258c7f7c7be472e6131799539dbbb87686c1010afe2791e45e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"3ca8a6339da3e4298e514bea168ac30f6c718d158fa0efc5e0fd85f06754a528\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"72bb4e3923485ca35015ee8655bc43ee332eea77f2cd8effbd48b21828f89f80\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"879fe62fbbe8b0a130140cda7f546611c758fb8fa416f173d2b0cf3da17d7941\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ed162da516e04d5229dc1d49e1c785e9db374ba4ba028ecabbdccdcb33acd1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__4747dfc7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f462f4dcd8c7efdf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-e2e-temp-model-status\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__4747dfc7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f462f4dcd8c7efdf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-e2e-temp-model-status\"]}],\"name\":\"b43372d2a0820427086903362809a4a0c757cd1d6f593ba48a755e5fb972575d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f9603ac54a5668b179c6ba3dcda3951e57253a5ad5ad80214b563f50337f3a9c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"7caf859dfb9739029a8c1b13adba06164610495beddbda8e01fd7b432b15f4c3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"775fdec32977b769224a6d9530e33a1b93a2948f54e3f459e979da99f7def4ea\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"5cebae68b5e59e34a98c9c038f83d877f079732894ec3403d349e0b7ae0c9099\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6ab1b21b6f75f2c1ef86f9bcf36a6c25244e88430832e3ac86a839cf10bb8dcd\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"15ecb8224cf6049c2e831c815cc4f0aed954432b967d01d55ea637294f3ea87e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8b2fbdc0f4b402fd19fb549b70da796c6867a52206fa0420df2d6debc0db70b7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__4747dfc7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f462f4dcd8c7efdf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-e2e-temp-model-status\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__4747dfc7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f462f4dcd8c7efdf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-e2e-temp-model-status\"]}],\"name\":\"7cb303fae9824d31834d539772c1840fd2991481566b7d07635c9284c524ae4d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a649343311197c716e0b6f502bb8ad21ecf4e207e16ffc6e0b74b1dc4f05f7fb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"699e8723136e653d04a8800a9289a3543f733ebfd0f99efbedfd18d22de4c281\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a6267fc785126adca5b68df13f95ef1fa08e1d72b66fbff01b54f8d61edaf7ba\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"9a72bfcef40a8da2865b02b6123c023d9f4f17c11a2ff674e3ed24af23e468e2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a6d41f4e9f57ec1e6bb4423e49991033d85f00a2a3303e02b25d1eedb67be3c9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"ad4137b1e753fd100088742941c8aaee9eaddc158bbaf221eb0d7318bdb8dfb5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6610d72af8a18be17c09082b4389a248d739315be17e0e146375e82e8d76261d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"66a5afc61110ab52ae4b9c9d79944467f91c4a2bd7b954ed8f59e651c215c630\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aea6441051c6a7490e44d5f7bab0e4bf7cf461c9597675611789e8d9141a446c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"c871ffab27f7ed925d56fae005e70fd3716aab799f0484d7d44519e915491d11\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"be7879d2a6daa00da89abfe5895a77787208f1af5b8582c79c8dd2849ef7906c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__4747dfc7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f462f4dcd8c7efdf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-e2e-temp-model-status\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__4747dfc7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f462f4dcd8c7efdf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-e2e-temp-model-status\"]}],\"name\":\"461ea56b8a105dbd1d386b531c80b5a86960df99b24b6f6668520921b280a609\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7f4456bc894bf7ab59ba02c25915a8db007a89ffdd1efcace437a7761c68b3f9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"aedfea0f1dceed2b1af07ebf6e7dbc55cdc958ea5a084291f6216a19f63eae8a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f23dfebb92a3f3d59997030cce08899533ec20be47590cd866dd896392db04de\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__4747dfc7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f462f4dcd8c7efdf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-e2e-temp-model-status\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__4747dfc7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f462f4dcd8c7efdf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-e2e-temp-model-status\"]}],\"name\":\"f42d6cbc7a49b6c1c4f0668dc536500321a8f658d1ab1a3a8b2ad8c0a95b272c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c57cda59d33d438c637a64dce8619a9616880a275363557ccc83d2cbc4920e14\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"1a3df8e6f6ad36c3eb928970ca2e746005e16b25405fc6eb9f44977b07d56905\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"086314a2fc965880bf769a18d3353909b6a1e5544e7eb514174994ba24387652\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"8e63847006a8d1952318fe3b6d2707027991d1c00d7959d051b3baf72690aecf\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f1def6d908410a124665ecd632ae01e5ba977920643dab1a35d25277292bae55\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"1199947fd30f0d1dab3db5846b8d27e36b6284be94834b798e4004120ec52532\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"676709317386301aa762cc48b7aa0064bc03adc00abbddfda8d0294046751d34\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__4747dfc7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f462f4dcd8c7efdf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-e2e-temp-model-status\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__4747dfc7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f462f4dcd8c7efdf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-e2e-temp-model-status\"]}],\"name\":\"8a51327014eb82d6df6700b3f79ae6010cc76b2ee750f56ac5cb49c5b6f975ed\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d8557b9861d48e5714a954e0a885ecc7e55e6b9f034fc9f24f4c5c2f6dafce5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"91c8ce1078dc4a26a7cb0af054981aa28b4768dcd87a9a167f98e9b4e4b60325\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d63de28626482cf5fa2aaf12cb9aa3def86d637d4c98f193819331c36fa73b21\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"fae01409c891b630fc644ebf1b8bc640438a1fc79de2b0750d34e2a6388d4ca6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f86615df74e8d3814df8817b06dc7578a4b0af0817397c5bdddb1daaaeb1df4e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"2d972852e655bb76327ea47e134854d589cf64538813171d00544a81dc138f4f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ca57331ce8d0c8497c210605ffe8878f757d572164898f4f870b89fcf2f9f1ed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__4747dfc7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f462f4dcd8c7efdf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-e2e-temp-model-status\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__4747dfc7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f462f4dcd8c7efdf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-e2e-temp-model-status\"]}],\"name\":\"1ef135f8dcdcaa663d4184fa6364518f7001a744380301035f254e16acdad0b7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"06c1a51758821d18e14577dc995b939fe472579672223b3bf0c1a312b23f23c4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"a90d5652afa4bbc65c24ada88ebb0df97a9c759ab0004d0c85d28f7e4c012bb9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/premium-w3-f51151/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"acbe19c11dc0fe08b370bbe647de6ecce77849e75c774c3e46f4a7af09e2861f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"b1fa0497afe070203ab9c23aef75e896659b83c8305ca7a56664d1717528e732\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7b5f8cd8dfbddc7109fd206805e23a6ae21c18bf406c0001927759ff1a39122f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"64238089f4803f45c8353b0d5d05ac6a23d6a3647106591fdc2bd5299c0b0759\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fd143bc18213c3c4682bcced572bcf84c1cbc8cd87ea188e96c990f164fd5ade\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__4747dfc7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f462f4dcd8c7efdf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-e2e-temp-model-status\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__4747dfc7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f462f4dcd8c7efdf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-e2e-temp-model-status\"]}],\"name\":\"3ede2f522e381a5e5b8affa5afed6ede7d3894cf263c247dca9b3f3f3ad4a676\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cf25727b6a9419d97ed5dc9613d3b6a26e590c05f01b5c4038461accc96bc026\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"fb213d7be796970427643a4a818af11356ba854b3a0477e3c48bc2ef3332c7d5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cb9167704c77a112808785ad099bc015c57786c61e7befec251b029ce378a0c6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"ef8b5b3a53f3de47fd70ccb56be2422e84d7fb1f10a03b64c032baca50a33c79\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9a4beabc5e6770b1db0aae064836730685e70fcacd601193f69aafe8156d41a4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"667e44e20cda74056b10928af7322c52f17d044dda1b5aded34df466201c3e4d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/premium-w3-f51151/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fdd358955bc325dacf4ae3d584d9dfaa236b2605d42014543bcddb868221d0fa\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"0a4335c7c536062bc1f3c4f55fad89ef387858062864c877a3014c384192a4f5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"91d11ef27666b7f1f85063266e00a4add2242586a1e8a4bac5447b3f4ec7925d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"26827917812d006281f7f7ba6e53d3573012708364624693432b2cbdd0f434b5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"79bf752ac34000e70b4860b3a87054e1aab2babf35019e7e24d203c82f5f1c70\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__4747dfc7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f462f4dcd8c7efdf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-e2e-temp-model-status\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__4747dfc7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f462f4dcd8c7efdf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-e2e-temp-model-status\"]}],\"name\":\"e8683890d73b71f6556b533ec6f92b30804817a025abb3d3c716a89f9b3f85d9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"707f7a9a5bb373d466ca8ba9e6220842edd61bdf74768cdb8760aca4648a21b3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"b90f395e8ebaa67a3ab9ee2a967d88bbf981033415dedacddf2e76a8347bfd39\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/premium-w3-f51151/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a40304ff6b4a0f6c57da3d4a6bcc549a18c94ce2ed3356df2ce4c4621e7d5231\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__4747dfc7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f462f4dcd8c7efdf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-e2e-temp-model-status\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__4747dfc7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f462f4dcd8c7efdf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-e2e-temp-model-status\"]}],\"name\":\"ff65bd9a43408c55f0593fcb41763d9030c7823704d875b6050eb2c39b500d75\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ab3c6da9622dba177dfaf10df58f987a09c5bd12e35f73cca3f03ce632140cd4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"9ec2510ba7c20be712eae31e88eb54985eedbb6ce61783804c05db0582107bc2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/premium-w3-f51151/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5d4b7dc290bd7cb2c0c574a9869b31b45107252e6aaf512691b5c665967d6821\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"f6fff5f3b2673f2810cddb2b65518e70b74aad58e6c27ef1faf828a9cdef8c14\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d896bcdf40d08e0bef242ce04aa58467e96c672450af890adda6941c53a574d3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"69bd1c4b3e1b36f5d5d62283b221b7026a4e53da339ac7c470f75cb4334435f6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"16bf1b94bcdc2b222ee7ef5dfdb45298f40e57fcf65f862a63a7b2d64b143143\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__4747dfc7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f462f4dcd8c7efdf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-e2e-temp-model-status\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__4747dfc7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f462f4dcd8c7efdf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-e2e-temp-model-status\"]}],\"name\":\"ec2b739c69e9a51aedc6a2ee8ed6e7bbcb37f4eff66695b2c6d1bf4950a2ecb3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3fdafb69d9c72b7e3c78e50b30f01adec907957097c6a1e811ceff68d93d7c23\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"a31568314e38d20d12f5921c57463100edd3022d5f9f3c0b36033d9a4dee9193\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e11ba50523ae86c5c06c5b76176154ed9ba57c3ed13fa43133b1ac7249ce345f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"67192e2ead59827b5990f7b4cbc2aece4271402ddcdfaa76f7cf95d2d4552c43\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b6344fa6f672d55d2eb4fbf6449de24a41dbf664f8e9d3c01ecde50e9d46e233\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"3c429336b45d9712bfdb0d99ecd41baa0dde1570067b941b5927e1894931c254\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d1f3365185f5fcfe92899c5f49af1b579baab97128b8afee3eed4350859c3f14\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"2f17c508c987cffd0b45ebd164fcee3ad66819a39900f83fbeda518ccf619183\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"85124e62247f9234752fedfc382ba93d6f839dab53f49c16951446afa3e613aa\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"6d2c4320e5eae8e51596e1c62f1c7494e1c5f9cd5d374e73b3ddae65dd071a92\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"461f0fb3ed9e91195eaa488b65b6f04cb4bff62087edbcf0d4c2186d180ba0ab\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"994b30d96390325263d89c2da7554eadd9d4fd1811371afabaf057df68e19205\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d13670b5b1696edcb191c925fa86dd729eeb7447f2230e160d9cc03e0117604d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"f70585dfa8966b9748a8978bfdf51d589a9d85f553359b47bfa09ad8bb266b02\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"18b02d50add3a7c29ec6127eedab648f22d172b48224a97365a7798a612dcd01\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"1e0c9c02fbbf3d69df4286ba8224f5543dfc90c1df5aa687b5b6f1c00dce4d56\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3f0daf8882dbe2b0594c2bb310f151a319cec601c5028d24f0d4557684bfb5f1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__4747dfc7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f462f4dcd8c7efdf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-e2e-temp-model-status\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__4747dfc7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"f462f4dcd8c7efdf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-e2e-temp-model-status\"]}],\"name\":\"4d8ba792ec63f5d46b5589f993126734f136e3569a1b7639aaea8768dc2c0f57\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a8ad3ccfafcc25ea959dd98788332d9514ad2d762423f3039adff91a3381329f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"b159e4d34dc2a1f6fe05bc0d616c2ebb2d3306defc93bfb6d4035e2f842e1b91\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-worker-w3-f51151"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-worker-w3-f51151\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:51:50.938Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w3-f51151","namespace":"e2e-models-e2e-worker-w3-f51151","uid":"e3340067-224a-43ad-8020-ca9e00ead152","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w3-f51151\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:51:51.018Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-praxis-a-aa8aff-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-praxis-a-aa8aff-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:51:51.713Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w0-0c9014","namespace":"e2e-models-e2e-worker-w0-0c9014","uid":"4f647df6-1d5b-433b-b4fc-1279ff1755f7","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w0-0c9014\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:51:51.831Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w0-0c9014","namespace":"e2e-models-e2e-worker-w0-0c9014","uid":"dcb5a0e4-7049-4ddc-91de-e14d55b09789","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w0-0c9014\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:51:51.888Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-e2e-temp-model-status","namespace":"e2e-models-e2e-worker-w3-f51151","uid":"68336124-e921-4440-a513-454b151c2a64","error":"tokenratelimitpolicies.kuadrant.io \"maas-trlp-e2e-temp-model-status\" not found"}
{"level":"info","ts":"2026-11-02T21:51:52.067Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:51:52.067Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T21:51:52.441Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"distinct-w3-f51151-kserve-route","namespace":"e2e-models-e2e-worker-w3-f51151","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"distinct-w3-f51151-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:51:52.894Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-praxis-b-3c7706","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-praxis-b-3c7706\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:51:52Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-praxis-b-942164","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-b-942164","reconcileID":"f9e4da43-c6f7-48ef-8c2f-b123e342bbf2","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-praxis-b-942164","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:51:53Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-b-942164","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T21:51:53Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:51:53Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-11-02T21:51:53Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:51:53Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-11-02T21:51:53Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-praxis-b-942164","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-b-942164","reconcileID":"f9e4da43-c6f7-48ef-8c2f-b123e342bbf2","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-praxis-b-942164","namespace":"openshift-ingress"}
{"level":"error","ts":"2026-11-02T21:51:53Z","logger":"telemetry-policy-extension-controller","msg":"Reconciler error","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-praxis-b-942164","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-b-942164","reconcileID":"2a447719-c8bc-4128-8349-7566ca9ea18c","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-praxis-b-942164\" not found","stacktrace":"sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:353\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-02T21:51:53Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-b-942164","event":"DELETE"}
{"level":"info","ts":"2026-11-02T21:51:53Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-02T21:51:53Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-praxis-b-942164\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-02T21:51:53Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:52:02.707Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["EnvoyFilter","Kuadrant","ConfigMap","TokenRateLimitPolicy","AuthPolicy","HTTPRoute","Gateway","Limitador"],"eventTypes":{"delete":3,"update":12}}
{"level":"info","ts":"2026-11-02T21:52:02.954Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:52:02.973Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:52:07.078Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:52:07.323Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:52:07.751Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:52:07.934Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:52:07.934Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:52:11.153Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:52:11.160Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:52:11.160Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:52:11.161Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:52:11.168Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:52:11.172Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-11-02T21:52:11.223Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to delete envoyfilter object","envoyfilter":"openshift-ingress/kuadrant-ratelimiting-e2e-praxis-b-942164","error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-praxis-b-942164\" not found"}
{"level":"error","ts":"2026-11-02T21:52:11.392Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to delete envoyfilter object","envoyfilter":"openshift-ingress/kuadrant-auth-e2e-praxis-b-942164","error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-praxis-b-942164\" not found"}
{"level":"error","ts":"2026-11-02T21:52:11.392Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:52:11.392Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T21:52:12.241Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to delete envoyfilter object","gateway":"openshift-ingress/e2e-praxis-b-942164","envoyfilter":"openshift-ingress/kuadrant-e2e-praxis-b-942164","error":"envoyfilters.networking.istio.io \"kuadrant-e2e-praxis-b-942164\" not found"}
{"level":"error","ts":"2026-11-02T21:52:13.852Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w0-0c9014","namespace":"e2e-models-e2e-worker-w0-0c9014","uid":"4f647df6-1d5b-433b-b4fc-1279ff1755f7","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w0-0c9014\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:52:13.910Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w4-d6cb38","namespace":"e2e-models-e2e-worker-w4-d6cb38","uid":"486176e6-7786-40c4-9ce0-6f4a68b408b2","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w4-d6cb38\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:52:13.967Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-praxis-b-942164-maas-auth","namespace":"openshift-ingress","error":"authpolicies.kuadrant.io \"e2e-praxis-b-942164-maas-auth\" not found"}
{"level":"error","ts":"2026-11-02T21:52:14.028Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w3-f51151","namespace":"e2e-models-e2e-worker-w3-f51151","uid":"e3340067-224a-43ad-8020-ca9e00ead152","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w3-f51151\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:52:14.449Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:52:14.449Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T21:52:15.279Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-praxis-b-942164","error":"gateways.gateway.networking.k8s.io \"e2e-praxis-b-942164\" not found"}
{"level":"info","ts":"2026-11-02T21:52:15.639Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy"],"eventTypes":{"update":1}}
{"level":"info","ts":"2026-11-02T21:52:19.976Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:52:19.981Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:52:19.985Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:52:19.985Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-02T21:52:20.032Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to delete envoyfilter object","envoyfilter":"openshift-ingress/kuadrant-ratelimiting-e2e-praxis-b-942164","error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-praxis-b-942164\" not found"}
{"level":"error","ts":"2026-11-02T21:52:20.094Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:52:20.094Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T21:52:20.728Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-worker-w3-f51151","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T21:21:31Z","generation":16,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"8871137c-7f6a-401d-a6db-2983aea5ba22\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:51:41Z"}],"name":"kuadrant-e2e-worker-w3-f51151","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-worker-w3-f51151","uid":"8871137c-7f6a-401d-a6db-2983aea5ba22"}],"resourceVersion":"77284","uid":"c24c0550-6758-4dca-8d2b-3fe32740d122"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a05d7e315cc7cde173ab18a777672d3a18ce0a96f8f52d505404dcf8d1e51c20\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1d9dda0bbc9176d0\\\" || auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1d9dda0bbc9176d0\\\" || auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"0e7c31c41adb0d3f9efc929ae631573fe0c783a2fa7edb7a4b135081c2969bbf\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6c73e108ce3d5ef8ece11651aca73aa00bd88530b6aba861d23ca7b6ff89ba5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"aedbd7ef0308fd9494e9a3a1386b732923d5d060acf5a188601898d4867d320f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7b56d8e34a0de188e49dc0ae60057e421eb8bc4643546e49b2fe810120869498\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"b6389ab82133347e2514a4ad1cbd9d34042edc9a4ad044714155dbb2aecf38d4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a942d85d233c0e2e8932f598b5b8c9b97eda0ae826b5a80a742559b36fa56979\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"85e7f37f931469abe1b396a1a44b52a8b72e6a4dc98ed0ebdd61e43f0486de13\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a05d7e315cc7cde173ab18a777672d3a18ce0a96f8f52d505404dcf8d1e51c20\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1d9dda0bbc9176d0\\\" || auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1d9dda0bbc9176d0\\\" || auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"ec8a1b6bbf984a67cda63e2d923bfa9d2d66a7537f676f6198c12cbca9103517\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6c73e108ce3d5ef8ece11651aca73aa00bd88530b6aba861d23ca7b6ff89ba5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"5c9b9ac2bc33c747eb54045ee2511e3c8b2ee9737a3f347afb75903f43d74fb7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7b56d8e34a0de188e49dc0ae60057e421eb8bc4643546e49b2fe810120869498\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"f82b9432930517e02d229f4fdbdd8b6700b061d5d333fe35b064a3bb85f58e76\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a942d85d233c0e2e8932f598b5b8c9b97eda0ae826b5a80a742559b36fa56979\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"6d321a24ed09abad642dee549f0c7cbf98ce40481beb85ca79bd3d4eeb89b77e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a05d7e315cc7cde173ab18a777672d3a18ce0a96f8f52d505404dcf8d1e51c20\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1d9dda0bbc9176d0\\\" || auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1d9dda0bbc9176d0\\\" || auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"a54bd689e670e5f8bbee0a66c2585a4d4adce9a5a7fc297449ee3b816a0c2695\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6c73e108ce3d5ef8ece11651aca73aa00bd88530b6aba861d23ca7b6ff89ba5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"ad845c31a125851bf4cc5ae7e83bb4a011cf98484d99780ab16df250ca9dd41c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7b56d8e34a0de188e49dc0ae60057e421eb8bc4643546e49b2fe810120869498\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"9eefe22cd9d7f4d324cc07e6422d998261fea96e9069bc938fe66a94e8c8cadb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a942d85d233c0e2e8932f598b5b8c9b97eda0ae826b5a80a742559b36fa56979\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"b00ec38cf5be980b160374be347b182afaa16e0dc99314a5e990f20cef6d57ed\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a05d7e315cc7cde173ab18a777672d3a18ce0a96f8f52d505404dcf8d1e51c20\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1d9dda0bbc9176d0\\\" || auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1d9dda0bbc9176d0\\\" || auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"6d5d9aca320022f0f8b70c3f9b34b5922adf537f5da717ec79924566febf6df1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6c73e108ce3d5ef8ece11651aca73aa00bd88530b6aba861d23ca7b6ff89ba5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"346e75cab49a1cf8ae89d90cfb32099256f44d7909e40cdc730e951946a411e2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7b56d8e34a0de188e49dc0ae60057e421eb8bc4643546e49b2fe810120869498\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"ae0a4172fa23a6e8857123675126f34bcaf4e08f94c05663e2913801fda46401\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a942d85d233c0e2e8932f598b5b8c9b97eda0ae826b5a80a742559b36fa56979\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"ee0931c3dc206732c58bab1add9bf2cb602a2eb21bfa9272c2df596197dceb3e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a05d7e315cc7cde173ab18a777672d3a18ce0a96f8f52d505404dcf8d1e51c20\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1d9dda0bbc9176d0\\\" || auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1d9dda0bbc9176d0\\\" || auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"3f6b6643d5731a355a44968b83b24169ff3e0c1b36737d8be7f9d42e1def7c3e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6c73e108ce3d5ef8ece11651aca73aa00bd88530b6aba861d23ca7b6ff89ba5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"cd8ab5f89e71494c8d176f9668b8ed279bd244e6f70d1a5c87603877b4b7182d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7b56d8e34a0de188e49dc0ae60057e421eb8bc4643546e49b2fe810120869498\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"09df06c068a0d1324c44679ca0c022e74cd18bae1497d0087fb2184f9401d63b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a942d85d233c0e2e8932f598b5b8c9b97eda0ae826b5a80a742559b36fa56979\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"821121f5584e938a01b323996203984576204f894f2c9f09f5ececcdc058373e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a05d7e315cc7cde173ab18a777672d3a18ce0a96f8f52d505404dcf8d1e51c20\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1d9dda0bbc9176d0\\\" || auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1d9dda0bbc9176d0\\\" || auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"e00f3dfbbce60a718137b415a42cbf1e65a7b226437cc4600d9fa76b264e3b4d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a05d7e315cc7cde173ab18a777672d3a18ce0a96f8f52d505404dcf8d1e51c20\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1d9dda0bbc9176d0\\\" || auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1d9dda0bbc9176d0\\\" || auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"7ddf0d6bdcfc6aa206cdc0919b1d5b7545c903aafbb0e16d393016b1a83bd29a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6c73e108ce3d5ef8ece11651aca73aa00bd88530b6aba861d23ca7b6ff89ba5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"fe3b37fdd5d3f9d3bdf7d03b186d964b283bfbe7d3ffa720457517666c3070a2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6c73e108ce3d5ef8ece11651aca73aa00bd88530b6aba861d23ca7b6ff89ba5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"7dd9491b4755b4900c5bc55b4dd9aff38f99899f0236e4d21bf7c94e5769cbb1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7b56d8e34a0de188e49dc0ae60057e421eb8bc4643546e49b2fe810120869498\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"fa5430186b33e56d19e4d2e0209b4f2215d17b488745cd8061eb5ecaf96ecafa\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7b56d8e34a0de188e49dc0ae60057e421eb8bc4643546e49b2fe810120869498\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"cd88af3d71345ad9b32dfae02550fa9bf6aa0cddfac2d0464a60cd90b9898d74\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a942d85d233c0e2e8932f598b5b8c9b97eda0ae826b5a80a742559b36fa56979\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"2182ac070ac99ffbeb246624e36aa202ce8c626bd38aaa3191f5e60a408bc782\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a942d85d233c0e2e8932f598b5b8c9b97eda0ae826b5a80a742559b36fa56979\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"97e41dd7c810563f2cac2a1c963d220c840d6b756c6c76b0cf97113387aab38b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a05d7e315cc7cde173ab18a777672d3a18ce0a96f8f52d505404dcf8d1e51c20\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1d9dda0bbc9176d0\\\" || auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1d9dda0bbc9176d0\\\" || auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"a00edc25239da061cd0457625d6046ede5f9d09507c78c2209e1e992795831c9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6c73e108ce3d5ef8ece11651aca73aa00bd88530b6aba861d23ca7b6ff89ba5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"fbd557cfa232fb43236e5864400cd1522fbf21d014450df4a714ea2d3608e863\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7b56d8e34a0de188e49dc0ae60057e421eb8bc4643546e49b2fe810120869498\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"f809ccd15563984c9befad8f50ee38613b9c34eda0af01f561e75be88cba33ab\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a942d85d233c0e2e8932f598b5b8c9b97eda0ae826b5a80a742559b36fa56979\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"749b6bc66485455bb3cc5a0d552c38935bb446a6be85e306d894e6cbb4d92c08\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b31ddb7ef02e35e9d172430b50a004a3047564232880010bd3e581bf0dc547f8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"a1ec0f0592798b3996117a17734b0936906621077ceec69c81d8fb77e89a142a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"75a5abd89bb4e6258c7f7c7be472e6131799539dbbb87686c1010afe2791e45e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"3ca8a6339da3e4298e514bea168ac30f6c718d158fa0efc5e0fd85f06754a528\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"72bb4e3923485ca35015ee8655bc43ee332eea77f2cd8effbd48b21828f89f80\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1d9dda0bbc9176d0\\\" || auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1d9dda0bbc9176d0\\\" || auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"879fe62fbbe8b0a130140cda7f546611c758fb8fa416f173d2b0cf3da17d7941\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ed162da516e04d5229dc1d49e1c785e9db374ba4ba028ecabbdccdcb33acd1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"b43372d2a0820427086903362809a4a0c757cd1d6f593ba48a755e5fb972575d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f9603ac54a5668b179c6ba3dcda3951e57253a5ad5ad80214b563f50337f3a9c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"7caf859dfb9739029a8c1b13adba06164610495beddbda8e01fd7b432b15f4c3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"775fdec32977b769224a6d9530e33a1b93a2948f54e3f459e979da99f7def4ea\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"5cebae68b5e59e34a98c9c038f83d877f079732894ec3403d349e0b7ae0c9099\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6ab1b21b6f75f2c1ef86f9bcf36a6c25244e88430832e3ac86a839cf10bb8dcd\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1d9dda0bbc9176d0\\\" || auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1d9dda0bbc9176d0\\\" || auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"15ecb8224cf6049c2e831c815cc4f0aed954432b967d01d55ea637294f3ea87e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8b2fbdc0f4b402fd19fb549b70da796c6867a52206fa0420df2d6debc0db70b7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"7cb303fae9824d31834d539772c1840fd2991481566b7d07635c9284c524ae4d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a649343311197c716e0b6f502bb8ad21ecf4e207e16ffc6e0b74b1dc4f05f7fb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"699e8723136e653d04a8800a9289a3543f733ebfd0f99efbedfd18d22de4c281\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a6267fc785126adca5b68df13f95ef1fa08e1d72b66fbff01b54f8d61edaf7ba\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1d9dda0bbc9176d0\\\" || auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1d9dda0bbc9176d0\\\" || auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"9a72bfcef40a8da2865b02b6123c023d9f4f17c11a2ff674e3ed24af23e468e2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a6d41f4e9f57ec1e6bb4423e49991033d85f00a2a3303e02b25d1eedb67be3c9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"ad4137b1e753fd100088742941c8aaee9eaddc158bbaf221eb0d7318bdb8dfb5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6610d72af8a18be17c09082b4389a248d739315be17e0e146375e82e8d76261d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"66a5afc61110ab52ae4b9c9d79944467f91c4a2bd7b954ed8f59e651c215c630\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aea6441051c6a7490e44d5f7bab0e4bf7cf461c9597675611789e8d9141a446c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1d9dda0bbc9176d0\\\" || auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1d9dda0bbc9176d0\\\" || auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"c871ffab27f7ed925d56fae005e70fd3716aab799f0484d7d44519e915491d11\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"be7879d2a6daa00da89abfe5895a77787208f1af5b8582c79c8dd2849ef7906c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"461ea56b8a105dbd1d386b531c80b5a86960df99b24b6f6668520921b280a609\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7f4456bc894bf7ab59ba02c25915a8db007a89ffdd1efcace437a7761c68b3f9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"aedfea0f1dceed2b1af07ebf6e7dbc55cdc958ea5a084291f6216a19f63eae8a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f23dfebb92a3f3d59997030cce08899533ec20be47590cd866dd896392db04de\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"f42d6cbc7a49b6c1c4f0668dc536500321a8f658d1ab1a3a8b2ad8c0a95b272c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c57cda59d33d438c637a64dce8619a9616880a275363557ccc83d2cbc4920e14\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"1a3df8e6f6ad36c3eb928970ca2e746005e16b25405fc6eb9f44977b07d56905\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"086314a2fc965880bf769a18d3353909b6a1e5544e7eb514174994ba24387652\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"8e63847006a8d1952318fe3b6d2707027991d1c00d7959d051b3baf72690aecf\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f1def6d908410a124665ecd632ae01e5ba977920643dab1a35d25277292bae55\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1d9dda0bbc9176d0\\\" || auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1d9dda0bbc9176d0\\\" || auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"1199947fd30f0d1dab3db5846b8d27e36b6284be94834b798e4004120ec52532\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"676709317386301aa762cc48b7aa0064bc03adc00abbddfda8d0294046751d34\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"8a51327014eb82d6df6700b3f79ae6010cc76b2ee750f56ac5cb49c5b6f975ed\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d8557b9861d48e5714a954e0a885ecc7e55e6b9f034fc9f24f4c5c2f6dafce5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"91c8ce1078dc4a26a7cb0af054981aa28b4768dcd87a9a167f98e9b4e4b60325\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d63de28626482cf5fa2aaf12cb9aa3def86d637d4c98f193819331c36fa73b21\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1d9dda0bbc9176d0\\\" || auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1d9dda0bbc9176d0\\\" || auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"fae01409c891b630fc644ebf1b8bc640438a1fc79de2b0750d34e2a6388d4ca6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f86615df74e8d3814df8817b06dc7578a4b0af0817397c5bdddb1daaaeb1df4e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"2d972852e655bb76327ea47e134854d589cf64538813171d00544a81dc138f4f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ca57331ce8d0c8497c210605ffe8878f757d572164898f4f870b89fcf2f9f1ed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"1ef135f8dcdcaa663d4184fa6364518f7001a744380301035f254e16acdad0b7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"06c1a51758821d18e14577dc995b939fe472579672223b3bf0c1a312b23f23c4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"a90d5652afa4bbc65c24ada88ebb0df97a9c759ab0004d0c85d28f7e4c012bb9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/premium-w3-f51151/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"acbe19c11dc0fe08b370bbe647de6ecce77849e75c774c3e46f4a7af09e2861f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"b1fa0497afe070203ab9c23aef75e896659b83c8305ca7a56664d1717528e732\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7b5f8cd8dfbddc7109fd206805e23a6ae21c18bf406c0001927759ff1a39122f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1d9dda0bbc9176d0\\\" || auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1d9dda0bbc9176d0\\\" || auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"64238089f4803f45c8353b0d5d05ac6a23d6a3647106591fdc2bd5299c0b0759\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fd143bc18213c3c4682bcced572bcf84c1cbc8cd87ea188e96c990f164fd5ade\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"3ede2f522e381a5e5b8affa5afed6ede7d3894cf263c247dca9b3f3f3ad4a676\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cf25727b6a9419d97ed5dc9613d3b6a26e590c05f01b5c4038461accc96bc026\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"fb213d7be796970427643a4a818af11356ba854b3a0477e3c48bc2ef3332c7d5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cb9167704c77a112808785ad099bc015c57786c61e7befec251b029ce378a0c6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1d9dda0bbc9176d0\\\" || auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1d9dda0bbc9176d0\\\" || auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"ef8b5b3a53f3de47fd70ccb56be2422e84d7fb1f10a03b64c032baca50a33c79\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9a4beabc5e6770b1db0aae064836730685e70fcacd601193f69aafe8156d41a4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"667e44e20cda74056b10928af7322c52f17d044dda1b5aded34df466201c3e4d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/premium-w3-f51151/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fdd358955bc325dacf4ae3d584d9dfaa236b2605d42014543bcddb868221d0fa\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"0a4335c7c536062bc1f3c4f55fad89ef387858062864c877a3014c384192a4f5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"91d11ef27666b7f1f85063266e00a4add2242586a1e8a4bac5447b3f4ec7925d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1d9dda0bbc9176d0\\\" || auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1d9dda0bbc9176d0\\\" || auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"26827917812d006281f7f7ba6e53d3573012708364624693432b2cbdd0f434b5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"79bf752ac34000e70b4860b3a87054e1aab2babf35019e7e24d203c82f5f1c70\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"e8683890d73b71f6556b533ec6f92b30804817a025abb3d3c716a89f9b3f85d9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"707f7a9a5bb373d466ca8ba9e6220842edd61bdf74768cdb8760aca4648a21b3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"b90f395e8ebaa67a3ab9ee2a967d88bbf981033415dedacddf2e76a8347bfd39\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/premium-w3-f51151/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a40304ff6b4a0f6c57da3d4a6bcc549a18c94ce2ed3356df2ce4c4621e7d5231\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"ff65bd9a43408c55f0593fcb41763d9030c7823704d875b6050eb2c39b500d75\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ab3c6da9622dba177dfaf10df58f987a09c5bd12e35f73cca3f03ce632140cd4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"9ec2510ba7c20be712eae31e88eb54985eedbb6ce61783804c05db0582107bc2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/premium-w3-f51151/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5d4b7dc290bd7cb2c0c574a9869b31b45107252e6aaf512691b5c665967d6821\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"f6fff5f3b2673f2810cddb2b65518e70b74aad58e6c27ef1faf828a9cdef8c14\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d896bcdf40d08e0bef242ce04aa58467e96c672450af890adda6941c53a574d3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1d9dda0bbc9176d0\\\" || auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1d9dda0bbc9176d0\\\" || auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"69bd1c4b3e1b36f5d5d62283b221b7026a4e53da339ac7c470f75cb4334435f6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"16bf1b94bcdc2b222ee7ef5dfdb45298f40e57fcf65f862a63a7b2d64b143143\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"ec2b739c69e9a51aedc6a2ee8ed6e7bbcb37f4eff66695b2c6d1bf4950a2ecb3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3fdafb69d9c72b7e3c78e50b30f01adec907957097c6a1e811ceff68d93d7c23\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"a31568314e38d20d12f5921c57463100edd3022d5f9f3c0b36033d9a4dee9193\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e11ba50523ae86c5c06c5b76176154ed9ba57c3ed13fa43133b1ac7249ce345f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"67192e2ead59827b5990f7b4cbc2aece4271402ddcdfaa76f7cf95d2d4552c43\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b6344fa6f672d55d2eb4fbf6449de24a41dbf664f8e9d3c01ecde50e9d46e233\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"3c429336b45d9712bfdb0d99ecd41baa0dde1570067b941b5927e1894931c254\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d1f3365185f5fcfe92899c5f49af1b579baab97128b8afee3eed4350859c3f14\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"2f17c508c987cffd0b45ebd164fcee3ad66819a39900f83fbeda518ccf619183\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"85124e62247f9234752fedfc382ba93d6f839dab53f49c16951446afa3e613aa\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"6d2c4320e5eae8e51596e1c62f1c7494e1c5f9cd5d374e73b3ddae65dd071a92\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"461f0fb3ed9e91195eaa488b65b6f04cb4bff62087edbcf0d4c2186d180ba0ab\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"994b30d96390325263d89c2da7554eadd9d4fd1811371afabaf057df68e19205\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d13670b5b1696edcb191c925fa86dd729eeb7447f2230e160d9cc03e0117604d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1d9dda0bbc9176d0\\\" || auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"1d9dda0bbc9176d0\\\" || auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"f70585dfa8966b9748a8978bfdf51d589a9d85f553359b47bfa09ad8bb266b02\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"18b02d50add3a7c29ec6127eedab648f22d172b48224a97365a7798a612dcd01\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"1e0c9c02fbbf3d69df4286ba8224f5543dfc90c1df5aa687b5b6f1c00dce4d56\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3f0daf8882dbe2b0594c2bb310f151a319cec601c5028d24f0d4557684bfb5f1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"4d8ba792ec63f5d46b5589f993126734f136e3569a1b7639aaea8768dc2c0f57\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a8ad3ccfafcc25ea959dd98788332d9514ad2d762423f3039adff91a3381329f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"b159e4d34dc2a1f6fe05bc0d616c2ebb2d3306defc93bfb6d4035e2f842e1b91\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-worker-w3-f51151"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-worker-w3-f51151\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:52:21.254Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-worker-w0-0c9014","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T21:21:39Z","generation":13,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"ddb57683-c2b1-4246-8c87-c1833e256a52\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:51:41Z"}],"name":"kuadrant-e2e-worker-w0-0c9014","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-worker-w0-0c9014","uid":"ddb57683-c2b1-4246-8c87-c1833e256a52"}],"resourceVersion":"77289","uid":"3a59a593-1a36-4e21-9529-ff8f3620d431"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"86115b8156c50eab2036378ac37ec53b33537f0eef44a4aa5d81752c24254c82\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"05504ddfe67ffabf\\\" || auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"05504ddfe67ffabf\\\" || auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"c69d9902b654dc255ef5aa6007c01753aa727fc097ae6b83d952cc0cf913761b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bdc9387e460a2dc1a85bc42d8ce6440788e8331159ace91b443c9628ef7c1fed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"2f68643a3c63d5b17fdfef48d85bd91a0973501f0d563a896e4b380a0b00d185\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e1cab00a309f6035001c6bed21b280b9cd6d81b83072c8f351fbe860f69886ad\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"d886729ca10572769b8b41e68ee56fb12942ea073f0b48ede22b1cc50bfcc40f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fe65e47ea66e64f823a934786806a737bfe3ca692bad4019774d91daeb2348d1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"e10af8f1a2640cf1de04932f79e79764db98097340db6ec566b3ab0af709d0d8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"86115b8156c50eab2036378ac37ec53b33537f0eef44a4aa5d81752c24254c82\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"05504ddfe67ffabf\\\" || auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"05504ddfe67ffabf\\\" || auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"34720a2e4d6ed7817a277e99c8b6c63bea050141799be3b70b3690e8575a06a6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bdc9387e460a2dc1a85bc42d8ce6440788e8331159ace91b443c9628ef7c1fed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"3a712e9256a22351eb20be5c7695beb1ebb8fb8ce2b2061a380c7829f310a235\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e1cab00a309f6035001c6bed21b280b9cd6d81b83072c8f351fbe860f69886ad\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"24d4dc5eb03a2701700ed1da77fab5dada30f4d5f19acc2aeb784ab7c2913842\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fe65e47ea66e64f823a934786806a737bfe3ca692bad4019774d91daeb2348d1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"95b56d1eb3f5f986a8dcd4728f616565f9664996c1a434f44f7b87c3972457ca\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"86115b8156c50eab2036378ac37ec53b33537f0eef44a4aa5d81752c24254c82\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"05504ddfe67ffabf\\\" || auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"05504ddfe67ffabf\\\" || auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"f831f6710914a69194c3f7c48e2651f7e183a1e62afcb27c73307245ab045f93\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bdc9387e460a2dc1a85bc42d8ce6440788e8331159ace91b443c9628ef7c1fed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"ad3a2d8079306ff1eeb9734837c5b71f0724eb8028848f90dbf05b80557a363c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e1cab00a309f6035001c6bed21b280b9cd6d81b83072c8f351fbe860f69886ad\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"44114992b7dce232405acd1cfada4b72839265de04c15b8c8b12cba013144276\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fe65e47ea66e64f823a934786806a737bfe3ca692bad4019774d91daeb2348d1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"a594b6f1c0a2b22e4714c27e98575eda080192ee3760bdfca9b4ad6aa516eee0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"86115b8156c50eab2036378ac37ec53b33537f0eef44a4aa5d81752c24254c82\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"05504ddfe67ffabf\\\" || auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"05504ddfe67ffabf\\\" || auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"de21a6b7dab6f53ab9e521b41625d35020e107d76ddb50e2958e0e2a412d9e40\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bdc9387e460a2dc1a85bc42d8ce6440788e8331159ace91b443c9628ef7c1fed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"9d9413f8be4dfb8834299266127fb239516760f378a7601605194b5533f62a28\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e1cab00a309f6035001c6bed21b280b9cd6d81b83072c8f351fbe860f69886ad\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"b608ac3153414f90d7bc1d459d441fc96968144e3d07d2286f28927e15b1e621\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fe65e47ea66e64f823a934786806a737bfe3ca692bad4019774d91daeb2348d1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"31897c718cc142df0d5d16918dfaf37807fffedaa54950878ada2e28c78ed1ea\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"86115b8156c50eab2036378ac37ec53b33537f0eef44a4aa5d81752c24254c82\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"05504ddfe67ffabf\\\" || auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"05504ddfe67ffabf\\\" || auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"0f90af4971cd47ea5ddd60d45eba18a900b5cf23592a3f0ecd9d46778e3738e0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bdc9387e460a2dc1a85bc42d8ce6440788e8331159ace91b443c9628ef7c1fed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"93ac09aaab9c4f036a2bdd254b8b96a4151063abefd4189c40778e53ebecdc09\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e1cab00a309f6035001c6bed21b280b9cd6d81b83072c8f351fbe860f69886ad\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"8791484f6beb20141c5c557cf7cec8b4649b67a98f43b54539a6ee6a88bceb5f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fe65e47ea66e64f823a934786806a737bfe3ca692bad4019774d91daeb2348d1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"5009bcd6ede0ee206f1c68b91ea406216f5da58a2b1c5f056ba6778c5f13d641\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"86115b8156c50eab2036378ac37ec53b33537f0eef44a4aa5d81752c24254c82\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"05504ddfe67ffabf\\\" || auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"05504ddfe67ffabf\\\" || auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"140e618f0bcaa91b635c87d4f29e5f8813bf0436d1f6e9b36373faecbdec61eb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"86115b8156c50eab2036378ac37ec53b33537f0eef44a4aa5d81752c24254c82\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"05504ddfe67ffabf\\\" || auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"05504ddfe67ffabf\\\" || auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"6acbaeb49e85ee3cb000f040214618990342fd0a59de5b2c5a1f90647758a246\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bdc9387e460a2dc1a85bc42d8ce6440788e8331159ace91b443c9628ef7c1fed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"5b6e6a7f7dc5f0d34eb857ca49303262b3c223fe67458805f41c060248c5dbfe\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bdc9387e460a2dc1a85bc42d8ce6440788e8331159ace91b443c9628ef7c1fed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"2127668fa8fef2292ac1484bc4a37390a4f7d56256dc3e5dbee6c3e5a11a9b76\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e1cab00a309f6035001c6bed21b280b9cd6d81b83072c8f351fbe860f69886ad\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"0aa314d93ee3acda2c2d9263c7d5271f8931007a465cca802fa4f97f82de8fea\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e1cab00a309f6035001c6bed21b280b9cd6d81b83072c8f351fbe860f69886ad\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"cb70a8e00aa575e704bd5c438dfcc5d7f8961efe6033fd93fae3fc6eca018120\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fe65e47ea66e64f823a934786806a737bfe3ca692bad4019774d91daeb2348d1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"1acbce7018705c04168bda5187e037e60c0fe47f186f10f96e84266e33b5b034\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fe65e47ea66e64f823a934786806a737bfe3ca692bad4019774d91daeb2348d1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"52baf0b74be4e68628b5b4ef71a9d95dad1cf739658ce467c9b24c3165eac562\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"86115b8156c50eab2036378ac37ec53b33537f0eef44a4aa5d81752c24254c82\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"05504ddfe67ffabf\\\" || auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"05504ddfe67ffabf\\\" || auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"a9b1a49056b3283c82e0d4f88ad61bed5b6f4b736a70f1bb2ef4ba19a80a05e0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bdc9387e460a2dc1a85bc42d8ce6440788e8331159ace91b443c9628ef7c1fed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"30c85ca7419d0f9a695b73530b16cb571b50e9dde62c1210e8c4fe44c14e4def\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e1cab00a309f6035001c6bed21b280b9cd6d81b83072c8f351fbe860f69886ad\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"5a52f00c07e5813093290d1bee011f0120610619cb82666a79b0139919644d6e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fe65e47ea66e64f823a934786806a737bfe3ca692bad4019774d91daeb2348d1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"309ad48f4f9314f702e5565256eb6d81567787f6737820f7ffb21a6d85a92b93\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"00c4d48b9f06a2f5dbb9cbe22ae3dcc9e10401b038e62058849dcebe2769e4f1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-0c9014\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-0c9014\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"02e0339b7fefd72794f04b407e26149d4822a36b0c408bf1129e0f7ccdc0cfdb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"884ebceaf8f5da21059151f97834277770ed77023feb57f83fc8c75e495f8d1c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"bb55cf856b87c0953ba4478213144ef02787b3cbbf80cc32e530521407ee40b0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7da280ddad70ebcc1b84b8a595244d0682cd0302755439371683331c4562cfe5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"05504ddfe67ffabf\\\" || auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"05504ddfe67ffabf\\\" || auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"23b1ef8cd3219264f8227915650891004d0dbf97a799031e0e6e6967fcd5f1c8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fe169ab2014a705a54df2fda4ec719f7132fd6bba54202f7531ce8df8da2bdf6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"5f4fc30622e992160dd04a2ed38f7e44c1794374d6682ae9f1f7ca01be3ee831\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8cb0b0d9cbe25e4182aea7d2ed6f3ca636a7d0c9be364f722b182dde26da45e1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"ca6fe2da7884bdf4da7e4fad467882fb9f7b1a542ef29da25c93b58c0a2facf5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5f8a52baf63f9e4c9ea31b6e22c9076262e33bc06968bbcb213439af05ae3a21\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"4e45e802c43f08adeba0b390be3827705a757991fe469c439db480762890906f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9a7eea6dc0fbfacc7f1b1980a90d1b04de88692dd5758d6a6457477b77a64673\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"05504ddfe67ffabf\\\" || auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"05504ddfe67ffabf\\\" || auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"0657b3667bafd18f07dc410bc515b76f51256e8c487baf4fe36409a313e6191e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ece9796b491eeaad9788ab6c426bb54d8cbb85433a9010ef2c4d3f579cca0db0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"5b95fd1a3cba680d3078cbfcc3ed349106804d68df9ff279d7829f1ce54c9fcb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3d645f3ac772a0cc5a9a71b4e6a542a2b2ab9962190903cb5d89d3e8e45b7f9d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"d61768c90b21a96135005ba91b0f0abbf7ffc2bd4f372c506a740a4d2280118a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bcf1ddf402fe28df1f45e616a2e2380b51177c45a7f8dcdd03bc2aa6b5814d26\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"05504ddfe67ffabf\\\" || auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"05504ddfe67ffabf\\\" || auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"0d7aee7ae66dd59feb746b56375d3063a0a395dd032211e5f6fd8a79acc4c534\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4cc208f8f31098b1cdf91b5776a85b52bae0339e659b20995e8ad11208703993\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"d480cd881add8aa6a454eefd0ff4a4f1883e0f31dd0af2c4fc8d49930dfd988a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"096fbc9d544918ac5b9d60464268ef3b1f03546e96ed130c743da74445576f52\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"862991ab77df3e7a553882c71a94c90c8006da4badbb5d62b2523a0c2ae8397b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"228ec96802a09009d984b3728e4e96175fefb32ba2e3b918071e85b3f8ec79d0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"05504ddfe67ffabf\\\" || auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"05504ddfe67ffabf\\\" || auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"1174da5781e0d01a3f99ec7d577f0c792e9d2f3d97450b0297d625c782aae7c6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6d14c0784badaddad1e95c3697462cedd1c5a5cf32d3a98f16155abc0721429e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"c6601f905085efd63830b0439c759fd2e17f4b3a0625b37e6ca853dfb418a3fe\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"669fd13dfb6f84f6e255bbee071a63253e1d5bd80a372cb6a445299b3c53a1a6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"aae79ba1b6eabe4b8be62d566c21c48755697af6a5a955ca0108115f218409f6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b0bfe3b1d3a080ff25e482046cf0d1df0ca30a090ef9f8424787467410af7627\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"cfedc7f35c0353d53fec0474975ad5e05c19ec8b2ac4718a77f59ccd7fb1233c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b0476fc7cd4ea3306c893f375fa8b815ad5c84676dd8000109732b76fc6c9e7d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"2fc0502446287f4669be2a416f781c0acba21256ff9eb15861862053f18d0e29\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4dcc64ddad4ef375730fe33c8b8925944bf0c1750f66d8a3347219a51dd190d3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"fe7515ad4af2d0fbe432bcf9bb564a76c332dd67819f108c4e0ccd547ada4eb1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a24eea90cd520665ff61391c71ddaf8965158b1b42c4e6f9fe99dd03dfa7c401\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"05504ddfe67ffabf\\\" || auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"05504ddfe67ffabf\\\" || auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"2036d4e41537afdd08f850cbe0bbe0d23c83b572c0c1f917f2cd718904dfce6d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1cd65b24c576b1e8f7a954fffca2225dfb109bf5a068107003d4f72206723e55\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"909bedc4bbf04ca094fb3d369cf7cb3b15d83ab3e98ef27c04ee79b787659c95\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"be088898c71049f4ea232cae6dd479dfab1a9947fba6b17e7353ce14e639507c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"cfc0c9b5c46987f78f689a5a334275694f4c03653d50c2fbe6e969e238c7f8cb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"03e9bc99c98697160f9a6db2252bc0ba9e88e4ed113a3d5d851256f6cee3dcab\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"05504ddfe67ffabf\\\" || auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"05504ddfe67ffabf\\\" || auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"642d89c776f69505ff2a885b3a3e0374200ad36c578ca4799ed899b1dc0cf546\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0e0bbf1b6879cb3f68f7ea7f2afda47c74a88c5d3cb97fdf3e110cdc54718649\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"f05bad08945108f9026112e207cee46af50e92faf4445f0e991b27b9412c4c58\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ad6b1369f6065e5d01605f83113ef1c7c93ed4b3fa8d01ad81d870c4a418f675\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"9eb0cbcb37fa43674c71b90f27589d7260b93ced662c1ceb0efe4cb1f91dab4c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4b932ff2b149c42a260b63c5bdd2b0515a398d1964de7381e0735756ee620b8e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"6fbda76757cae53d56b898432e232fb51847f0a1452503c1d53bf530847020ed\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a8ba5320fff14c281f32c2b0a9e757f0e205aace00c294b0d13fa46185724d35\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"8d788326bd35d2b328ba885da80b8eac2f0f1f55930d0bd275aa0c5fd637e227\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0ad1aa31e975e4b569a9617aed9c37982646578e71674b0d96896f60dc232a90\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"05504ddfe67ffabf\\\" || auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"05504ddfe67ffabf\\\" || auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"c8ee3691fdd0cb6a376274ca4ee98e52cb5718f985d4f539fb764ae6116296f6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0be4b31b8961f89b18ef02b2a56a0b76e7cb0d94a4440a467414ac2d9a504010\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"235df022eefeafa48d660af3720c4cb0c0fec34ddef36d3c467db88f9a57b07f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"69645d92530f5991fb0c1154aa418715dafc9eb9b4b827c33aa742687b00c4fc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"b449a8480f629d5de320a05efeec5a558221dbb03b4dac7572367202e5ec4e3a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"96d049688a520cd26e12f2232f544b815eac1611ab00713e2f641e57b40e5f84\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"05504ddfe67ffabf\\\" || auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"05504ddfe67ffabf\\\" || auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"bc1544ecfcc1a9c24b532fcd9001124011a4a99e354877a6f611310592c512dc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fbfa7264341556b62c34307c6c836c7e015aeca2df10913c89f8c2d9d38fd28d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"787567c7ebc18db7ec0598b9dbf1466caebf9a1d07f97cfb4afbc3f8bc3fd0e4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"03938d68f68953b697b7b9ec3a9bb3205251dab0d8c28c8488a51872990c74d6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"0d7a95a011dd25d93bb4476331e0b43d38df072b07b758073c5e89ae27e7c6e3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea4599ace477623ac871dedf5650245e6a589cd60cb7c50944431b6bd5453ebc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"05504ddfe67ffabf\\\" || auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"05504ddfe67ffabf\\\" || auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"06aff6eabb02cda098099e156015c1b3f2389b929e7df774b34188d1589de73e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"463f896d9e9b5a3f2518e764053718a018fbe93828587f90cc4250e5a67a2236\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"88eb8224ce85abcb39e51aee14e03c01d32d86bc4f686e66279e969a1413d263\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d2e0eee1c8e9f13da0b4cd4af8a834f482ac80e1620cc44747922a7c61d6a51b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"203a868aa43281568c0e425caebe830e36d9bb16cabaf6e7dd92722711d4e496\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0dcf2663d1fa4c3fb5056f3703d9d1a316345e3f4ea0e2503f77738258a9e6a2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"c4e555c424bbb24fa529375505443d3163dbb2379b150d3ae00c6689e4123fae\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"29a6e78291fb6eb1600fcc523c35316897713ec3a1f3092074998de0701a2bff\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"220018b07e05f37b279946d5b903a8c5295a21774b20d317b40db4ae44ab089f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea78fba3abdfbae2cfbad8389b4c97d45d924dfb8eebd29422ca7a2b62f9564f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"86fdf51aa1b29a978535560d7a45ad778e5802bfe467d27e1295c743248d1507\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"dcddce6770eda2db3f8f60d8b51b5ed927194e11c56d328f35000b6f5e92dbdf\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"05504ddfe67ffabf\\\" || auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"05504ddfe67ffabf\\\" || auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"df9a2fd989201e2d0ef8377583b501f9afac6836df894071bbae9e6b6b2598f4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b8e8a49e358e54b12e2aba59e563ba17bcf32315bebde13a721f3b7ebfae18ba\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"742ed2fd7d94f5d252aeaa965657e054bac8691ea31b81375ab8a5488c2f2888\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"327ad026e5a9c61ed15c52c9e2fb0c219e4d9a636a17ed736f525f2b42ebfd6d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"8b45807e9f971b175f77e49aa0f5e281c0245f33f6942f95c36aedfd7d419199\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"59093ab44195ceb3a72fd7400b422644d3d7c840cd3e838bafbbcf827cbcc073\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-0c9014\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-0c9014\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"bde801ad48bcba39a3cf88516077f8fad94dd2ce0692d0f274ab650cb9cc6614\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fbf5e5a312486cd624620a8628b976f89d3b75ffa1d3e47224c08e003294432f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-0c9014\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-0c9014\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"047906c5f7db776a9bd905e481a3347b0c84bd6edf626dc5626ed91115c7408a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cbaea0f78f7b655ed1c234a9fbf7020e12e29bee546d39c314b814aa1692620f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-0c9014\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-0c9014\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"1e414f5eaffdbc43cdaeda8552267e2b46abc1a6b41adfdb24735f3843a9c51f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2ab986aa56245948b966f417e9db684ac2bae70862e05b68a996c57de4d7c4c9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-0c9014\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-0c9014\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"3f61be5c1cb2e788fb6ec123b23519795a5d4fa05fbf9eb842b61931843e1834\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"83f9aef31a325eccb5ee1ca5935289e892a53f7f9d05ac2a6d2b8a973624d6db\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-0c9014\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-0c9014\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"ead8e640f12ec2a2a5b9632dbacd377499d067469c52a5e5c7791f29393639d3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"93867ab0bab47561de7ff57c3a2f54a4e134cfb5a3ee35d78ee703589d669077\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"05504ddfe67ffabf\\\" || auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"05504ddfe67ffabf\\\" || auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"760f6f0b0f0dfc05ff96616a7ebd6878ae6a8e384823348a74bc46e7ee6e70ab\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"06c24ca69f585351676e3a47fdf7a96df9b9a8fe85641e1c3348c8cfdfe446cb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"2089b2caaee71efefb7e26192d15a3376881340fd07cbc304d192587b50b0c07\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f713c09235fdc689702761ce6f8fb3c2c03ea75f66382e5121160a24cf7aee9d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"78522ace7509d509793c07978801f1f4bab7d64f1ad59df33af972c953cd6851\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6b6f55f762b51c1f46156308a7f509359377c543fd3789f104b3416ff46e3216\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"06aab5232bb89b6e09b9780286eb3fceeee4557f3ea4efd5ede8278ad6c21170\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-worker-w0-0c9014"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-worker-w0-0c9014\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:52:21.364Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to delete envoyfilter object","gateway":"openshift-ingress/e2e-praxis-b-942164","envoyfilter":"openshift-ingress/kuadrant-e2e-praxis-b-942164","error":"envoyfilters.networking.istio.io \"kuadrant-e2e-praxis-b-942164\" not found"}
{"level":"error","ts":"2026-11-02T21:52:22.255Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w0-0c9014","namespace":"e2e-models-e2e-worker-w0-0c9014","uid":"4f647df6-1d5b-433b-b4fc-1279ff1755f7","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w0-0c9014\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:52:22.373Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w4-d6cb38","namespace":"e2e-models-e2e-worker-w4-d6cb38","uid":"486176e6-7786-40c4-9ce0-6f4a68b408b2","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w4-d6cb38\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:52:22.730Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w3-f51151","namespace":"e2e-models-e2e-worker-w3-f51151","uid":"e3340067-224a-43ad-8020-ca9e00ead152","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w3-f51151\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:52:23.160Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"distinct-w3-f51151-kserve-route","namespace":"e2e-models-e2e-worker-w3-f51151","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"distinct-w3-f51151-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:52:23.287Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-praxis-b-942164","error":"gateways.gateway.networking.k8s.io \"e2e-praxis-b-942164\" not found"}
{"level":"info","ts":"2026-11-02T21:52:29Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-praxis-b-3c7706","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-b-3c7706","reconcileID":"eaf69b5b-0307-4500-b162-133a3da80b05","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-praxis-b-3c7706","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:52:29Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-b-3c7706","event":"CREATE"}
{"level":"info","ts":"2026-11-02T21:52:29Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:52:30Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-02T21:52:30Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-02T21:52:30Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:52:30Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-praxis-b-3c7706","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-b-3c7706","reconcileID":"1affab6a-9031-489e-a3c6-a8881660dce7","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-praxis-b-3c7706","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:52:30Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-b-3c7706","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T21:52:30Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:52:30Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-02T21:52:30Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-02T21:52:30Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-02T21:52:30Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:52:33.033Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","AuthConfig","HTTPRoute","AuthPolicy","TokenRateLimitPolicy","EnvoyFilter","Limitador","Gateway"],"eventTypes":{"create":2,"delete":11,"update":27}}
{"level":"info","ts":"2026-11-02T21:52:33.169Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:52:35.053Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:52:35.241Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:52:35.241Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:52:38.232Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:52:38.238Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:52:38.244Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:52:38.244Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:52:38.246Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:52:38.250Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:52:38.399Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T21:52:40.206Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w4-d6cb38","namespace":"e2e-models-e2e-worker-w4-d6cb38","uid":"486176e6-7786-40c4-9ce0-6f4a68b408b2","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w4-d6cb38\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:52:40.720Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-distinct-w3-f51151","namespace":"e2e-models-e2e-worker-w3-f51151","uid":"f999400d-f0dc-4bbb-a149-d69388fc41ec","error":"tokenratelimitpolicies.kuadrant.io \"maas-trlp-distinct-w3-f51151\" not found"}
{"level":"info","ts":"2026-11-02T21:52:41.294Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:52:41.295Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:52:42.503Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","Kuadrant","AuthPolicy","Gateway","HTTPRoute"],"eventTypes":{"create":4,"update":4}}
{"level":"info","ts":"2026-11-02T21:52:42.638Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:52:42.646Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:52:44.756Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:52:44.925Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:52:44.925Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:52:45.253Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:52:45.441Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:52:48.626Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:52:48.633Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:52:48.637Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:52:48.637Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:52:48.626Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:52:48.641Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-11-02T21:52:48.747Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-praxis-b-3c7706","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"kuadrant-auth-e2e-praxis-b-3c7706","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-praxis-b-3c7706","uid":"f7acdca2-f093-49ea-ba06-65d8698226a2"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-auth-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local","port_value":50051}}}}]}]},"name":"kuadrant-auth-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-praxis-b-3c7706"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-praxis-b-3c7706\" already exists"}
{"level":"error","ts":"2026-11-02T21:52:48.749Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-praxis-b-3c7706","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/ratelimit":"true"},"name":"kuadrant-ratelimiting-e2e-praxis-b-3c7706","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-praxis-b-3c7706","uid":"f7acdca2-f093-49ea-ba06-65d8698226a2"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"limitador-limitador.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-ratelimit-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"limitador-limitador.kuadrant-system.svc.cluster.local","port_value":8081}}}}]}]},"name":"kuadrant-ratelimit-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-praxis-b-3c7706"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-praxis-b-3c7706\" already exists"}
{"level":"error","ts":"2026-11-02T21:52:48.750Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:52:48.750Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T21:52:48.765Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-3c7706","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-3c7706#rule-4"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"e56184489c8a08052ac4e3a9c868c0f2bf5cbb5e2206bc5e78b6d47312c445aa","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["e56184489c8a08052ac4e3a9c868c0f2bf5cbb5e2206bc5e78b6d47312c445aa"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-b-3c7706.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-b-3c7706.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"e56184489c8a08052ac4e3a9c868c0f2bf5cbb5e2206bc5e78b6d47312c445aa\" already exists"}
{"level":"error","ts":"2026-11-02T21:52:48.833Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-3c7706","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-3c7706#rule-6"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"a9cfab4dee1081bfcc7b618cb58ae36fc9c49b8e2b26b899c1807178fca8c87d","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a9cfab4dee1081bfcc7b618cb58ae36fc9c49b8e2b26b899c1807178fca8c87d"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-b-3c7706.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-b-3c7706.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"a9cfab4dee1081bfcc7b618cb58ae36fc9c49b8e2b26b899c1807178fca8c87d\" already exists"}
{"level":"error","ts":"2026-11-02T21:52:48.923Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-3c7706","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-3c7706#rule-3"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"de0d805f3826b837284e5cca2fc58406c648b6e9332a019d49bdf318c846a7cd","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["de0d805f3826b837284e5cca2fc58406c648b6e9332a019d49bdf318c846a7cd"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-b-3c7706.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-b-3c7706.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"de0d805f3826b837284e5cca2fc58406c648b6e9332a019d49bdf318c846a7cd\" already exists"}
{"level":"error","ts":"2026-11-02T21:52:48.995Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-3c7706","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-3c7706#rule-1"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"201c10375b73212bcc98e077fed390b4de9f61c5e39c038588ca40148514dec1","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["201c10375b73212bcc98e077fed390b4de9f61c5e39c038588ca40148514dec1"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-b-3c7706.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-b-3c7706.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"201c10375b73212bcc98e077fed390b4de9f61c5e39c038588ca40148514dec1\" already exists"}
{"level":"error","ts":"2026-11-02T21:52:49.067Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-3c7706","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-3c7706#rule-5"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"323178fa83a1efa41905caf97801bbc5f5ddd425df8246a546a2100d28797d9f","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["323178fa83a1efa41905caf97801bbc5f5ddd425df8246a546a2100d28797d9f"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-b-3c7706.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-b-3c7706.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"323178fa83a1efa41905caf97801bbc5f5ddd425df8246a546a2100d28797d9f\" already exists"}
{"level":"error","ts":"2026-11-02T21:52:49.136Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-3c7706","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-3c7706#rule-2"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"a39665f55e0cac822a1aab86029467ea93e90af6ab75122f73087728caf0470f","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a39665f55e0cac822a1aab86029467ea93e90af6ab75122f73087728caf0470f"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-b-3c7706.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-praxis-b-3c7706.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"a39665f55e0cac822a1aab86029467ea93e90af6ab75122f73087728caf0470f\" already exists"}
{"level":"error","ts":"2026-11-02T21:52:49.412Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-worker-w3-f51151","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T21:21:31Z","generation":17,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"8871137c-7f6a-401d-a6db-2983aea5ba22\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:52:11Z"}],"name":"kuadrant-e2e-worker-w3-f51151","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-worker-w3-f51151","uid":"8871137c-7f6a-401d-a6db-2983aea5ba22"}],"resourceVersion":"78093","uid":"c24c0550-6758-4dca-8d2b-3fe32740d122"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a05d7e315cc7cde173ab18a777672d3a18ce0a96f8f52d505404dcf8d1e51c20\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"0e7c31c41adb0d3f9efc929ae631573fe0c783a2fa7edb7a4b135081c2969bbf\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6c73e108ce3d5ef8ece11651aca73aa00bd88530b6aba861d23ca7b6ff89ba5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"aedbd7ef0308fd9494e9a3a1386b732923d5d060acf5a188601898d4867d320f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7b56d8e34a0de188e49dc0ae60057e421eb8bc4643546e49b2fe810120869498\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__077b0935\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"471bc33583f218d6\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-distinct-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__077b0935\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"471bc33583f218d6\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-distinct-w3-f51151\"]}],\"name\":\"b6389ab82133347e2514a4ad1cbd9d34042edc9a4ad044714155dbb2aecf38d4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a942d85d233c0e2e8932f598b5b8c9b97eda0ae826b5a80a742559b36fa56979\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__252b7b15\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d7d0ef30e99b1daa\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-distinct-2-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__252b7b15\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d7d0ef30e99b1daa\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-distinct-2-w3-f51151\"]}],\"name\":\"85e7f37f931469abe1b396a1a44b52a8b72e6a4dc98ed0ebdd61e43f0486de13\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a05d7e315cc7cde173ab18a777672d3a18ce0a96f8f52d505404dcf8d1e51c20\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"ec8a1b6bbf984a67cda63e2d923bfa9d2d66a7537f676f6198c12cbca9103517\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6c73e108ce3d5ef8ece11651aca73aa00bd88530b6aba861d23ca7b6ff89ba5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"5c9b9ac2bc33c747eb54045ee2511e3c8b2ee9737a3f347afb75903f43d74fb7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7b56d8e34a0de188e49dc0ae60057e421eb8bc4643546e49b2fe810120869498\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__077b0935\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"471bc33583f218d6\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-distinct-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__077b0935\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"471bc33583f218d6\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-distinct-w3-f51151\"]}],\"name\":\"f82b9432930517e02d229f4fdbdd8b6700b061d5d333fe35b064a3bb85f58e76\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a942d85d233c0e2e8932f598b5b8c9b97eda0ae826b5a80a742559b36fa56979\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__252b7b15\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d7d0ef30e99b1daa\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-distinct-2-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__252b7b15\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d7d0ef30e99b1daa\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-distinct-2-w3-f51151\"]}],\"name\":\"6d321a24ed09abad642dee549f0c7cbf98ce40481beb85ca79bd3d4eeb89b77e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a05d7e315cc7cde173ab18a777672d3a18ce0a96f8f52d505404dcf8d1e51c20\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"a54bd689e670e5f8bbee0a66c2585a4d4adce9a5a7fc297449ee3b816a0c2695\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6c73e108ce3d5ef8ece11651aca73aa00bd88530b6aba861d23ca7b6ff89ba5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"ad845c31a125851bf4cc5ae7e83bb4a011cf98484d99780ab16df250ca9dd41c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7b56d8e34a0de188e49dc0ae60057e421eb8bc4643546e49b2fe810120869498\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__077b0935\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"471bc33583f218d6\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-distinct-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__077b0935\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"471bc33583f218d6\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-distinct-w3-f51151\"]}],\"name\":\"9eefe22cd9d7f4d324cc07e6422d998261fea96e9069bc938fe66a94e8c8cadb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a942d85d233c0e2e8932f598b5b8c9b97eda0ae826b5a80a742559b36fa56979\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__252b7b15\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d7d0ef30e99b1daa\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-distinct-2-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__252b7b15\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d7d0ef30e99b1daa\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-distinct-2-w3-f51151\"]}],\"name\":\"b00ec38cf5be980b160374be347b182afaa16e0dc99314a5e990f20cef6d57ed\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a05d7e315cc7cde173ab18a777672d3a18ce0a96f8f52d505404dcf8d1e51c20\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"6d5d9aca320022f0f8b70c3f9b34b5922adf537f5da717ec79924566febf6df1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6c73e108ce3d5ef8ece11651aca73aa00bd88530b6aba861d23ca7b6ff89ba5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"346e75cab49a1cf8ae89d90cfb32099256f44d7909e40cdc730e951946a411e2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7b56d8e34a0de188e49dc0ae60057e421eb8bc4643546e49b2fe810120869498\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__077b0935\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"471bc33583f218d6\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-distinct-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__077b0935\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"471bc33583f218d6\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-distinct-w3-f51151\"]}],\"name\":\"ae0a4172fa23a6e8857123675126f34bcaf4e08f94c05663e2913801fda46401\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a942d85d233c0e2e8932f598b5b8c9b97eda0ae826b5a80a742559b36fa56979\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__252b7b15\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d7d0ef30e99b1daa\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-distinct-2-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__252b7b15\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d7d0ef30e99b1daa\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-distinct-2-w3-f51151\"]}],\"name\":\"ee0931c3dc206732c58bab1add9bf2cb602a2eb21bfa9272c2df596197dceb3e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a05d7e315cc7cde173ab18a777672d3a18ce0a96f8f52d505404dcf8d1e51c20\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"3f6b6643d5731a355a44968b83b24169ff3e0c1b36737d8be7f9d42e1def7c3e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6c73e108ce3d5ef8ece11651aca73aa00bd88530b6aba861d23ca7b6ff89ba5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"cd8ab5f89e71494c8d176f9668b8ed279bd244e6f70d1a5c87603877b4b7182d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7b56d8e34a0de188e49dc0ae60057e421eb8bc4643546e49b2fe810120869498\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__077b0935\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"471bc33583f218d6\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-distinct-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__077b0935\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"471bc33583f218d6\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-distinct-w3-f51151\"]}],\"name\":\"09df06c068a0d1324c44679ca0c022e74cd18bae1497d0087fb2184f9401d63b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a942d85d233c0e2e8932f598b5b8c9b97eda0ae826b5a80a742559b36fa56979\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__252b7b15\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d7d0ef30e99b1daa\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-distinct-2-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__252b7b15\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d7d0ef30e99b1daa\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-distinct-2-w3-f51151\"]}],\"name\":\"821121f5584e938a01b323996203984576204f894f2c9f09f5ececcdc058373e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a05d7e315cc7cde173ab18a777672d3a18ce0a96f8f52d505404dcf8d1e51c20\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"e00f3dfbbce60a718137b415a42cbf1e65a7b226437cc4600d9fa76b264e3b4d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a05d7e315cc7cde173ab18a777672d3a18ce0a96f8f52d505404dcf8d1e51c20\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"7ddf0d6bdcfc6aa206cdc0919b1d5b7545c903aafbb0e16d393016b1a83bd29a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6c73e108ce3d5ef8ece11651aca73aa00bd88530b6aba861d23ca7b6ff89ba5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"fe3b37fdd5d3f9d3bdf7d03b186d964b283bfbe7d3ffa720457517666c3070a2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6c73e108ce3d5ef8ece11651aca73aa00bd88530b6aba861d23ca7b6ff89ba5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"7dd9491b4755b4900c5bc55b4dd9aff38f99899f0236e4d21bf7c94e5769cbb1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7b56d8e34a0de188e49dc0ae60057e421eb8bc4643546e49b2fe810120869498\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__077b0935\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"471bc33583f218d6\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-distinct-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__077b0935\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"471bc33583f218d6\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-distinct-w3-f51151\"]}],\"name\":\"fa5430186b33e56d19e4d2e0209b4f2215d17b488745cd8061eb5ecaf96ecafa\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7b56d8e34a0de188e49dc0ae60057e421eb8bc4643546e49b2fe810120869498\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__077b0935\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"471bc33583f218d6\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-distinct-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__077b0935\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"471bc33583f218d6\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-distinct-w3-f51151\"]}],\"name\":\"cd88af3d71345ad9b32dfae02550fa9bf6aa0cddfac2d0464a60cd90b9898d74\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a942d85d233c0e2e8932f598b5b8c9b97eda0ae826b5a80a742559b36fa56979\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__252b7b15\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d7d0ef30e99b1daa\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-distinct-2-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__252b7b15\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d7d0ef30e99b1daa\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-distinct-2-w3-f51151\"]}],\"name\":\"2182ac070ac99ffbeb246624e36aa202ce8c626bd38aaa3191f5e60a408bc782\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a942d85d233c0e2e8932f598b5b8c9b97eda0ae826b5a80a742559b36fa56979\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__252b7b15\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d7d0ef30e99b1daa\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-distinct-2-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__252b7b15\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d7d0ef30e99b1daa\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-distinct-2-w3-f51151\"]}],\"name\":\"97e41dd7c810563f2cac2a1c963d220c840d6b756c6c76b0cf97113387aab38b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a05d7e315cc7cde173ab18a777672d3a18ce0a96f8f52d505404dcf8d1e51c20\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"a00edc25239da061cd0457625d6046ede5f9d09507c78c2209e1e992795831c9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6c73e108ce3d5ef8ece11651aca73aa00bd88530b6aba861d23ca7b6ff89ba5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"fbd557cfa232fb43236e5864400cd1522fbf21d014450df4a714ea2d3608e863\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7b56d8e34a0de188e49dc0ae60057e421eb8bc4643546e49b2fe810120869498\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__077b0935\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"471bc33583f218d6\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-distinct-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__077b0935\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"471bc33583f218d6\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-distinct-w3-f51151\"]}],\"name\":\"f809ccd15563984c9befad8f50ee38613b9c34eda0af01f561e75be88cba33ab\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a942d85d233c0e2e8932f598b5b8c9b97eda0ae826b5a80a742559b36fa56979\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__252b7b15\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d7d0ef30e99b1daa\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-distinct-2-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__252b7b15\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d7d0ef30e99b1daa\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-distinct-2-w3-f51151\"]}],\"name\":\"749b6bc66485455bb3cc5a0d552c38935bb446a6be85e306d894e6cbb4d92c08\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b31ddb7ef02e35e9d172430b50a004a3047564232880010bd3e581bf0dc547f8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"a1ec0f0592798b3996117a17734b0936906621077ceec69c81d8fb77e89a142a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"75a5abd89bb4e6258c7f7c7be472e6131799539dbbb87686c1010afe2791e45e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__252b7b15\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d7d0ef30e99b1daa\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-distinct-2-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__252b7b15\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d7d0ef30e99b1daa\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-distinct-2-w3-f51151\"]}],\"name\":\"3ca8a6339da3e4298e514bea168ac30f6c718d158fa0efc5e0fd85f06754a528\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"72bb4e3923485ca35015ee8655bc43ee332eea77f2cd8effbd48b21828f89f80\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"879fe62fbbe8b0a130140cda7f546611c758fb8fa416f173d2b0cf3da17d7941\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ed162da516e04d5229dc1d49e1c785e9db374ba4ba028ecabbdccdcb33acd1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__077b0935\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"471bc33583f218d6\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-distinct-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__077b0935\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"471bc33583f218d6\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-distinct-w3-f51151\"]}],\"name\":\"b43372d2a0820427086903362809a4a0c757cd1d6f593ba48a755e5fb972575d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f9603ac54a5668b179c6ba3dcda3951e57253a5ad5ad80214b563f50337f3a9c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"7caf859dfb9739029a8c1b13adba06164610495beddbda8e01fd7b432b15f4c3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"775fdec32977b769224a6d9530e33a1b93a2948f54e3f459e979da99f7def4ea\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__252b7b15\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d7d0ef30e99b1daa\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-distinct-2-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__252b7b15\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d7d0ef30e99b1daa\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-distinct-2-w3-f51151\"]}],\"name\":\"5cebae68b5e59e34a98c9c038f83d877f079732894ec3403d349e0b7ae0c9099\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6ab1b21b6f75f2c1ef86f9bcf36a6c25244e88430832e3ac86a839cf10bb8dcd\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"15ecb8224cf6049c2e831c815cc4f0aed954432b967d01d55ea637294f3ea87e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8b2fbdc0f4b402fd19fb549b70da796c6867a52206fa0420df2d6debc0db70b7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__077b0935\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"471bc33583f218d6\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-distinct-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__077b0935\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"471bc33583f218d6\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-distinct-w3-f51151\"]}],\"name\":\"7cb303fae9824d31834d539772c1840fd2991481566b7d07635c9284c524ae4d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a649343311197c716e0b6f502bb8ad21ecf4e207e16ffc6e0b74b1dc4f05f7fb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__252b7b15\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d7d0ef30e99b1daa\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-distinct-2-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__252b7b15\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d7d0ef30e99b1daa\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-distinct-2-w3-f51151\"]}],\"name\":\"699e8723136e653d04a8800a9289a3543f733ebfd0f99efbedfd18d22de4c281\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a6267fc785126adca5b68df13f95ef1fa08e1d72b66fbff01b54f8d61edaf7ba\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"9a72bfcef40a8da2865b02b6123c023d9f4f17c11a2ff674e3ed24af23e468e2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a6d41f4e9f57ec1e6bb4423e49991033d85f00a2a3303e02b25d1eedb67be3c9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"ad4137b1e753fd100088742941c8aaee9eaddc158bbaf221eb0d7318bdb8dfb5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6610d72af8a18be17c09082b4389a248d739315be17e0e146375e82e8d76261d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__252b7b15\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d7d0ef30e99b1daa\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-distinct-2-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__252b7b15\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d7d0ef30e99b1daa\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-distinct-2-w3-f51151\"]}],\"name\":\"66a5afc61110ab52ae4b9c9d79944467f91c4a2bd7b954ed8f59e651c215c630\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aea6441051c6a7490e44d5f7bab0e4bf7cf461c9597675611789e8d9141a446c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"c871ffab27f7ed925d56fae005e70fd3716aab799f0484d7d44519e915491d11\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"be7879d2a6daa00da89abfe5895a77787208f1af5b8582c79c8dd2849ef7906c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__077b0935\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"471bc33583f218d6\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-distinct-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__077b0935\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"471bc33583f218d6\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-distinct-w3-f51151\"]}],\"name\":\"461ea56b8a105dbd1d386b531c80b5a86960df99b24b6f6668520921b280a609\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7f4456bc894bf7ab59ba02c25915a8db007a89ffdd1efcace437a7761c68b3f9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"aedfea0f1dceed2b1af07ebf6e7dbc55cdc958ea5a084291f6216a19f63eae8a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f23dfebb92a3f3d59997030cce08899533ec20be47590cd866dd896392db04de\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__077b0935\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"471bc33583f218d6\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-distinct-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__077b0935\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"471bc33583f218d6\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-distinct-w3-f51151\"]}],\"name\":\"f42d6cbc7a49b6c1c4f0668dc536500321a8f658d1ab1a3a8b2ad8c0a95b272c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c57cda59d33d438c637a64dce8619a9616880a275363557ccc83d2cbc4920e14\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"1a3df8e6f6ad36c3eb928970ca2e746005e16b25405fc6eb9f44977b07d56905\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"086314a2fc965880bf769a18d3353909b6a1e5544e7eb514174994ba24387652\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__252b7b15\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d7d0ef30e99b1daa\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-distinct-2-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__252b7b15\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d7d0ef30e99b1daa\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-distinct-2-w3-f51151\"]}],\"name\":\"8e63847006a8d1952318fe3b6d2707027991d1c00d7959d051b3baf72690aecf\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f1def6d908410a124665ecd632ae01e5ba977920643dab1a35d25277292bae55\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"1199947fd30f0d1dab3db5846b8d27e36b6284be94834b798e4004120ec52532\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"676709317386301aa762cc48b7aa0064bc03adc00abbddfda8d0294046751d34\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__077b0935\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"471bc33583f218d6\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-distinct-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__077b0935\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"471bc33583f218d6\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-distinct-w3-f51151\"]}],\"name\":\"8a51327014eb82d6df6700b3f79ae6010cc76b2ee750f56ac5cb49c5b6f975ed\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d8557b9861d48e5714a954e0a885ecc7e55e6b9f034fc9f24f4c5c2f6dafce5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__252b7b15\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d7d0ef30e99b1daa\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-distinct-2-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__252b7b15\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d7d0ef30e99b1daa\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-distinct-2-w3-f51151\"]}],\"name\":\"91c8ce1078dc4a26a7cb0af054981aa28b4768dcd87a9a167f98e9b4e4b60325\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d63de28626482cf5fa2aaf12cb9aa3def86d637d4c98f193819331c36fa73b21\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"fae01409c891b630fc644ebf1b8bc640438a1fc79de2b0750d34e2a6388d4ca6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f86615df74e8d3814df8817b06dc7578a4b0af0817397c5bdddb1daaaeb1df4e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"2d972852e655bb76327ea47e134854d589cf64538813171d00544a81dc138f4f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ca57331ce8d0c8497c210605ffe8878f757d572164898f4f870b89fcf2f9f1ed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__077b0935\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"471bc33583f218d6\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-distinct-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__077b0935\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"471bc33583f218d6\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-distinct-w3-f51151\"]}],\"name\":\"1ef135f8dcdcaa663d4184fa6364518f7001a744380301035f254e16acdad0b7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"06c1a51758821d18e14577dc995b939fe472579672223b3bf0c1a312b23f23c4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"a90d5652afa4bbc65c24ada88ebb0df97a9c759ab0004d0c85d28f7e4c012bb9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/premium-w3-f51151/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"acbe19c11dc0fe08b370bbe647de6ecce77849e75c774c3e46f4a7af09e2861f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__252b7b15\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d7d0ef30e99b1daa\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-distinct-2-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__252b7b15\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d7d0ef30e99b1daa\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-distinct-2-w3-f51151\"]}],\"name\":\"b1fa0497afe070203ab9c23aef75e896659b83c8305ca7a56664d1717528e732\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7b5f8cd8dfbddc7109fd206805e23a6ae21c18bf406c0001927759ff1a39122f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"64238089f4803f45c8353b0d5d05ac6a23d6a3647106591fdc2bd5299c0b0759\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fd143bc18213c3c4682bcced572bcf84c1cbc8cd87ea188e96c990f164fd5ade\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__077b0935\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"471bc33583f218d6\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-distinct-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__077b0935\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"471bc33583f218d6\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-distinct-w3-f51151\"]}],\"name\":\"3ede2f522e381a5e5b8affa5afed6ede7d3894cf263c247dca9b3f3f3ad4a676\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cf25727b6a9419d97ed5dc9613d3b6a26e590c05f01b5c4038461accc96bc026\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__252b7b15\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d7d0ef30e99b1daa\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-distinct-2-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__252b7b15\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d7d0ef30e99b1daa\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-distinct-2-w3-f51151\"]}],\"name\":\"fb213d7be796970427643a4a818af11356ba854b3a0477e3c48bc2ef3332c7d5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cb9167704c77a112808785ad099bc015c57786c61e7befec251b029ce378a0c6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"ef8b5b3a53f3de47fd70ccb56be2422e84d7fb1f10a03b64c032baca50a33c79\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9a4beabc5e6770b1db0aae064836730685e70fcacd601193f69aafe8156d41a4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"667e44e20cda74056b10928af7322c52f17d044dda1b5aded34df466201c3e4d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/premium-w3-f51151/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fdd358955bc325dacf4ae3d584d9dfaa236b2605d42014543bcddb868221d0fa\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__252b7b15\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d7d0ef30e99b1daa\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-distinct-2-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__252b7b15\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d7d0ef30e99b1daa\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-distinct-2-w3-f51151\"]}],\"name\":\"0a4335c7c536062bc1f3c4f55fad89ef387858062864c877a3014c384192a4f5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"91d11ef27666b7f1f85063266e00a4add2242586a1e8a4bac5447b3f4ec7925d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"26827917812d006281f7f7ba6e53d3573012708364624693432b2cbdd0f434b5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"79bf752ac34000e70b4860b3a87054e1aab2babf35019e7e24d203c82f5f1c70\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__077b0935\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"471bc33583f218d6\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-distinct-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__077b0935\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"471bc33583f218d6\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-distinct-w3-f51151\"]}],\"name\":\"e8683890d73b71f6556b533ec6f92b30804817a025abb3d3c716a89f9b3f85d9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"707f7a9a5bb373d466ca8ba9e6220842edd61bdf74768cdb8760aca4648a21b3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"b90f395e8ebaa67a3ab9ee2a967d88bbf981033415dedacddf2e76a8347bfd39\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/premium-w3-f51151/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a40304ff6b4a0f6c57da3d4a6bcc549a18c94ce2ed3356df2ce4c4621e7d5231\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__077b0935\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"471bc33583f218d6\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-distinct-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__077b0935\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"471bc33583f218d6\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-distinct-w3-f51151\"]}],\"name\":\"ff65bd9a43408c55f0593fcb41763d9030c7823704d875b6050eb2c39b500d75\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ab3c6da9622dba177dfaf10df58f987a09c5bd12e35f73cca3f03ce632140cd4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"9ec2510ba7c20be712eae31e88eb54985eedbb6ce61783804c05db0582107bc2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/premium-w3-f51151/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5d4b7dc290bd7cb2c0c574a9869b31b45107252e6aaf512691b5c665967d6821\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__252b7b15\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d7d0ef30e99b1daa\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-distinct-2-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__252b7b15\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d7d0ef30e99b1daa\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-distinct-2-w3-f51151\"]}],\"name\":\"f6fff5f3b2673f2810cddb2b65518e70b74aad58e6c27ef1faf828a9cdef8c14\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d896bcdf40d08e0bef242ce04aa58467e96c672450af890adda6941c53a574d3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"69bd1c4b3e1b36f5d5d62283b221b7026a4e53da339ac7c470f75cb4334435f6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"16bf1b94bcdc2b222ee7ef5dfdb45298f40e57fcf65f862a63a7b2d64b143143\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__077b0935\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"471bc33583f218d6\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-distinct-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__077b0935\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"471bc33583f218d6\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-distinct-w3-f51151\"]}],\"name\":\"ec2b739c69e9a51aedc6a2ee8ed6e7bbcb37f4eff66695b2c6d1bf4950a2ecb3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3fdafb69d9c72b7e3c78e50b30f01adec907957097c6a1e811ceff68d93d7c23\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"a31568314e38d20d12f5921c57463100edd3022d5f9f3c0b36033d9a4dee9193\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e11ba50523ae86c5c06c5b76176154ed9ba57c3ed13fa43133b1ac7249ce345f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"67192e2ead59827b5990f7b4cbc2aece4271402ddcdfaa76f7cf95d2d4552c43\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b6344fa6f672d55d2eb4fbf6449de24a41dbf664f8e9d3c01ecde50e9d46e233\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"3c429336b45d9712bfdb0d99ecd41baa0dde1570067b941b5927e1894931c254\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d1f3365185f5fcfe92899c5f49af1b579baab97128b8afee3eed4350859c3f14\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"2f17c508c987cffd0b45ebd164fcee3ad66819a39900f83fbeda518ccf619183\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"85124e62247f9234752fedfc382ba93d6f839dab53f49c16951446afa3e613aa\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"6d2c4320e5eae8e51596e1c62f1c7494e1c5f9cd5d374e73b3ddae65dd071a92\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"461f0fb3ed9e91195eaa488b65b6f04cb4bff62087edbcf0d4c2186d180ba0ab\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"994b30d96390325263d89c2da7554eadd9d4fd1811371afabaf057df68e19205\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d13670b5b1696edcb191c925fa86dd729eeb7447f2230e160d9cc03e0117604d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"f70585dfa8966b9748a8978bfdf51d589a9d85f553359b47bfa09ad8bb266b02\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"18b02d50add3a7c29ec6127eedab648f22d172b48224a97365a7798a612dcd01\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"1e0c9c02fbbf3d69df4286ba8224f5543dfc90c1df5aa687b5b6f1c00dce4d56\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3f0daf8882dbe2b0594c2bb310f151a319cec601c5028d24f0d4557684bfb5f1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__077b0935\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"471bc33583f218d6\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-distinct-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__077b0935\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"471bc33583f218d6\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-distinct-w3-f51151\"]}],\"name\":\"4d8ba792ec63f5d46b5589f993126734f136e3569a1b7639aaea8768dc2c0f57\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a8ad3ccfafcc25ea959dd98788332d9514ad2d762423f3039adff91a3381329f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__252b7b15\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d7d0ef30e99b1daa\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-distinct-2-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__252b7b15\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d7d0ef30e99b1daa\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-distinct-2-w3-f51151\"]}],\"name\":\"b159e4d34dc2a1f6fe05bc0d616c2ebb2d3306defc93bfb6d4035e2f842e1b91\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-worker-w3-f51151"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-worker-w3-f51151\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:52:49.944Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-praxis-b-3c7706","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"name":"kuadrant-e2e-praxis-b-3c7706","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-praxis-b-3c7706","uid":"f7acdca2-f093-49ea-ba06-65d8698226a2"}]},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a9cfab4dee1081bfcc7b618cb58ae36fc9c49b8e2b26b899c1807178fca8c87d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-b-3c7706-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__b48c10ea\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-3c7706\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-3c7706\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__b48c10ea\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-3c7706\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-3c7706\"]}],\"name\":\"6762a423c54dae74b2d867c7f9ef460722f4039829b96350e86f5c62f12b2433\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a39665f55e0cac822a1aab86029467ea93e90af6ab75122f73087728caf0470f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-b-3c7706-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__b48c10ea\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-3c7706\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-3c7706\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__b48c10ea\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-3c7706\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-3c7706\"]}],\"name\":\"eb014591d77d3e9e1274226ff5927dedc018eb9a9d35ca280c5c342d314b0057\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"323178fa83a1efa41905caf97801bbc5f5ddd425df8246a546a2100d28797d9f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-b-3c7706-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__b48c10ea\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-3c7706\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-3c7706\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__b48c10ea\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-3c7706\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-3c7706\"]}],\"name\":\"5f642a06761d65bba18547508b31699581daa2ff8313d5164cdcc1f09cde4d2c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"de0d805f3826b837284e5cca2fc58406c648b6e9332a019d49bdf318c846a7cd\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-b-3c7706-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__b48c10ea\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-3c7706\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-3c7706\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__b48c10ea\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-3c7706\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-3c7706\"]}],\"name\":\"71078740952ed02dd8f96f4a7bb8652215ddef272737af51ad8cb40538f277d3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e56184489c8a08052ac4e3a9c868c0f2bf5cbb5e2206bc5e78b6d47312c445aa\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-b-3c7706-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__b48c10ea\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-3c7706\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-3c7706\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__b48c10ea\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-3c7706\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-3c7706\"]}],\"name\":\"8afc81aad81386a7daddae8767aabf651b446d86023df74ee49d97a394f309f1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"201c10375b73212bcc98e077fed390b4de9f61c5e39c038588ca40148514dec1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-b-3c7706-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__b48c10ea\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-3c7706\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-3c7706\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__b48c10ea\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-3c7706\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-3c7706\"]}],\"name\":\"e00b09080c795bb000bb4fb16f20a734f2c19952b207e120677d64e58fb63c39\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-praxis-b-3c7706"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-e2e-praxis-b-3c7706\" already exists"}
{"level":"error","ts":"2026-11-02T21:52:50.100Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-worker-w0-0c9014","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T21:21:39Z","generation":14,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"ddb57683-c2b1-4246-8c87-c1833e256a52\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:52:11Z"}],"name":"kuadrant-e2e-worker-w0-0c9014","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-worker-w0-0c9014","uid":"ddb57683-c2b1-4246-8c87-c1833e256a52"}],"resourceVersion":"78109","uid":"3a59a593-1a36-4e21-9529-ff8f3620d431"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"86115b8156c50eab2036378ac37ec53b33537f0eef44a4aa5d81752c24254c82\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"c69d9902b654dc255ef5aa6007c01753aa727fc097ae6b83d952cc0cf913761b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bdc9387e460a2dc1a85bc42d8ce6440788e8331159ace91b443c9628ef7c1fed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"2f68643a3c63d5b17fdfef48d85bd91a0973501f0d563a896e4b380a0b00d185\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e1cab00a309f6035001c6bed21b280b9cd6d81b83072c8f351fbe860f69886ad\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__16755e57\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"13d133b6be569451\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-e2e-enrichment-model-ref\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__16755e57\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"13d133b6be569451\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-e2e-enrichment-model-ref\"]}],\"name\":\"d886729ca10572769b8b41e68ee56fb12942ea073f0b48ede22b1cc50bfcc40f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fe65e47ea66e64f823a934786806a737bfe3ca692bad4019774d91daeb2348d1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"e10af8f1a2640cf1de04932f79e79764db98097340db6ec566b3ab0af709d0d8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"86115b8156c50eab2036378ac37ec53b33537f0eef44a4aa5d81752c24254c82\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"34720a2e4d6ed7817a277e99c8b6c63bea050141799be3b70b3690e8575a06a6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bdc9387e460a2dc1a85bc42d8ce6440788e8331159ace91b443c9628ef7c1fed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"3a712e9256a22351eb20be5c7695beb1ebb8fb8ce2b2061a380c7829f310a235\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e1cab00a309f6035001c6bed21b280b9cd6d81b83072c8f351fbe860f69886ad\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__16755e57\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"13d133b6be569451\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-e2e-enrichment-model-ref\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__16755e57\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"13d133b6be569451\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-e2e-enrichment-model-ref\"]}],\"name\":\"24d4dc5eb03a2701700ed1da77fab5dada30f4d5f19acc2aeb784ab7c2913842\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fe65e47ea66e64f823a934786806a737bfe3ca692bad4019774d91daeb2348d1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"95b56d1eb3f5f986a8dcd4728f616565f9664996c1a434f44f7b87c3972457ca\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"86115b8156c50eab2036378ac37ec53b33537f0eef44a4aa5d81752c24254c82\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"f831f6710914a69194c3f7c48e2651f7e183a1e62afcb27c73307245ab045f93\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bdc9387e460a2dc1a85bc42d8ce6440788e8331159ace91b443c9628ef7c1fed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"ad3a2d8079306ff1eeb9734837c5b71f0724eb8028848f90dbf05b80557a363c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e1cab00a309f6035001c6bed21b280b9cd6d81b83072c8f351fbe860f69886ad\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__16755e57\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"13d133b6be569451\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-e2e-enrichment-model-ref\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__16755e57\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"13d133b6be569451\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-e2e-enrichment-model-ref\"]}],\"name\":\"44114992b7dce232405acd1cfada4b72839265de04c15b8c8b12cba013144276\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fe65e47ea66e64f823a934786806a737bfe3ca692bad4019774d91daeb2348d1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"a594b6f1c0a2b22e4714c27e98575eda080192ee3760bdfca9b4ad6aa516eee0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"86115b8156c50eab2036378ac37ec53b33537f0eef44a4aa5d81752c24254c82\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"de21a6b7dab6f53ab9e521b41625d35020e107d76ddb50e2958e0e2a412d9e40\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bdc9387e460a2dc1a85bc42d8ce6440788e8331159ace91b443c9628ef7c1fed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"9d9413f8be4dfb8834299266127fb239516760f378a7601605194b5533f62a28\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e1cab00a309f6035001c6bed21b280b9cd6d81b83072c8f351fbe860f69886ad\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__16755e57\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"13d133b6be569451\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-e2e-enrichment-model-ref\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__16755e57\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"13d133b6be569451\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-e2e-enrichment-model-ref\"]}],\"name\":\"b608ac3153414f90d7bc1d459d441fc96968144e3d07d2286f28927e15b1e621\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fe65e47ea66e64f823a934786806a737bfe3ca692bad4019774d91daeb2348d1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"31897c718cc142df0d5d16918dfaf37807fffedaa54950878ada2e28c78ed1ea\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"86115b8156c50eab2036378ac37ec53b33537f0eef44a4aa5d81752c24254c82\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"0f90af4971cd47ea5ddd60d45eba18a900b5cf23592a3f0ecd9d46778e3738e0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bdc9387e460a2dc1a85bc42d8ce6440788e8331159ace91b443c9628ef7c1fed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"93ac09aaab9c4f036a2bdd254b8b96a4151063abefd4189c40778e53ebecdc09\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e1cab00a309f6035001c6bed21b280b9cd6d81b83072c8f351fbe860f69886ad\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__16755e57\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"13d133b6be569451\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-e2e-enrichment-model-ref\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__16755e57\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"13d133b6be569451\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-e2e-enrichment-model-ref\"]}],\"name\":\"8791484f6beb20141c5c557cf7cec8b4649b67a98f43b54539a6ee6a88bceb5f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fe65e47ea66e64f823a934786806a737bfe3ca692bad4019774d91daeb2348d1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"5009bcd6ede0ee206f1c68b91ea406216f5da58a2b1c5f056ba6778c5f13d641\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"86115b8156c50eab2036378ac37ec53b33537f0eef44a4aa5d81752c24254c82\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"140e618f0bcaa91b635c87d4f29e5f8813bf0436d1f6e9b36373faecbdec61eb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"86115b8156c50eab2036378ac37ec53b33537f0eef44a4aa5d81752c24254c82\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"6acbaeb49e85ee3cb000f040214618990342fd0a59de5b2c5a1f90647758a246\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bdc9387e460a2dc1a85bc42d8ce6440788e8331159ace91b443c9628ef7c1fed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"5b6e6a7f7dc5f0d34eb857ca49303262b3c223fe67458805f41c060248c5dbfe\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bdc9387e460a2dc1a85bc42d8ce6440788e8331159ace91b443c9628ef7c1fed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"2127668fa8fef2292ac1484bc4a37390a4f7d56256dc3e5dbee6c3e5a11a9b76\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e1cab00a309f6035001c6bed21b280b9cd6d81b83072c8f351fbe860f69886ad\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__16755e57\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"13d133b6be569451\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-e2e-enrichment-model-ref\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__16755e57\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"13d133b6be569451\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-e2e-enrichment-model-ref\"]}],\"name\":\"0aa314d93ee3acda2c2d9263c7d5271f8931007a465cca802fa4f97f82de8fea\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e1cab00a309f6035001c6bed21b280b9cd6d81b83072c8f351fbe860f69886ad\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__16755e57\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"13d133b6be569451\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-e2e-enrichment-model-ref\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__16755e57\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"13d133b6be569451\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-e2e-enrichment-model-ref\"]}],\"name\":\"cb70a8e00aa575e704bd5c438dfcc5d7f8961efe6033fd93fae3fc6eca018120\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fe65e47ea66e64f823a934786806a737bfe3ca692bad4019774d91daeb2348d1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"1acbce7018705c04168bda5187e037e60c0fe47f186f10f96e84266e33b5b034\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fe65e47ea66e64f823a934786806a737bfe3ca692bad4019774d91daeb2348d1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"52baf0b74be4e68628b5b4ef71a9d95dad1cf739658ce467c9b24c3165eac562\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"86115b8156c50eab2036378ac37ec53b33537f0eef44a4aa5d81752c24254c82\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"a9b1a49056b3283c82e0d4f88ad61bed5b6f4b736a70f1bb2ef4ba19a80a05e0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bdc9387e460a2dc1a85bc42d8ce6440788e8331159ace91b443c9628ef7c1fed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"30c85ca7419d0f9a695b73530b16cb571b50e9dde62c1210e8c4fe44c14e4def\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e1cab00a309f6035001c6bed21b280b9cd6d81b83072c8f351fbe860f69886ad\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__16755e57\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"13d133b6be569451\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-e2e-enrichment-model-ref\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__16755e57\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"13d133b6be569451\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-e2e-enrichment-model-ref\"]}],\"name\":\"5a52f00c07e5813093290d1bee011f0120610619cb82666a79b0139919644d6e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fe65e47ea66e64f823a934786806a737bfe3ca692bad4019774d91daeb2348d1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"309ad48f4f9314f702e5565256eb6d81567787f6737820f7ffb21a6d85a92b93\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"00c4d48b9f06a2f5dbb9cbe22ae3dcc9e10401b038e62058849dcebe2769e4f1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-0c9014\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-0c9014\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"02e0339b7fefd72794f04b407e26149d4822a36b0c408bf1129e0f7ccdc0cfdb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"884ebceaf8f5da21059151f97834277770ed77023feb57f83fc8c75e495f8d1c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"bb55cf856b87c0953ba4478213144ef02787b3cbbf80cc32e530521407ee40b0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7da280ddad70ebcc1b84b8a595244d0682cd0302755439371683331c4562cfe5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"23b1ef8cd3219264f8227915650891004d0dbf97a799031e0e6e6967fcd5f1c8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fe169ab2014a705a54df2fda4ec719f7132fd6bba54202f7531ce8df8da2bdf6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__16755e57\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"13d133b6be569451\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-e2e-enrichment-model-ref\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__16755e57\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"13d133b6be569451\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-e2e-enrichment-model-ref\"]}],\"name\":\"5f4fc30622e992160dd04a2ed38f7e44c1794374d6682ae9f1f7ca01be3ee831\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8cb0b0d9cbe25e4182aea7d2ed6f3ca636a7d0c9be364f722b182dde26da45e1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"ca6fe2da7884bdf4da7e4fad467882fb9f7b1a542ef29da25c93b58c0a2facf5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5f8a52baf63f9e4c9ea31b6e22c9076262e33bc06968bbcb213439af05ae3a21\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"4e45e802c43f08adeba0b390be3827705a757991fe469c439db480762890906f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9a7eea6dc0fbfacc7f1b1980a90d1b04de88692dd5758d6a6457477b77a64673\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"0657b3667bafd18f07dc410bc515b76f51256e8c487baf4fe36409a313e6191e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ece9796b491eeaad9788ab6c426bb54d8cbb85433a9010ef2c4d3f579cca0db0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__16755e57\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"13d133b6be569451\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-e2e-enrichment-model-ref\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__16755e57\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"13d133b6be569451\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-e2e-enrichment-model-ref\"]}],\"name\":\"5b95fd1a3cba680d3078cbfcc3ed349106804d68df9ff279d7829f1ce54c9fcb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3d645f3ac772a0cc5a9a71b4e6a542a2b2ab9962190903cb5d89d3e8e45b7f9d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"d61768c90b21a96135005ba91b0f0abbf7ffc2bd4f372c506a740a4d2280118a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bcf1ddf402fe28df1f45e616a2e2380b51177c45a7f8dcdd03bc2aa6b5814d26\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"0d7aee7ae66dd59feb746b56375d3063a0a395dd032211e5f6fd8a79acc4c534\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4cc208f8f31098b1cdf91b5776a85b52bae0339e659b20995e8ad11208703993\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"d480cd881add8aa6a454eefd0ff4a4f1883e0f31dd0af2c4fc8d49930dfd988a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"096fbc9d544918ac5b9d60464268ef3b1f03546e96ed130c743da74445576f52\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"862991ab77df3e7a553882c71a94c90c8006da4badbb5d62b2523a0c2ae8397b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"228ec96802a09009d984b3728e4e96175fefb32ba2e3b918071e85b3f8ec79d0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"1174da5781e0d01a3f99ec7d577f0c792e9d2f3d97450b0297d625c782aae7c6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6d14c0784badaddad1e95c3697462cedd1c5a5cf32d3a98f16155abc0721429e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__16755e57\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"13d133b6be569451\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-e2e-enrichment-model-ref\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__16755e57\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"13d133b6be569451\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-e2e-enrichment-model-ref\"]}],\"name\":\"c6601f905085efd63830b0439c759fd2e17f4b3a0625b37e6ca853dfb418a3fe\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"669fd13dfb6f84f6e255bbee071a63253e1d5bd80a372cb6a445299b3c53a1a6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"aae79ba1b6eabe4b8be62d566c21c48755697af6a5a955ca0108115f218409f6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b0bfe3b1d3a080ff25e482046cf0d1df0ca30a090ef9f8424787467410af7627\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__16755e57\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"13d133b6be569451\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-e2e-enrichment-model-ref\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__16755e57\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"13d133b6be569451\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-e2e-enrichment-model-ref\"]}],\"name\":\"cfedc7f35c0353d53fec0474975ad5e05c19ec8b2ac4718a77f59ccd7fb1233c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b0476fc7cd4ea3306c893f375fa8b815ad5c84676dd8000109732b76fc6c9e7d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"2fc0502446287f4669be2a416f781c0acba21256ff9eb15861862053f18d0e29\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4dcc64ddad4ef375730fe33c8b8925944bf0c1750f66d8a3347219a51dd190d3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"fe7515ad4af2d0fbe432bcf9bb564a76c332dd67819f108c4e0ccd547ada4eb1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a24eea90cd520665ff61391c71ddaf8965158b1b42c4e6f9fe99dd03dfa7c401\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"2036d4e41537afdd08f850cbe0bbe0d23c83b572c0c1f917f2cd718904dfce6d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1cd65b24c576b1e8f7a954fffca2225dfb109bf5a068107003d4f72206723e55\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__16755e57\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"13d133b6be569451\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-e2e-enrichment-model-ref\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__16755e57\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"13d133b6be569451\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-e2e-enrichment-model-ref\"]}],\"name\":\"909bedc4bbf04ca094fb3d369cf7cb3b15d83ab3e98ef27c04ee79b787659c95\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"be088898c71049f4ea232cae6dd479dfab1a9947fba6b17e7353ce14e639507c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"cfc0c9b5c46987f78f689a5a334275694f4c03653d50c2fbe6e969e238c7f8cb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"03e9bc99c98697160f9a6db2252bc0ba9e88e4ed113a3d5d851256f6cee3dcab\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"642d89c776f69505ff2a885b3a3e0374200ad36c578ca4799ed899b1dc0cf546\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0e0bbf1b6879cb3f68f7ea7f2afda47c74a88c5d3cb97fdf3e110cdc54718649\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"f05bad08945108f9026112e207cee46af50e92faf4445f0e991b27b9412c4c58\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ad6b1369f6065e5d01605f83113ef1c7c93ed4b3fa8d01ad81d870c4a418f675\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__16755e57\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"13d133b6be569451\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-e2e-enrichment-model-ref\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__16755e57\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"13d133b6be569451\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-e2e-enrichment-model-ref\"]}],\"name\":\"9eb0cbcb37fa43674c71b90f27589d7260b93ced662c1ceb0efe4cb1f91dab4c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4b932ff2b149c42a260b63c5bdd2b0515a398d1964de7381e0735756ee620b8e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"6fbda76757cae53d56b898432e232fb51847f0a1452503c1d53bf530847020ed\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a8ba5320fff14c281f32c2b0a9e757f0e205aace00c294b0d13fa46185724d35\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"8d788326bd35d2b328ba885da80b8eac2f0f1f55930d0bd275aa0c5fd637e227\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0ad1aa31e975e4b569a9617aed9c37982646578e71674b0d96896f60dc232a90\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"c8ee3691fdd0cb6a376274ca4ee98e52cb5718f985d4f539fb764ae6116296f6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0be4b31b8961f89b18ef02b2a56a0b76e7cb0d94a4440a467414ac2d9a504010\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__16755e57\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"13d133b6be569451\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-e2e-enrichment-model-ref\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__16755e57\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"13d133b6be569451\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-e2e-enrichment-model-ref\"]}],\"name\":\"235df022eefeafa48d660af3720c4cb0c0fec34ddef36d3c467db88f9a57b07f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"69645d92530f5991fb0c1154aa418715dafc9eb9b4b827c33aa742687b00c4fc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"b449a8480f629d5de320a05efeec5a558221dbb03b4dac7572367202e5ec4e3a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"96d049688a520cd26e12f2232f544b815eac1611ab00713e2f641e57b40e5f84\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"bc1544ecfcc1a9c24b532fcd9001124011a4a99e354877a6f611310592c512dc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fbfa7264341556b62c34307c6c836c7e015aeca2df10913c89f8c2d9d38fd28d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"787567c7ebc18db7ec0598b9dbf1466caebf9a1d07f97cfb4afbc3f8bc3fd0e4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"03938d68f68953b697b7b9ec3a9bb3205251dab0d8c28c8488a51872990c74d6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"0d7a95a011dd25d93bb4476331e0b43d38df072b07b758073c5e89ae27e7c6e3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea4599ace477623ac871dedf5650245e6a589cd60cb7c50944431b6bd5453ebc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"06aff6eabb02cda098099e156015c1b3f2389b929e7df774b34188d1589de73e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"463f896d9e9b5a3f2518e764053718a018fbe93828587f90cc4250e5a67a2236\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__16755e57\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"13d133b6be569451\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-e2e-enrichment-model-ref\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__16755e57\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"13d133b6be569451\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-e2e-enrichment-model-ref\"]}],\"name\":\"88eb8224ce85abcb39e51aee14e03c01d32d86bc4f686e66279e969a1413d263\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d2e0eee1c8e9f13da0b4cd4af8a834f482ac80e1620cc44747922a7c61d6a51b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"203a868aa43281568c0e425caebe830e36d9bb16cabaf6e7dd92722711d4e496\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0dcf2663d1fa4c3fb5056f3703d9d1a316345e3f4ea0e2503f77738258a9e6a2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__16755e57\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"13d133b6be569451\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-e2e-enrichment-model-ref\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__16755e57\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"13d133b6be569451\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-e2e-enrichment-model-ref\"]}],\"name\":\"c4e555c424bbb24fa529375505443d3163dbb2379b150d3ae00c6689e4123fae\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"29a6e78291fb6eb1600fcc523c35316897713ec3a1f3092074998de0701a2bff\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"220018b07e05f37b279946d5b903a8c5295a21774b20d317b40db4ae44ab089f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea78fba3abdfbae2cfbad8389b4c97d45d924dfb8eebd29422ca7a2b62f9564f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"86fdf51aa1b29a978535560d7a45ad778e5802bfe467d27e1295c743248d1507\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"dcddce6770eda2db3f8f60d8b51b5ed927194e11c56d328f35000b6f5e92dbdf\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"df9a2fd989201e2d0ef8377583b501f9afac6836df894071bbae9e6b6b2598f4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b8e8a49e358e54b12e2aba59e563ba17bcf32315bebde13a721f3b7ebfae18ba\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__16755e57\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"13d133b6be569451\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-e2e-enrichment-model-ref\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__16755e57\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"13d133b6be569451\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-e2e-enrichment-model-ref\"]}],\"name\":\"742ed2fd7d94f5d252aeaa965657e054bac8691ea31b81375ab8a5488c2f2888\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"327ad026e5a9c61ed15c52c9e2fb0c219e4d9a636a17ed736f525f2b42ebfd6d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"8b45807e9f971b175f77e49aa0f5e281c0245f33f6942f95c36aedfd7d419199\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"59093ab44195ceb3a72fd7400b422644d3d7c840cd3e838bafbbcf827cbcc073\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-0c9014\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-0c9014\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"bde801ad48bcba39a3cf88516077f8fad94dd2ce0692d0f274ab650cb9cc6614\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fbf5e5a312486cd624620a8628b976f89d3b75ffa1d3e47224c08e003294432f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-0c9014\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-0c9014\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"047906c5f7db776a9bd905e481a3347b0c84bd6edf626dc5626ed91115c7408a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cbaea0f78f7b655ed1c234a9fbf7020e12e29bee546d39c314b814aa1692620f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-0c9014\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-0c9014\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"1e414f5eaffdbc43cdaeda8552267e2b46abc1a6b41adfdb24735f3843a9c51f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2ab986aa56245948b966f417e9db684ac2bae70862e05b68a996c57de4d7c4c9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-0c9014\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-0c9014\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"3f61be5c1cb2e788fb6ec123b23519795a5d4fa05fbf9eb842b61931843e1834\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"83f9aef31a325eccb5ee1ca5935289e892a53f7f9d05ac2a6d2b8a973624d6db\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-0c9014\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-0c9014\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"ead8e640f12ec2a2a5b9632dbacd377499d067469c52a5e5c7791f29393639d3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"93867ab0bab47561de7ff57c3a2f54a4e134cfb5a3ee35d78ee703589d669077\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"760f6f0b0f0dfc05ff96616a7ebd6878ae6a8e384823348a74bc46e7ee6e70ab\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"06c24ca69f585351676e3a47fdf7a96df9b9a8fe85641e1c3348c8cfdfe446cb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"2089b2caaee71efefb7e26192d15a3376881340fd07cbc304d192587b50b0c07\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f713c09235fdc689702761ce6f8fb3c2c03ea75f66382e5121160a24cf7aee9d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__16755e57\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"13d133b6be569451\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-e2e-enrichment-model-ref\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__16755e57\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"13d133b6be569451\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-e2e-enrichment-model-ref\"]}],\"name\":\"78522ace7509d509793c07978801f1f4bab7d64f1ad59df33af972c953cd6851\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6b6f55f762b51c1f46156308a7f509359377c543fd3789f104b3416ff46e3216\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"06aab5232bb89b6e09b9780286eb3fceeee4557f3ea4efd5ede8278ad6c21170\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-worker-w0-0c9014"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-worker-w0-0c9014\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:52:50.270Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-worker-w4-d6cb38","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T21:21:30Z","generation":13,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"36c0d6c0-4ad3-4739-8e18-24485ab1bc48\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:31:08Z"}],"name":"kuadrant-e2e-worker-w4-d6cb38","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-worker-w4-d6cb38","uid":"36c0d6c0-4ad3-4739-8e18-24485ab1bc48"}],"resourceVersion":"42729","uid":"2255fc2d-ab48-428d-86a8-4726b25b244c"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7f9f489fba4cc345dba07951f043d704ea999478c1da34cd23037357dcdf1384\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__2fd6b724\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"02452dd10300549d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__2fd6b724\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"02452dd10300549d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"f61d2b7d2f64f1d64a2dcee70f47ce24c9c6eb4854589984128561c58f6171ac\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"12f3d170c629c434ef1558f623819a2294b75940427c1164b50933cdad3fb52f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"4d6b2e7d73dcdd0567dbe7811fffb6b677ae17a404dd4e000e5586417b4abff9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"af01177c39cc2acfc81deb8fed1e1062fd6125232da28da32592d4c0fd546c97\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"c66c5829a3315f16b0f26dd5daed466c5b2b261235b86bfb98043e96d7dd9de0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"16e9561ee4c6deff2fa31e8a5aec69ff1b5c963a2bd79d3413890752338a808c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"85bbc444688b414fd85af5d3f6532006d93d40793700cdf48cc119eb12135602\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-2-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7f9f489fba4cc345dba07951f043d704ea999478c1da34cd23037357dcdf1384\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__2fd6b724\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"02452dd10300549d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__2fd6b724\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"02452dd10300549d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"5b984da304c827646ff112362de545fa451a799e7f6999eac00f25f038606c2a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"12f3d170c629c434ef1558f623819a2294b75940427c1164b50933cdad3fb52f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"ad40721e9bd95807ea332811f94d79eb07b9dd045127a232886a7924332cbc73\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"af01177c39cc2acfc81deb8fed1e1062fd6125232da28da32592d4c0fd546c97\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"9190216f349b0595dc54d5cad3f429f840bbb0e4a2c199f4f2c79134aeb92beb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"16e9561ee4c6deff2fa31e8a5aec69ff1b5c963a2bd79d3413890752338a808c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"4447ac687428f773a4b67c9b5c06c6a0359aeee3ba2dd093ddd5af4018b5d896\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-2-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7f9f489fba4cc345dba07951f043d704ea999478c1da34cd23037357dcdf1384\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__2fd6b724\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"02452dd10300549d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__2fd6b724\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"02452dd10300549d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"b91256531abbaaf08ed45e4a93b53e9af9ebb53002123196214bb374517e81f0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"12f3d170c629c434ef1558f623819a2294b75940427c1164b50933cdad3fb52f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"597cf592078ae14c96f33099e96fee363339bedb2f5d430fdd69e28e8be2a8ff\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"af01177c39cc2acfc81deb8fed1e1062fd6125232da28da32592d4c0fd546c97\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"165316669577d87085504ec32756c6d6d67f595b2690025965232ab07a1da412\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"16e9561ee4c6deff2fa31e8a5aec69ff1b5c963a2bd79d3413890752338a808c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"b868f10bd5b40e8919994fca53311146eef16ba432d05144082d631a9418e83a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-2-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7f9f489fba4cc345dba07951f043d704ea999478c1da34cd23037357dcdf1384\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__2fd6b724\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"02452dd10300549d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__2fd6b724\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"02452dd10300549d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"490344715bd8708a2d31131fc3b4e370beef7eb7d9942ba89fc82080284e6244\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"12f3d170c629c434ef1558f623819a2294b75940427c1164b50933cdad3fb52f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"aeb99e2df9a1951917065c7b887084431b3e62a6f4d47287af43193676a5b8be\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"af01177c39cc2acfc81deb8fed1e1062fd6125232da28da32592d4c0fd546c97\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"76f141d8a065403b5c0a2fc7e2c76ce1301f93b13d91fd2078e5f2b4d2280197\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"16e9561ee4c6deff2fa31e8a5aec69ff1b5c963a2bd79d3413890752338a808c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"fb58ee2926965a2dcd5e496ba51d76076fbac1dbb0faeb6aaa8849736beb98ec\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-2-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7f9f489fba4cc345dba07951f043d704ea999478c1da34cd23037357dcdf1384\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__2fd6b724\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"02452dd10300549d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__2fd6b724\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"02452dd10300549d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"fa28a7ae652b865919d1ff4c61fd33bb8512d3139af38d1ceb9697a99e63cc6b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"12f3d170c629c434ef1558f623819a2294b75940427c1164b50933cdad3fb52f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"601d68ffdf7137fde779cf41214f1c74f63e6b717be0b7aad1eb56041a2d9b76\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"af01177c39cc2acfc81deb8fed1e1062fd6125232da28da32592d4c0fd546c97\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"b7d42066b553c2d03aee2da38514171a14e8ae8d343c0fda8f80d3265343c45c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"16e9561ee4c6deff2fa31e8a5aec69ff1b5c963a2bd79d3413890752338a808c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"157f8deef4224451e2a5d831c8369a39aa3b418062c8767a9f84de3947b7356c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-2-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7f9f489fba4cc345dba07951f043d704ea999478c1da34cd23037357dcdf1384\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__2fd6b724\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"02452dd10300549d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__2fd6b724\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"02452dd10300549d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"2dea78ba3797dedd7edd7b687182785345cfd95029e2131769c5797e3b752eb5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7f9f489fba4cc345dba07951f043d704ea999478c1da34cd23037357dcdf1384\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__2fd6b724\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"02452dd10300549d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__2fd6b724\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"02452dd10300549d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"cdb3a0c564011d63952f137daa521c84f02a66f8a75696ef9ac4f1f2cc9ea8c9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"12f3d170c629c434ef1558f623819a2294b75940427c1164b50933cdad3fb52f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"e019089f573a8879defa7fdce139828725d9f042c5a4dc9974b9185a8a382c51\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"12f3d170c629c434ef1558f623819a2294b75940427c1164b50933cdad3fb52f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"6a08c6dd0c7522c09a18466dfa733eb68e8c593cdc8d2890ccff2f5c9064fcc0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"af01177c39cc2acfc81deb8fed1e1062fd6125232da28da32592d4c0fd546c97\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"6f15db2f827c7eda1ecbf154277f01be4351cb08f525fa50ec0da278253b6d6b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"af01177c39cc2acfc81deb8fed1e1062fd6125232da28da32592d4c0fd546c97\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"5a27a9e4c9daab234151b3ade5f24a8f9f235443ec26586cc0a883b4ca237233\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"16e9561ee4c6deff2fa31e8a5aec69ff1b5c963a2bd79d3413890752338a808c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"1589c12ca11e6544f2b7072121804f185e5630b2cdcfa71c0561af4619194727\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-2-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"16e9561ee4c6deff2fa31e8a5aec69ff1b5c963a2bd79d3413890752338a808c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"1faaf26cba48036c2d95bf76257bcd6baf769ac5e6eed0a8964eec058af259eb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-2-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7f9f489fba4cc345dba07951f043d704ea999478c1da34cd23037357dcdf1384\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__2fd6b724\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"02452dd10300549d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__2fd6b724\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"02452dd10300549d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"31c0c96d54839068517aaeb062676423451143447943cafff7ee595d9fd1feca\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"12f3d170c629c434ef1558f623819a2294b75940427c1164b50933cdad3fb52f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"aebde4a102828558eb0fbde9709268d7adabc75fadf451c730e0573c086e2f07\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"af01177c39cc2acfc81deb8fed1e1062fd6125232da28da32592d4c0fd546c97\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"87ed1d3b3cd1e3027869c6fc197828ccea328c7f84e2acdf7e06e70b8842fdd7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"16e9561ee4c6deff2fa31e8a5aec69ff1b5c963a2bd79d3413890752338a808c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"d90c0faa5819af99665a29bf35d18a090fc213efb27bcb06e9cc9c8a2be3094c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-2-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a69bb45bad035c53dd8c7176828b1cc26d0c9d3f775d2059034b1639ca1b49d8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"79db77eb448edf55b65761a293f7f6fc07c9d4365912f7a8595364cdbf33d994\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"94dcd05ea37e3629c540245bc47fd87fca3f73a8e2994ead89bda609cefca74a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"f682bdd564171974ac50af1b79bec8319fb070d4f9ff054872e07f0bb5970828\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-2-w4-d6cb38/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e5e9b9fa41efe7f56f3ea6e9079d12a9f3e89cd596105815b30b04ba7ba1281b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__2fd6b724\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"02452dd10300549d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__2fd6b724\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"02452dd10300549d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"9b7cb9a28ed2fc7fdfa23c7d8d869cc573e3e72423805bef3f945a77d2785710\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"32a498b3029fba046b39d6c26d52ecb2de8f74b942f2d122b45240b1a839deae\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"7442c06fdbee3ca35e62201bfc1ded73b46ccce5d6905e07f6a1792cecd8bc10\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-w4-d6cb38/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"dff7a596e1042978304d40238abe84063cc499f4a6a2f9def85e7c84d1df1ebc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"4ebe0e741886c221cfcd8d1126bcb3535dcbe15c7f802a713d3b2ceb8cee37e1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ad3bad78fb2ca1b68182c777555c2a07f35742a0dc28e73d65c173489bf20bfe\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"adeaca08e9f8fd42fe69e77eee49140cfd5715eac018c5601b0d3378d917d2ce\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-2-w4-d6cb38/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4db1dd6250896b02d5f97b90471902db72d349ea082f211b7b5e4046c827d477\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__2fd6b724\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"02452dd10300549d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__2fd6b724\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"02452dd10300549d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"9e4cdffa79635674b661188290cd9c853017f5721accaa1f268edc6c6b7f2590\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1f3d6ce43ced512267c700bcaefac5fe1e5a0f56279d9c49efc4ca04e0d03518\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"a9a34f579b60868ec0be5a14bb835a3898e0c43fe25650166ed2178248bbe1f9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-w4-d6cb38/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c7906cc8021baa6797dfa1978c7ce78b494865d95b66f59ca1cd380376b5fba9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"6ae22229709f702a5686121e25321b1ca57a9a38cb7380c3cbc347a36b32a2f4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-2-w4-d6cb38/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8ea982efbe7afcd4f8dbaa4e864584b38ec852971d686ed11c87e99f1b9f4f9a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__2fd6b724\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"02452dd10300549d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__2fd6b724\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"02452dd10300549d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"1ed83021e2408187ee74cd1a66732d37b92c80d46439951ce5e0f654f1542381\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7d8b4229a4e8df0df0b627da5317c526c045e2ab5837161d638a7835193820d5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"36ee8c63f509519eef9ec6e2c257745b647d322586f8289611274ca06f90ec11\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"33871c6a0ae4feae1469b537cc1ea6bbbd60286eed4edf3f6b041e5ca65d4b23\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"44c4b2971f379de31e5b1b9aa432f9a0e14ca85e20312f6967c9581de8fe5e23\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-2-w4-d6cb38/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2c4b4abb753457c4ad4bd5815f6ce55723fcfcf44f298a47923e03e51d023a49\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__2fd6b724\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"02452dd10300549d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__2fd6b724\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"02452dd10300549d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"3ce9856de6f3b95cc2ed4fe4abeef13ecb59b5b1ef0102b858e5d3ec0d8afa89\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"99a01d66d9ba32727c09707b61669b110b150d8025da9291ae815b1d8e07454c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"77ec05cc7c773a3540c71498b5777588286f6a84b1595d80c4f1634ded3def93\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-w4-d6cb38/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7fdbd59414185d321c56439c757d9c725c67465b49a83a52b935fdd9c5f0df82\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"2eb3ad4b5e4be8080b2e0309815371172455a7e5f61cf9c3c595f17e99e6f681\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c806bf2d4d850ded382b88489831427afef078ecb67dd4c920a1355d1453a2f9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"ac190091ad6e540c35613b81dc40071b56f4f92355769f89e35c56f588a5f040\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-w4-d6cb38/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bb82cce53996fd9a50a4f33832b37ff599d227ab91d54895bf0ab989d1eb0b01\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"138b7da9a4ea2091f7b13106ba292672e2ca1d22138b32de717b07cab221eebc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9ba6421c13373b029e319749dfcc66205cba71509d9781aae6bc20029ca16a7b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"64d8cc6534e1f2b54595d10cceba7274e4820b1bc4cc4a0f7fffbb2bb61304a9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-2-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7ebdbd5a6be861834fc366408f369ad8f021dfe8f061cbc93334bc801f3df98f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__2fd6b724\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"02452dd10300549d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__2fd6b724\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"02452dd10300549d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"be4080fc1058816edd779c6c2b40a1657320a89a6a86b4ff7358026a6adb2e23\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6d3e7a9a4b4298310e0bfe2e3cbd62aec91a573c07d02cbee9db82354ce9ae45\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"8cc4fab950417e53f8887a857eadcd63e5254ca90ce535ac8312884267a353f5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b69fcfecbff8a7db20373884ddd2ca22e39f7a814dfc0946441bf6dc7f369a4d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"b2ed152f8ee7914ee5d821eac3bce97f229c18d303b8bf53e7c6d08dbd946a69\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a6e80d640d49da44f2b60f9db62279137aa6839ed5acbca6493b96977b1f3f9b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__2fd6b724\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"02452dd10300549d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__2fd6b724\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"02452dd10300549d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"b470ad22bfeca185d9d86c6a107cdea6e62f1aaf494ef31244de0d30052bbcfc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b1fdba63ead328fd43c505e06394bc2adb7e5e2dfb0a1e55ef2c41d8f345142f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"30a1d05fede91486be251352bb7291a36ac69d50b6fce18433612afe29f1b4b1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f333a7db2a4322946ba06e577de4e4465e1174fb5cc0bb60d8d97ffd9018dc4b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"ee6bf02baeb9e28323dc2d9fa206cb2ed963925f778322eed091490229b29e9e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f2655bcd7b6a7d3d8a4479c1c943c5f2b4d4fbb7d96408fc7ce07c4e7bd9f30c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"12835533e58f43762872e20b92b523339a9de435dc7d0f689b42133b367fae44\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e99af4c913dc9844409b7c31f2f26b7f80984fdcc4a30c1de535a7a3435d0ae8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"c9d5a4401f4154088ac8ced8673158a379ae2073a1dce32a0504c995271c0e88\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"309f6b916a61539853033efc6ca2e083c01c99e5b96f857a7c78b89f9816f598\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__2fd6b724\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"02452dd10300549d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__2fd6b724\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"02452dd10300549d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"788f4c0f9a4e5a97247c2043b8125cf170fe6674c40d873723dc972c4d5d93af\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"68beb50e573f7f8f729255a19248728f937beeab700e92bcc9c0a070e602e982\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"26447c99384ffe81ccfc09fad9c33ffe60c6796933a9e2734b738ff5de8c664b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6060eef24f1f9e109ceaa90837578da0e77128864be44cea71a6e4d056f6aed1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"075d582681ff3e0d68d4a835d43bc72dd6bc492d9a3ca8b6dd3ef470e6b6946d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9a1afd5e20de63bb2c85d93c9c3fd7aae15a0f45cb6e07dc467b8063b97decee\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__2fd6b724\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"02452dd10300549d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__2fd6b724\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"02452dd10300549d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"4c928eaa593596b5c3719a02958892d193943b2129a32e43035c896d93b232c1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4b5d6544ef7fd39f49a5af0551f4a404b0a5f49df3054a95306b7f797216c599\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"8773bca7122a801a4f199775b03693ad30e316ffebea5bcaf72af079bf14f24d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c5c4680765cefb123f1033aa2b612856432a81adb7bccb16df753674ddd4a42e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"cb4b2a4191c8a55c17ce5101bc78ca33035bffe16815d6ab6f63b4fa3147b68a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3474cd3af51b646106406cc4778f6a5608fdc62b1fd92f27ccbcf8ab285bc05c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__2fd6b724\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"02452dd10300549d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__2fd6b724\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"02452dd10300549d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"f0bc235629f48b82dcaad76bce5cdb80abfa82763d9ad220a11c3e27d70223d5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"af8712f819a09682d066de98c1b93feb5b0f27e478190be446e0c2d881c1e213\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"8ea734d5ea8e3432cc886f3fd011204345c05060f7991aff6617797636b9896a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c34c962f04362894a54cdf652c523865dbd1633f051244729b008181d474e55\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"2c3bfc8693c69427d3231717a8df2d14aba0f1fb87d9fd82bb191f0ebb31c308\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"915885eb7c9a3e141be9223dcd2bf03d4b850977922b9f3ad6f812809cf05a77\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"6816c53aa0b9171acb1b1522501aef6282ab95e3b7509a288af72c749a40063f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e12ef81cd87aec42f5b2528c46a9aeefe6b1bca82398f07b17a52a4bf6e91945\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"bd1615998be1912965bb2d26173bc1bd1e2565f8996f1f21fc476ccff3b1ad05\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a2f26131fa92b8ff5a24a34c4f1276e2ebde9d4239d1c79890c5f312ae6d007d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"199ebbeac914dfbab35c15e934f10f9f3b2214a0617964999f2157bf0c31b763\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a6fa5c95daf46871f07bc4e3ef7985a19659c040a1ef2a7baccccaa90e241705\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__2fd6b724\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"02452dd10300549d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__2fd6b724\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"02452dd10300549d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"3a34ac7af354fbf7d29872077cc2e557a29218e220d9e4e79e21710f2084e770\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"347ab4a75cfecc2353073cab067f0c183bd7a253c653eba93329ecf6aa4c77b2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"7eac06b7d9983846e2e0314ba9178882139d7919173fba3a84a8b264634346a5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"16cb85f469e7c5716866312b8b4cc95d7bd4782b54923c1571be2b995ef85c30\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"a65b58c28d5a781726a832c59d62e640ea9d347c008d6795a6bc79865414532f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3aa68add648f18fb79f3def0d73f0c2f29d8ab60b1352cf4548a1a038cf3d923\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"fad9cba453f811618739c6f08a8544a889f48ec7511f7d3ccac0f71ba988967b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"099191e40682a5a6b1df435c6dc10936b8b4e31a891f3520e8e9f8418b1acc3e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"adbf9660bf8db4b1489d019993fddbd2863d0cf7c72174df8663c00e565a1e21\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"13694f4cecc05b3e953bb7d1aa68f96fad9b8548456e1357cc504ba9936493bf\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"fd3f6d135cf69e39efa3702af6a7e665f47a40ddb90f71d1f37cad11438027bc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"db8ed9490207e877020d08d86f8a9769046fd69225998abd4e476e93ef7b9431\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"e3ae0784ebe4c51499f320023e5e93f640f2a33ae4fea237cb7e068df1c76739\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"12dec0ddb151cc18ef75cfe2b4260788095e28a391f359fc3f7da7c75381b728\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"8f6398fb66bae44affa747ad532a12445774a5b43ca2c7196a633d5d03da8c80\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"735d43fce555e32c36cd137abc0678ce944fbfe58a677497d16ab8d9ab37074f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__2fd6b724\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"02452dd10300549d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__2fd6b724\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"02452dd10300549d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"1016de6b3250a59509e3bc1de65ad0a68ae6faf776c4eaa853d86bce7dd96698\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9a442413f7e81c114c48c6bbdd04c0e3809cdcdf4def1f524f6d3adf70468027\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"785762b8cbcc7dd30b578476b081ad2df517e9e450947fa2591a488b59407126\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"204a90b318233d1075e557d2348b027549cbc82cda4c1d6aea6cfcfa28a96654\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"7bb190477ec8b722acf5b940486e283cbb3ed66f8b99945c184f13fdd5e8b25e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e5f21bd702765764bb09a1ee4f30f2c44baa119970ede500be5eedb7653d9284\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"c83d6ce70647211ab5b215758b02838f2d1d66725baa3ae1e3b9d5635dc53006\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-2-w4-d6cb38')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-worker-w4-d6cb38"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-worker-w4-d6cb38\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:52:50.447Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-praxis-a-aa8aff-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-praxis-a-aa8aff-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:52:50.580Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-praxis-b-3c7706-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-praxis-b-3c7706-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:52:50.686Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-distinct-w3-f51151","namespace":"e2e-models-e2e-worker-w3-f51151","uid":"f999400d-f0dc-4bbb-a149-d69388fc41ec","error":"tokenratelimitpolicies.kuadrant.io \"maas-trlp-distinct-w3-f51151\" not found"}
{"level":"error","ts":"2026-11-02T21:52:50.743Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w3-f51151","namespace":"e2e-models-e2e-worker-w3-f51151","uid":"e3340067-224a-43ad-8020-ca9e00ead152","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w3-f51151\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:52:50.919Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w0-0c9014","namespace":"e2e-models-e2e-worker-w0-0c9014","uid":"4f647df6-1d5b-433b-b4fc-1279ff1755f7","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w0-0c9014\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:52:51.036Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-praxis-b-3c7706","namespace":"openshift-ingress","uid":"b0510110-7e9f-4e4e-8e3c-79563c2bd717","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-praxis-b-3c7706\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:52:51.094Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w4-d6cb38","namespace":"e2e-models-e2e-worker-w4-d6cb38","uid":"486176e6-7786-40c4-9ce0-6f4a68b408b2","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w4-d6cb38\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:52:51.270Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-e2e-enrichment-model-ref","namespace":"e2e-models-e2e-worker-w0-0c9014","uid":"e689ba3a-362c-4885-aed5-bd981eb434c6","error":"tokenratelimitpolicies.kuadrant.io \"maas-trlp-e2e-enrichment-model-ref\" not found"}
{"level":"error","ts":"2026-11-02T21:52:51.683Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-distinct-2-w3-f51151","namespace":"e2e-models-e2e-worker-w3-f51151","uid":"02007b66-787e-4697-8004-5da85073b471","error":"tokenratelimitpolicies.kuadrant.io \"maas-trlp-distinct-2-w3-f51151\" not found"}
{"level":"info","ts":"2026-11-02T21:52:51.742Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:52:51.742Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T21:52:51.807Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-praxis-b-3c7706","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-praxis-b-3c7706\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:52:51.822Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"distinct-w3-f51151-kserve-route","namespace":"e2e-models-e2e-worker-w3-f51151","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"distinct-w3-f51151-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:52:52.195Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"distinct-w0-0c9014-kserve-route","namespace":"e2e-models-e2e-worker-w0-0c9014","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"distinct-w0-0c9014-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:52:52.305Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"maas-api-route-e2e-praxis-b-3c7706","namespace":"odh-ai-gateway-infra","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"maas-api-route-e2e-praxis-b-3c7706\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:52:52.403Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"distinct-2-w3-f51151-kserve-route","namespace":"e2e-models-e2e-worker-w3-f51151","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"distinct-2-w3-f51151-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:53:02.574Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["EnvoyFilter","TokenRateLimitPolicy","HTTPRoute","AuthConfig","AuthPolicy","ConfigMap","Gateway","Limitador"],"eventTypes":{"create":13,"delete":3,"update":16}}
{"level":"info","ts":"2026-11-02T21:53:02.820Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:53:05.767Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:53:05.869Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:53:05.869Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:53:10.764Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:53:10.773Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:53:10.840Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:53:10.840Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:53:10.841Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:53:10.854Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:53:11.019Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:53:14.301Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:53:14.301Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T21:53:14.970Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-a-w4-7cde84","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-shared-a-w4-7cde84\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:53:15.862Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway","TokenRateLimitPolicy"],"eventTypes":{"create":2,"delete":2,"update":1}}
{"level":"info","ts":"2026-11-02T21:53:20.763Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:53:20.777Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:53:20.777Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:53:20.784Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:53:20.784Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:53:20.791Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"error","ts":"2026-11-02T21:53:20.902Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:53:20.902Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T21:53:21.385Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-praxis-a-aa8aff","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T21:47:29Z","generation":2,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"f4623b7b-c834-4412-87d2-6cc902d519fd\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:50:51Z"}],"name":"kuadrant-e2e-praxis-a-aa8aff","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-praxis-a-aa8aff","uid":"f4623b7b-c834-4412-87d2-6cc902d519fd"}],"resourceVersion":"75668","uid":"0c3f67e6-099e-4828-8ab8-3010c7a07193"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"dfaf51cd2960082df8575afc70019a8aa8190ceee6c7275bfd043e37353167cc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-a-aa8aff-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__3087d8be\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"08d467ee84db5e3b\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-praxis-a-aa8aff/praxis-route-aa8aff-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-praxis-a-aa8aff/maas-trlp-praxis-route-aa8aff\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__3087d8be\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"08d467ee84db5e3b\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-praxis-a-aa8aff/praxis-route-aa8aff-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-praxis-a-aa8aff/maas-trlp-praxis-route-aa8aff\"]}],\"name\":\"4fc5ecf6cdd40be2d82cae6060cf654f7e45aca30d97cf6b3e92c0e7dbc5df6f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-praxis-a-aa8aff/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"dfaf51cd2960082df8575afc70019a8aa8190ceee6c7275bfd043e37353167cc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-a-aa8aff-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__3087d8be\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"08d467ee84db5e3b\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-praxis-a-aa8aff/praxis-route-aa8aff-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-praxis-a-aa8aff/maas-trlp-praxis-route-aa8aff\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__3087d8be\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"08d467ee84db5e3b\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-praxis-a-aa8aff/praxis-route-aa8aff-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-praxis-a-aa8aff/maas-trlp-praxis-route-aa8aff\"]}],\"name\":\"f740326911c539537873c26c44b1165f311226de0694ef954a15f6c7d648e679\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-praxis-a-aa8aff/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"dfaf51cd2960082df8575afc70019a8aa8190ceee6c7275bfd043e37353167cc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-a-aa8aff-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__3087d8be\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"08d467ee84db5e3b\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-praxis-a-aa8aff/praxis-route-aa8aff-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-praxis-a-aa8aff/maas-trlp-praxis-route-aa8aff\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__3087d8be\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"08d467ee84db5e3b\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-praxis-a-aa8aff/praxis-route-aa8aff-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-praxis-a-aa8aff/maas-trlp-praxis-route-aa8aff\"]}],\"name\":\"9eb5ecbc178e2c11c1581173df4ab23ba039a1a5ea4257df46792bc350d2bd15\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-praxis-a-aa8aff/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"dfaf51cd2960082df8575afc70019a8aa8190ceee6c7275bfd043e37353167cc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-a-aa8aff-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__3087d8be\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"08d467ee84db5e3b\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-praxis-a-aa8aff/praxis-route-aa8aff-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-praxis-a-aa8aff/maas-trlp-praxis-route-aa8aff\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__3087d8be\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"08d467ee84db5e3b\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-praxis-a-aa8aff/praxis-route-aa8aff-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-praxis-a-aa8aff/maas-trlp-praxis-route-aa8aff\"]}],\"name\":\"13bb28e68713c11650db579bc5c5820cde58f936490640df84143b0729d5573a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-praxis-a-aa8aff/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"dfaf51cd2960082df8575afc70019a8aa8190ceee6c7275bfd043e37353167cc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-a-aa8aff-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__3087d8be\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"08d467ee84db5e3b\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-praxis-a-aa8aff/praxis-route-aa8aff-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-praxis-a-aa8aff/maas-trlp-praxis-route-aa8aff\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__3087d8be\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"08d467ee84db5e3b\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-praxis-a-aa8aff/praxis-route-aa8aff-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-praxis-a-aa8aff/maas-trlp-praxis-route-aa8aff\"]}],\"name\":\"2fbc1383d7d62b59745036612a6802d948118e685ad44c1103ccadda450c9d99\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-praxis-a-aa8aff/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"dfaf51cd2960082df8575afc70019a8aa8190ceee6c7275bfd043e37353167cc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-a-aa8aff-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__3087d8be\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"08d467ee84db5e3b\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-praxis-a-aa8aff/praxis-route-aa8aff-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-praxis-a-aa8aff/maas-trlp-praxis-route-aa8aff\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__3087d8be\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"08d467ee84db5e3b\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-praxis-a-aa8aff/praxis-route-aa8aff-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-praxis-a-aa8aff/maas-trlp-praxis-route-aa8aff\"]}],\"name\":\"36415c9ed6e6fdfb34135c2976e1160adfc7ef6974b8a65352e6804c9a3396ff\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-praxis-a-aa8aff/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"dfaf51cd2960082df8575afc70019a8aa8190ceee6c7275bfd043e37353167cc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-a-aa8aff-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__3087d8be\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"08d467ee84db5e3b\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-praxis-a-aa8aff/praxis-route-aa8aff-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-praxis-a-aa8aff/maas-trlp-praxis-route-aa8aff\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__3087d8be\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"08d467ee84db5e3b\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-praxis-a-aa8aff/praxis-route-aa8aff-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-praxis-a-aa8aff/maas-trlp-praxis-route-aa8aff\"]}],\"name\":\"7f7557744933779c40beb1b17334f2d25bcf6e69d1519830ad5790533be5c944\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-praxis-a-aa8aff/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"dfaf51cd2960082df8575afc70019a8aa8190ceee6c7275bfd043e37353167cc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-a-aa8aff-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__3087d8be\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"08d467ee84db5e3b\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-praxis-a-aa8aff/praxis-route-aa8aff-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-praxis-a-aa8aff/maas-trlp-praxis-route-aa8aff\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__3087d8be\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"08d467ee84db5e3b\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-praxis-a-aa8aff/praxis-route-aa8aff-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-praxis-a-aa8aff/maas-trlp-praxis-route-aa8aff\"]}],\"name\":\"2b27b075cdd3c377fe2d2b0de62f706e075938db3665dea676cc020066fd14ca\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-praxis-a-aa8aff/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2a2f4657d44d6ecba95bae442b2475b2e9939c246cc8eebbdbc3294b2b82f38a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-a-aa8aff-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__496f5b5f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-aa8aff\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-a-aa8aff\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__496f5b5f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-aa8aff\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-a-aa8aff\"]}],\"name\":\"bd595ed76d18aaf2e0d5e7d7dfcc4a132f87b32f54a9b5cd96dde3ad072761c9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1c7715a7b97704c062bdda48c1f4fca359ddfd47a4b89c996a091bbf202a6f6e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-a-aa8aff-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__3087d8be\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"08d467ee84db5e3b\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-praxis-a-aa8aff/praxis-route-aa8aff-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-praxis-a-aa8aff/maas-trlp-praxis-route-aa8aff\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__3087d8be\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"08d467ee84db5e3b\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-praxis-a-aa8aff/praxis-route-aa8aff-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-praxis-a-aa8aff/maas-trlp-praxis-route-aa8aff\"]}],\"name\":\"2f9de73ccb0d6cc8574dfff6740866f24757de5a9951fffe6effce87be4ad917\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-praxis-a-aa8aff/models/facebook/opt-125m/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c6c288bdc6400335234b4d5b3e6674ae03bd938dda23c9f889bd782887ff2a64\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-a-aa8aff-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__3087d8be\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"08d467ee84db5e3b\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-praxis-a-aa8aff/praxis-route-aa8aff-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-praxis-a-aa8aff/maas-trlp-praxis-route-aa8aff\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__3087d8be\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"08d467ee84db5e3b\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-praxis-a-aa8aff/praxis-route-aa8aff-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-praxis-a-aa8aff/maas-trlp-praxis-route-aa8aff\"]}],\"name\":\"b33d1f848cea6653645212ff2e761bab9ab7dc69526f5d4a6139535c06667e5c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-praxis-a-aa8aff/models/facebook/opt-125m/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a037509cd7762b2b38b15837df93e43ad3585c339cf17f519385438bf849c18d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-a-aa8aff-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__3087d8be\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"08d467ee84db5e3b\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-praxis-a-aa8aff/praxis-route-aa8aff-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-praxis-a-aa8aff/maas-trlp-praxis-route-aa8aff\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__3087d8be\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"08d467ee84db5e3b\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-praxis-a-aa8aff/praxis-route-aa8aff-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-praxis-a-aa8aff/maas-trlp-praxis-route-aa8aff\"]}],\"name\":\"ec458ece0b01643cb64f0840006f62adbd057d8ede8e06912f2add29b3700e79\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-praxis-a-aa8aff/models/facebook/opt-125m/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"af9e6bde539685d5d0a05f48574d05a4b4950429514947112e65895e7c79d504\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-a-aa8aff-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__3087d8be\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"08d467ee84db5e3b\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-praxis-a-aa8aff/praxis-route-aa8aff-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-praxis-a-aa8aff/maas-trlp-praxis-route-aa8aff\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__3087d8be\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"08d467ee84db5e3b\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-praxis-a-aa8aff/praxis-route-aa8aff-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-praxis-a-aa8aff/maas-trlp-praxis-route-aa8aff\"]}],\"name\":\"60569f9fc69e9539beb33624f6ff5cd7b48c2f5e97747ad2979d59ee755139df\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-praxis-a-aa8aff/models/facebook/opt-125m/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"dab80df92bcc50a8daf4ccb35203dc12a95aec16354af763832cba0b76635ef2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-a-aa8aff-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__3087d8be\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"08d467ee84db5e3b\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-praxis-a-aa8aff/praxis-route-aa8aff-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-praxis-a-aa8aff/maas-trlp-praxis-route-aa8aff\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__3087d8be\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"08d467ee84db5e3b\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-praxis-a-aa8aff/praxis-route-aa8aff-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-praxis-a-aa8aff/maas-trlp-praxis-route-aa8aff\"]}],\"name\":\"8f752167c25604c8fe42f0cc881de43a3fb0024ad6565db749de689ec32a2a50\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-praxis-a-aa8aff/praxis-route-aa8aff/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"557ea8d47815dd0d2dea5361aa15ea0c86441144b090e94f169492660765aeac\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-a-aa8aff-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__3087d8be\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"08d467ee84db5e3b\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-praxis-a-aa8aff/praxis-route-aa8aff-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-praxis-a-aa8aff/maas-trlp-praxis-route-aa8aff\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__3087d8be\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"08d467ee84db5e3b\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-praxis-a-aa8aff/praxis-route-aa8aff-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-praxis-a-aa8aff/maas-trlp-praxis-route-aa8aff\"]}],\"name\":\"834554f8fd231215576b0cfbd63f8d5ced872d69d665bbee782a340a90f0a6c0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-praxis-a-aa8aff/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e21e1a4c42933efc0333d252ac6ea90437052e32f706b3fc1b0fd030066f64e7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-a-aa8aff-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__3087d8be\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"08d467ee84db5e3b\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-praxis-a-aa8aff/praxis-route-aa8aff-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-praxis-a-aa8aff/maas-trlp-praxis-route-aa8aff\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__3087d8be\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"08d467ee84db5e3b\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-praxis-a-aa8aff/praxis-route-aa8aff-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-praxis-a-aa8aff/maas-trlp-praxis-route-aa8aff\"]}],\"name\":\"74f629ec63f4d8c1c81783891b4ca51b17388a487d10de2122d50cb8f0ec0c84\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-praxis-a-aa8aff/praxis-route-aa8aff/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"12c7c0bc5986eaa7d046774a889e4bc3d3eebb5c3c9b42a50fd37018f24e33ae\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-a-aa8aff-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__3087d8be\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"08d467ee84db5e3b\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-praxis-a-aa8aff/praxis-route-aa8aff-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-praxis-a-aa8aff/maas-trlp-praxis-route-aa8aff\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__3087d8be\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"08d467ee84db5e3b\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-praxis-a-aa8aff/praxis-route-aa8aff-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-praxis-a-aa8aff/maas-trlp-praxis-route-aa8aff\"]}],\"name\":\"70fb02a3abe5c53df1055430d2aee947927f2914e4b6f20c304d1b4d50774892\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-praxis-a-aa8aff/praxis-route-aa8aff/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cd38fd6584f318d80b4b145468fe8dc20ed94c27cfc991c9fad7d9fae6f0e537\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-a-aa8aff-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__3087d8be\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"08d467ee84db5e3b\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-praxis-a-aa8aff/praxis-route-aa8aff-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-praxis-a-aa8aff/maas-trlp-praxis-route-aa8aff\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__3087d8be\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"08d467ee84db5e3b\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-praxis-a-aa8aff/praxis-route-aa8aff-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-praxis-a-aa8aff/maas-trlp-praxis-route-aa8aff\"]}],\"name\":\"6a6262c1c4cbd69449d0bd3f0d7f0aeb2f8e8f712e8d8430217aefaf8c49bae0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-praxis-a-aa8aff/praxis-route-aa8aff/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c1d06f8b555eb6e177c3d425421d27e44859f77bad273362c2e7c9e5db135432\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-a-aa8aff-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__3087d8be\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"08d467ee84db5e3b\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-praxis-a-aa8aff/praxis-route-aa8aff-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-praxis-a-aa8aff/maas-trlp-praxis-route-aa8aff\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__3087d8be\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"08d467ee84db5e3b\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-praxis-a-aa8aff/praxis-route-aa8aff-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-praxis-a-aa8aff/maas-trlp-praxis-route-aa8aff\"]}],\"name\":\"40d930ef070c324687b3520b783852dd4fd3d99e6a5386e027ac59a30d90201d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-praxis-a-aa8aff/praxis-route-aa8aff')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e0e87bc68ced3c1fae3951c290c281edf6551918c422ba8d5d37c5634af550e9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-a-aa8aff-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__496f5b5f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-aa8aff\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-a-aa8aff\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__496f5b5f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-aa8aff\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-a-aa8aff\"]}],\"name\":\"899651a44add80a01d7fd405af484063328296530239fa1805275705aae864a1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f40ff62a41d740333fc2d5a12e89b985a6b447122c65e2af4caa1d79b5e0c9ee\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-a-aa8aff-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__496f5b5f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-aa8aff\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-a-aa8aff\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__496f5b5f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-aa8aff\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-a-aa8aff\"]}],\"name\":\"4b7dbe45944f1751d5d5768a60a24ba0c9516f74e78e572f25babfe3ab41fd70\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"95758b156a5024d2c1388891cd6820461c19b119dc764cad0ddeb2810283d8d0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-a-aa8aff-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__496f5b5f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-aa8aff\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-a-aa8aff\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__496f5b5f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-aa8aff\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-a-aa8aff\"]}],\"name\":\"65f3b97b703faa385e1c7f5e0511995bcc4a01a09cdc8c25cdd5d2d124149e53\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a0eb1c662a7b62c899339fe96c55da89c6bab1f7d957f79ed23685d4dafa7dcb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-a-aa8aff-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__496f5b5f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-aa8aff\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-a-aa8aff\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__496f5b5f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-aa8aff\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-a-aa8aff\"]}],\"name\":\"bfd661fd1ba7b4cf239d88afde94edd7fa7a162973c0ef47d84335ee386e0586\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7f0b6887999f604061fff1990a0319fd638e2b0ada2789c6660abcfeb00e8c92\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-a-aa8aff-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__496f5b5f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-aa8aff\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-a-aa8aff\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__496f5b5f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-a-aa8aff\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-a-aa8aff\"]}],\"name\":\"0fcfbac8ab825679658a2eb5c8386a24fa91e877ec612330f53ec2a2c0cc5ef6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e30b1cd8d54e09853f762b65378aac689ae7e38336c1140f67d92d2677e90972\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-a-aa8aff-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__3087d8be\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"08d467ee84db5e3b\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-praxis-a-aa8aff/praxis-route-aa8aff-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-praxis-a-aa8aff/maas-trlp-praxis-route-aa8aff\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__3087d8be\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"08d467ee84db5e3b\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-praxis-a-aa8aff/praxis-route-aa8aff-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-praxis-a-aa8aff/maas-trlp-praxis-route-aa8aff\"]}],\"name\":\"e01dd99c1472318ea3ebf4e253d3567a33d9801ec103ebb8b00306e8880c15ab\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-praxis-a-aa8aff/models/facebook/opt-125m')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-praxis-a-aa8aff"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-praxis-a-aa8aff\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:53:21.594Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-worker-w3-f51151","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T21:21:31Z","generation":18,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"8871137c-7f6a-401d-a6db-2983aea5ba22\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:52:39Z"}],"name":"kuadrant-e2e-worker-w3-f51151","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-worker-w3-f51151","uid":"8871137c-7f6a-401d-a6db-2983aea5ba22"}],"resourceVersion":"78851","uid":"c24c0550-6758-4dca-8d2b-3fe32740d122"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a05d7e315cc7cde173ab18a777672d3a18ce0a96f8f52d505404dcf8d1e51c20\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"0e7c31c41adb0d3f9efc929ae631573fe0c783a2fa7edb7a4b135081c2969bbf\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6c73e108ce3d5ef8ece11651aca73aa00bd88530b6aba861d23ca7b6ff89ba5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"aedbd7ef0308fd9494e9a3a1386b732923d5d060acf5a188601898d4867d320f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7b56d8e34a0de188e49dc0ae60057e421eb8bc4643546e49b2fe810120869498\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"b6389ab82133347e2514a4ad1cbd9d34042edc9a4ad044714155dbb2aecf38d4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a942d85d233c0e2e8932f598b5b8c9b97eda0ae826b5a80a742559b36fa56979\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"85e7f37f931469abe1b396a1a44b52a8b72e6a4dc98ed0ebdd61e43f0486de13\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a05d7e315cc7cde173ab18a777672d3a18ce0a96f8f52d505404dcf8d1e51c20\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"ec8a1b6bbf984a67cda63e2d923bfa9d2d66a7537f676f6198c12cbca9103517\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6c73e108ce3d5ef8ece11651aca73aa00bd88530b6aba861d23ca7b6ff89ba5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"5c9b9ac2bc33c747eb54045ee2511e3c8b2ee9737a3f347afb75903f43d74fb7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7b56d8e34a0de188e49dc0ae60057e421eb8bc4643546e49b2fe810120869498\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"f82b9432930517e02d229f4fdbdd8b6700b061d5d333fe35b064a3bb85f58e76\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a942d85d233c0e2e8932f598b5b8c9b97eda0ae826b5a80a742559b36fa56979\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"6d321a24ed09abad642dee549f0c7cbf98ce40481beb85ca79bd3d4eeb89b77e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a05d7e315cc7cde173ab18a777672d3a18ce0a96f8f52d505404dcf8d1e51c20\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"a54bd689e670e5f8bbee0a66c2585a4d4adce9a5a7fc297449ee3b816a0c2695\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6c73e108ce3d5ef8ece11651aca73aa00bd88530b6aba861d23ca7b6ff89ba5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"ad845c31a125851bf4cc5ae7e83bb4a011cf98484d99780ab16df250ca9dd41c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7b56d8e34a0de188e49dc0ae60057e421eb8bc4643546e49b2fe810120869498\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"9eefe22cd9d7f4d324cc07e6422d998261fea96e9069bc938fe66a94e8c8cadb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a942d85d233c0e2e8932f598b5b8c9b97eda0ae826b5a80a742559b36fa56979\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"b00ec38cf5be980b160374be347b182afaa16e0dc99314a5e990f20cef6d57ed\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a05d7e315cc7cde173ab18a777672d3a18ce0a96f8f52d505404dcf8d1e51c20\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"6d5d9aca320022f0f8b70c3f9b34b5922adf537f5da717ec79924566febf6df1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6c73e108ce3d5ef8ece11651aca73aa00bd88530b6aba861d23ca7b6ff89ba5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"346e75cab49a1cf8ae89d90cfb32099256f44d7909e40cdc730e951946a411e2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7b56d8e34a0de188e49dc0ae60057e421eb8bc4643546e49b2fe810120869498\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"ae0a4172fa23a6e8857123675126f34bcaf4e08f94c05663e2913801fda46401\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a942d85d233c0e2e8932f598b5b8c9b97eda0ae826b5a80a742559b36fa56979\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"ee0931c3dc206732c58bab1add9bf2cb602a2eb21bfa9272c2df596197dceb3e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a05d7e315cc7cde173ab18a777672d3a18ce0a96f8f52d505404dcf8d1e51c20\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"3f6b6643d5731a355a44968b83b24169ff3e0c1b36737d8be7f9d42e1def7c3e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6c73e108ce3d5ef8ece11651aca73aa00bd88530b6aba861d23ca7b6ff89ba5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"cd8ab5f89e71494c8d176f9668b8ed279bd244e6f70d1a5c87603877b4b7182d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7b56d8e34a0de188e49dc0ae60057e421eb8bc4643546e49b2fe810120869498\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"09df06c068a0d1324c44679ca0c022e74cd18bae1497d0087fb2184f9401d63b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a942d85d233c0e2e8932f598b5b8c9b97eda0ae826b5a80a742559b36fa56979\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"821121f5584e938a01b323996203984576204f894f2c9f09f5ececcdc058373e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a05d7e315cc7cde173ab18a777672d3a18ce0a96f8f52d505404dcf8d1e51c20\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"e00f3dfbbce60a718137b415a42cbf1e65a7b226437cc4600d9fa76b264e3b4d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a05d7e315cc7cde173ab18a777672d3a18ce0a96f8f52d505404dcf8d1e51c20\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"7ddf0d6bdcfc6aa206cdc0919b1d5b7545c903aafbb0e16d393016b1a83bd29a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6c73e108ce3d5ef8ece11651aca73aa00bd88530b6aba861d23ca7b6ff89ba5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"fe3b37fdd5d3f9d3bdf7d03b186d964b283bfbe7d3ffa720457517666c3070a2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6c73e108ce3d5ef8ece11651aca73aa00bd88530b6aba861d23ca7b6ff89ba5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"7dd9491b4755b4900c5bc55b4dd9aff38f99899f0236e4d21bf7c94e5769cbb1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7b56d8e34a0de188e49dc0ae60057e421eb8bc4643546e49b2fe810120869498\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"fa5430186b33e56d19e4d2e0209b4f2215d17b488745cd8061eb5ecaf96ecafa\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7b56d8e34a0de188e49dc0ae60057e421eb8bc4643546e49b2fe810120869498\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"cd88af3d71345ad9b32dfae02550fa9bf6aa0cddfac2d0464a60cd90b9898d74\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a942d85d233c0e2e8932f598b5b8c9b97eda0ae826b5a80a742559b36fa56979\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"2182ac070ac99ffbeb246624e36aa202ce8c626bd38aaa3191f5e60a408bc782\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a942d85d233c0e2e8932f598b5b8c9b97eda0ae826b5a80a742559b36fa56979\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"97e41dd7c810563f2cac2a1c963d220c840d6b756c6c76b0cf97113387aab38b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a05d7e315cc7cde173ab18a777672d3a18ce0a96f8f52d505404dcf8d1e51c20\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"a00edc25239da061cd0457625d6046ede5f9d09507c78c2209e1e992795831c9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6c73e108ce3d5ef8ece11651aca73aa00bd88530b6aba861d23ca7b6ff89ba5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"fbd557cfa232fb43236e5864400cd1522fbf21d014450df4a714ea2d3608e863\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7b56d8e34a0de188e49dc0ae60057e421eb8bc4643546e49b2fe810120869498\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"f809ccd15563984c9befad8f50ee38613b9c34eda0af01f561e75be88cba33ab\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a942d85d233c0e2e8932f598b5b8c9b97eda0ae826b5a80a742559b36fa56979\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"749b6bc66485455bb3cc5a0d552c38935bb446a6be85e306d894e6cbb4d92c08\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b31ddb7ef02e35e9d172430b50a004a3047564232880010bd3e581bf0dc547f8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"a1ec0f0592798b3996117a17734b0936906621077ceec69c81d8fb77e89a142a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"75a5abd89bb4e6258c7f7c7be472e6131799539dbbb87686c1010afe2791e45e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"3ca8a6339da3e4298e514bea168ac30f6c718d158fa0efc5e0fd85f06754a528\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"72bb4e3923485ca35015ee8655bc43ee332eea77f2cd8effbd48b21828f89f80\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"879fe62fbbe8b0a130140cda7f546611c758fb8fa416f173d2b0cf3da17d7941\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ed162da516e04d5229dc1d49e1c785e9db374ba4ba028ecabbdccdcb33acd1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"b43372d2a0820427086903362809a4a0c757cd1d6f593ba48a755e5fb972575d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f9603ac54a5668b179c6ba3dcda3951e57253a5ad5ad80214b563f50337f3a9c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"7caf859dfb9739029a8c1b13adba06164610495beddbda8e01fd7b432b15f4c3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"775fdec32977b769224a6d9530e33a1b93a2948f54e3f459e979da99f7def4ea\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"5cebae68b5e59e34a98c9c038f83d877f079732894ec3403d349e0b7ae0c9099\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6ab1b21b6f75f2c1ef86f9bcf36a6c25244e88430832e3ac86a839cf10bb8dcd\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"15ecb8224cf6049c2e831c815cc4f0aed954432b967d01d55ea637294f3ea87e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8b2fbdc0f4b402fd19fb549b70da796c6867a52206fa0420df2d6debc0db70b7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"7cb303fae9824d31834d539772c1840fd2991481566b7d07635c9284c524ae4d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a649343311197c716e0b6f502bb8ad21ecf4e207e16ffc6e0b74b1dc4f05f7fb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"699e8723136e653d04a8800a9289a3543f733ebfd0f99efbedfd18d22de4c281\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a6267fc785126adca5b68df13f95ef1fa08e1d72b66fbff01b54f8d61edaf7ba\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"9a72bfcef40a8da2865b02b6123c023d9f4f17c11a2ff674e3ed24af23e468e2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a6d41f4e9f57ec1e6bb4423e49991033d85f00a2a3303e02b25d1eedb67be3c9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"ad4137b1e753fd100088742941c8aaee9eaddc158bbaf221eb0d7318bdb8dfb5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6610d72af8a18be17c09082b4389a248d739315be17e0e146375e82e8d76261d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"66a5afc61110ab52ae4b9c9d79944467f91c4a2bd7b954ed8f59e651c215c630\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aea6441051c6a7490e44d5f7bab0e4bf7cf461c9597675611789e8d9141a446c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"c871ffab27f7ed925d56fae005e70fd3716aab799f0484d7d44519e915491d11\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"be7879d2a6daa00da89abfe5895a77787208f1af5b8582c79c8dd2849ef7906c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"461ea56b8a105dbd1d386b531c80b5a86960df99b24b6f6668520921b280a609\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7f4456bc894bf7ab59ba02c25915a8db007a89ffdd1efcace437a7761c68b3f9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"aedfea0f1dceed2b1af07ebf6e7dbc55cdc958ea5a084291f6216a19f63eae8a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f23dfebb92a3f3d59997030cce08899533ec20be47590cd866dd896392db04de\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"f42d6cbc7a49b6c1c4f0668dc536500321a8f658d1ab1a3a8b2ad8c0a95b272c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c57cda59d33d438c637a64dce8619a9616880a275363557ccc83d2cbc4920e14\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"1a3df8e6f6ad36c3eb928970ca2e746005e16b25405fc6eb9f44977b07d56905\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"086314a2fc965880bf769a18d3353909b6a1e5544e7eb514174994ba24387652\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"8e63847006a8d1952318fe3b6d2707027991d1c00d7959d051b3baf72690aecf\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f1def6d908410a124665ecd632ae01e5ba977920643dab1a35d25277292bae55\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"1199947fd30f0d1dab3db5846b8d27e36b6284be94834b798e4004120ec52532\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"676709317386301aa762cc48b7aa0064bc03adc00abbddfda8d0294046751d34\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"8a51327014eb82d6df6700b3f79ae6010cc76b2ee750f56ac5cb49c5b6f975ed\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d8557b9861d48e5714a954e0a885ecc7e55e6b9f034fc9f24f4c5c2f6dafce5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"91c8ce1078dc4a26a7cb0af054981aa28b4768dcd87a9a167f98e9b4e4b60325\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d63de28626482cf5fa2aaf12cb9aa3def86d637d4c98f193819331c36fa73b21\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"fae01409c891b630fc644ebf1b8bc640438a1fc79de2b0750d34e2a6388d4ca6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f86615df74e8d3814df8817b06dc7578a4b0af0817397c5bdddb1daaaeb1df4e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"2d972852e655bb76327ea47e134854d589cf64538813171d00544a81dc138f4f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ca57331ce8d0c8497c210605ffe8878f757d572164898f4f870b89fcf2f9f1ed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"1ef135f8dcdcaa663d4184fa6364518f7001a744380301035f254e16acdad0b7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"06c1a51758821d18e14577dc995b939fe472579672223b3bf0c1a312b23f23c4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"a90d5652afa4bbc65c24ada88ebb0df97a9c759ab0004d0c85d28f7e4c012bb9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/premium-w3-f51151/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"acbe19c11dc0fe08b370bbe647de6ecce77849e75c774c3e46f4a7af09e2861f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"b1fa0497afe070203ab9c23aef75e896659b83c8305ca7a56664d1717528e732\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7b5f8cd8dfbddc7109fd206805e23a6ae21c18bf406c0001927759ff1a39122f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"64238089f4803f45c8353b0d5d05ac6a23d6a3647106591fdc2bd5299c0b0759\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fd143bc18213c3c4682bcced572bcf84c1cbc8cd87ea188e96c990f164fd5ade\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"3ede2f522e381a5e5b8affa5afed6ede7d3894cf263c247dca9b3f3f3ad4a676\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cf25727b6a9419d97ed5dc9613d3b6a26e590c05f01b5c4038461accc96bc026\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"fb213d7be796970427643a4a818af11356ba854b3a0477e3c48bc2ef3332c7d5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cb9167704c77a112808785ad099bc015c57786c61e7befec251b029ce378a0c6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"ef8b5b3a53f3de47fd70ccb56be2422e84d7fb1f10a03b64c032baca50a33c79\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9a4beabc5e6770b1db0aae064836730685e70fcacd601193f69aafe8156d41a4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"667e44e20cda74056b10928af7322c52f17d044dda1b5aded34df466201c3e4d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/premium-w3-f51151/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fdd358955bc325dacf4ae3d584d9dfaa236b2605d42014543bcddb868221d0fa\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"0a4335c7c536062bc1f3c4f55fad89ef387858062864c877a3014c384192a4f5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"91d11ef27666b7f1f85063266e00a4add2242586a1e8a4bac5447b3f4ec7925d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"26827917812d006281f7f7ba6e53d3573012708364624693432b2cbdd0f434b5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"79bf752ac34000e70b4860b3a87054e1aab2babf35019e7e24d203c82f5f1c70\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"e8683890d73b71f6556b533ec6f92b30804817a025abb3d3c716a89f9b3f85d9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"707f7a9a5bb373d466ca8ba9e6220842edd61bdf74768cdb8760aca4648a21b3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"b90f395e8ebaa67a3ab9ee2a967d88bbf981033415dedacddf2e76a8347bfd39\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/premium-w3-f51151/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a40304ff6b4a0f6c57da3d4a6bcc549a18c94ce2ed3356df2ce4c4621e7d5231\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"ff65bd9a43408c55f0593fcb41763d9030c7823704d875b6050eb2c39b500d75\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ab3c6da9622dba177dfaf10df58f987a09c5bd12e35f73cca3f03ce632140cd4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"9ec2510ba7c20be712eae31e88eb54985eedbb6ce61783804c05db0582107bc2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/premium-w3-f51151/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5d4b7dc290bd7cb2c0c574a9869b31b45107252e6aaf512691b5c665967d6821\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"f6fff5f3b2673f2810cddb2b65518e70b74aad58e6c27ef1faf828a9cdef8c14\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d896bcdf40d08e0bef242ce04aa58467e96c672450af890adda6941c53a574d3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"69bd1c4b3e1b36f5d5d62283b221b7026a4e53da339ac7c470f75cb4334435f6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"16bf1b94bcdc2b222ee7ef5dfdb45298f40e57fcf65f862a63a7b2d64b143143\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"ec2b739c69e9a51aedc6a2ee8ed6e7bbcb37f4eff66695b2c6d1bf4950a2ecb3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3fdafb69d9c72b7e3c78e50b30f01adec907957097c6a1e811ceff68d93d7c23\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"a31568314e38d20d12f5921c57463100edd3022d5f9f3c0b36033d9a4dee9193\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e11ba50523ae86c5c06c5b76176154ed9ba57c3ed13fa43133b1ac7249ce345f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"67192e2ead59827b5990f7b4cbc2aece4271402ddcdfaa76f7cf95d2d4552c43\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b6344fa6f672d55d2eb4fbf6449de24a41dbf664f8e9d3c01ecde50e9d46e233\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"3c429336b45d9712bfdb0d99ecd41baa0dde1570067b941b5927e1894931c254\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d1f3365185f5fcfe92899c5f49af1b579baab97128b8afee3eed4350859c3f14\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"2f17c508c987cffd0b45ebd164fcee3ad66819a39900f83fbeda518ccf619183\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"85124e62247f9234752fedfc382ba93d6f839dab53f49c16951446afa3e613aa\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"6d2c4320e5eae8e51596e1c62f1c7494e1c5f9cd5d374e73b3ddae65dd071a92\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"461f0fb3ed9e91195eaa488b65b6f04cb4bff62087edbcf0d4c2186d180ba0ab\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"994b30d96390325263d89c2da7554eadd9d4fd1811371afabaf057df68e19205\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d13670b5b1696edcb191c925fa86dd729eeb7447f2230e160d9cc03e0117604d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__2357d986\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"59fbf22c59a17ed4\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-simulator-w3-f51151\"]}],\"name\":\"f70585dfa8966b9748a8978bfdf51d589a9d85f553359b47bfa09ad8bb266b02\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"18b02d50add3a7c29ec6127eedab648f22d172b48224a97365a7798a612dcd01\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"1e0c9c02fbbf3d69df4286ba8224f5543dfc90c1df5aa687b5b6f1c00dce4d56\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3f0daf8882dbe2b0594c2bb310f151a319cec601c5028d24f0d4557684bfb5f1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"4d8ba792ec63f5d46b5589f993126734f136e3569a1b7639aaea8768dc2c0f57\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a8ad3ccfafcc25ea959dd98788332d9514ad2d762423f3039adff91a3381329f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"b159e4d34dc2a1f6fe05bc0d616c2ebb2d3306defc93bfb6d4035e2f842e1b91\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-worker-w3-f51151"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-worker-w3-f51151\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:53:21.860Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-worker-w0-0c9014","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T21:21:39Z","generation":15,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"ddb57683-c2b1-4246-8c87-c1833e256a52\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:52:38Z"}],"name":"kuadrant-e2e-worker-w0-0c9014","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-worker-w0-0c9014","uid":"ddb57683-c2b1-4246-8c87-c1833e256a52"}],"resourceVersion":"78836","uid":"3a59a593-1a36-4e21-9529-ff8f3620d431"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"86115b8156c50eab2036378ac37ec53b33537f0eef44a4aa5d81752c24254c82\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"c69d9902b654dc255ef5aa6007c01753aa727fc097ae6b83d952cc0cf913761b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bdc9387e460a2dc1a85bc42d8ce6440788e8331159ace91b443c9628ef7c1fed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"2f68643a3c63d5b17fdfef48d85bd91a0973501f0d563a896e4b380a0b00d185\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e1cab00a309f6035001c6bed21b280b9cd6d81b83072c8f351fbe860f69886ad\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"d886729ca10572769b8b41e68ee56fb12942ea073f0b48ede22b1cc50bfcc40f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fe65e47ea66e64f823a934786806a737bfe3ca692bad4019774d91daeb2348d1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"e10af8f1a2640cf1de04932f79e79764db98097340db6ec566b3ab0af709d0d8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"86115b8156c50eab2036378ac37ec53b33537f0eef44a4aa5d81752c24254c82\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"34720a2e4d6ed7817a277e99c8b6c63bea050141799be3b70b3690e8575a06a6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bdc9387e460a2dc1a85bc42d8ce6440788e8331159ace91b443c9628ef7c1fed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"3a712e9256a22351eb20be5c7695beb1ebb8fb8ce2b2061a380c7829f310a235\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e1cab00a309f6035001c6bed21b280b9cd6d81b83072c8f351fbe860f69886ad\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"24d4dc5eb03a2701700ed1da77fab5dada30f4d5f19acc2aeb784ab7c2913842\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fe65e47ea66e64f823a934786806a737bfe3ca692bad4019774d91daeb2348d1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"95b56d1eb3f5f986a8dcd4728f616565f9664996c1a434f44f7b87c3972457ca\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"86115b8156c50eab2036378ac37ec53b33537f0eef44a4aa5d81752c24254c82\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"f831f6710914a69194c3f7c48e2651f7e183a1e62afcb27c73307245ab045f93\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bdc9387e460a2dc1a85bc42d8ce6440788e8331159ace91b443c9628ef7c1fed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"ad3a2d8079306ff1eeb9734837c5b71f0724eb8028848f90dbf05b80557a363c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e1cab00a309f6035001c6bed21b280b9cd6d81b83072c8f351fbe860f69886ad\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"44114992b7dce232405acd1cfada4b72839265de04c15b8c8b12cba013144276\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fe65e47ea66e64f823a934786806a737bfe3ca692bad4019774d91daeb2348d1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"a594b6f1c0a2b22e4714c27e98575eda080192ee3760bdfca9b4ad6aa516eee0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"86115b8156c50eab2036378ac37ec53b33537f0eef44a4aa5d81752c24254c82\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"de21a6b7dab6f53ab9e521b41625d35020e107d76ddb50e2958e0e2a412d9e40\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bdc9387e460a2dc1a85bc42d8ce6440788e8331159ace91b443c9628ef7c1fed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"9d9413f8be4dfb8834299266127fb239516760f378a7601605194b5533f62a28\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e1cab00a309f6035001c6bed21b280b9cd6d81b83072c8f351fbe860f69886ad\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"b608ac3153414f90d7bc1d459d441fc96968144e3d07d2286f28927e15b1e621\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fe65e47ea66e64f823a934786806a737bfe3ca692bad4019774d91daeb2348d1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"31897c718cc142df0d5d16918dfaf37807fffedaa54950878ada2e28c78ed1ea\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"86115b8156c50eab2036378ac37ec53b33537f0eef44a4aa5d81752c24254c82\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"0f90af4971cd47ea5ddd60d45eba18a900b5cf23592a3f0ecd9d46778e3738e0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bdc9387e460a2dc1a85bc42d8ce6440788e8331159ace91b443c9628ef7c1fed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"93ac09aaab9c4f036a2bdd254b8b96a4151063abefd4189c40778e53ebecdc09\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e1cab00a309f6035001c6bed21b280b9cd6d81b83072c8f351fbe860f69886ad\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"8791484f6beb20141c5c557cf7cec8b4649b67a98f43b54539a6ee6a88bceb5f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fe65e47ea66e64f823a934786806a737bfe3ca692bad4019774d91daeb2348d1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"5009bcd6ede0ee206f1c68b91ea406216f5da58a2b1c5f056ba6778c5f13d641\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"86115b8156c50eab2036378ac37ec53b33537f0eef44a4aa5d81752c24254c82\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"140e618f0bcaa91b635c87d4f29e5f8813bf0436d1f6e9b36373faecbdec61eb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"86115b8156c50eab2036378ac37ec53b33537f0eef44a4aa5d81752c24254c82\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"6acbaeb49e85ee3cb000f040214618990342fd0a59de5b2c5a1f90647758a246\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bdc9387e460a2dc1a85bc42d8ce6440788e8331159ace91b443c9628ef7c1fed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"5b6e6a7f7dc5f0d34eb857ca49303262b3c223fe67458805f41c060248c5dbfe\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bdc9387e460a2dc1a85bc42d8ce6440788e8331159ace91b443c9628ef7c1fed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"2127668fa8fef2292ac1484bc4a37390a4f7d56256dc3e5dbee6c3e5a11a9b76\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e1cab00a309f6035001c6bed21b280b9cd6d81b83072c8f351fbe860f69886ad\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"0aa314d93ee3acda2c2d9263c7d5271f8931007a465cca802fa4f97f82de8fea\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e1cab00a309f6035001c6bed21b280b9cd6d81b83072c8f351fbe860f69886ad\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"cb70a8e00aa575e704bd5c438dfcc5d7f8961efe6033fd93fae3fc6eca018120\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fe65e47ea66e64f823a934786806a737bfe3ca692bad4019774d91daeb2348d1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"1acbce7018705c04168bda5187e037e60c0fe47f186f10f96e84266e33b5b034\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fe65e47ea66e64f823a934786806a737bfe3ca692bad4019774d91daeb2348d1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"52baf0b74be4e68628b5b4ef71a9d95dad1cf739658ce467c9b24c3165eac562\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"86115b8156c50eab2036378ac37ec53b33537f0eef44a4aa5d81752c24254c82\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"a9b1a49056b3283c82e0d4f88ad61bed5b6f4b736a70f1bb2ef4ba19a80a05e0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bdc9387e460a2dc1a85bc42d8ce6440788e8331159ace91b443c9628ef7c1fed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"30c85ca7419d0f9a695b73530b16cb571b50e9dde62c1210e8c4fe44c14e4def\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e1cab00a309f6035001c6bed21b280b9cd6d81b83072c8f351fbe860f69886ad\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"5a52f00c07e5813093290d1bee011f0120610619cb82666a79b0139919644d6e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fe65e47ea66e64f823a934786806a737bfe3ca692bad4019774d91daeb2348d1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"309ad48f4f9314f702e5565256eb6d81567787f6737820f7ffb21a6d85a92b93\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"00c4d48b9f06a2f5dbb9cbe22ae3dcc9e10401b038e62058849dcebe2769e4f1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-0c9014\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-0c9014\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"02e0339b7fefd72794f04b407e26149d4822a36b0c408bf1129e0f7ccdc0cfdb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"884ebceaf8f5da21059151f97834277770ed77023feb57f83fc8c75e495f8d1c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"bb55cf856b87c0953ba4478213144ef02787b3cbbf80cc32e530521407ee40b0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7da280ddad70ebcc1b84b8a595244d0682cd0302755439371683331c4562cfe5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"23b1ef8cd3219264f8227915650891004d0dbf97a799031e0e6e6967fcd5f1c8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fe169ab2014a705a54df2fda4ec719f7132fd6bba54202f7531ce8df8da2bdf6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"5f4fc30622e992160dd04a2ed38f7e44c1794374d6682ae9f1f7ca01be3ee831\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8cb0b0d9cbe25e4182aea7d2ed6f3ca636a7d0c9be364f722b182dde26da45e1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"ca6fe2da7884bdf4da7e4fad467882fb9f7b1a542ef29da25c93b58c0a2facf5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5f8a52baf63f9e4c9ea31b6e22c9076262e33bc06968bbcb213439af05ae3a21\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"4e45e802c43f08adeba0b390be3827705a757991fe469c439db480762890906f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9a7eea6dc0fbfacc7f1b1980a90d1b04de88692dd5758d6a6457477b77a64673\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"0657b3667bafd18f07dc410bc515b76f51256e8c487baf4fe36409a313e6191e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ece9796b491eeaad9788ab6c426bb54d8cbb85433a9010ef2c4d3f579cca0db0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"5b95fd1a3cba680d3078cbfcc3ed349106804d68df9ff279d7829f1ce54c9fcb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3d645f3ac772a0cc5a9a71b4e6a542a2b2ab9962190903cb5d89d3e8e45b7f9d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"d61768c90b21a96135005ba91b0f0abbf7ffc2bd4f372c506a740a4d2280118a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bcf1ddf402fe28df1f45e616a2e2380b51177c45a7f8dcdd03bc2aa6b5814d26\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"0d7aee7ae66dd59feb746b56375d3063a0a395dd032211e5f6fd8a79acc4c534\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4cc208f8f31098b1cdf91b5776a85b52bae0339e659b20995e8ad11208703993\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"d480cd881add8aa6a454eefd0ff4a4f1883e0f31dd0af2c4fc8d49930dfd988a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"096fbc9d544918ac5b9d60464268ef3b1f03546e96ed130c743da74445576f52\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"862991ab77df3e7a553882c71a94c90c8006da4badbb5d62b2523a0c2ae8397b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"228ec96802a09009d984b3728e4e96175fefb32ba2e3b918071e85b3f8ec79d0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"1174da5781e0d01a3f99ec7d577f0c792e9d2f3d97450b0297d625c782aae7c6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6d14c0784badaddad1e95c3697462cedd1c5a5cf32d3a98f16155abc0721429e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"c6601f905085efd63830b0439c759fd2e17f4b3a0625b37e6ca853dfb418a3fe\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"669fd13dfb6f84f6e255bbee071a63253e1d5bd80a372cb6a445299b3c53a1a6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"aae79ba1b6eabe4b8be62d566c21c48755697af6a5a955ca0108115f218409f6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b0bfe3b1d3a080ff25e482046cf0d1df0ca30a090ef9f8424787467410af7627\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"cfedc7f35c0353d53fec0474975ad5e05c19ec8b2ac4718a77f59ccd7fb1233c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b0476fc7cd4ea3306c893f375fa8b815ad5c84676dd8000109732b76fc6c9e7d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"2fc0502446287f4669be2a416f781c0acba21256ff9eb15861862053f18d0e29\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4dcc64ddad4ef375730fe33c8b8925944bf0c1750f66d8a3347219a51dd190d3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"fe7515ad4af2d0fbe432bcf9bb564a76c332dd67819f108c4e0ccd547ada4eb1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a24eea90cd520665ff61391c71ddaf8965158b1b42c4e6f9fe99dd03dfa7c401\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"2036d4e41537afdd08f850cbe0bbe0d23c83b572c0c1f917f2cd718904dfce6d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1cd65b24c576b1e8f7a954fffca2225dfb109bf5a068107003d4f72206723e55\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"909bedc4bbf04ca094fb3d369cf7cb3b15d83ab3e98ef27c04ee79b787659c95\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"be088898c71049f4ea232cae6dd479dfab1a9947fba6b17e7353ce14e639507c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"cfc0c9b5c46987f78f689a5a334275694f4c03653d50c2fbe6e969e238c7f8cb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"03e9bc99c98697160f9a6db2252bc0ba9e88e4ed113a3d5d851256f6cee3dcab\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"642d89c776f69505ff2a885b3a3e0374200ad36c578ca4799ed899b1dc0cf546\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0e0bbf1b6879cb3f68f7ea7f2afda47c74a88c5d3cb97fdf3e110cdc54718649\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"f05bad08945108f9026112e207cee46af50e92faf4445f0e991b27b9412c4c58\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ad6b1369f6065e5d01605f83113ef1c7c93ed4b3fa8d01ad81d870c4a418f675\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"9eb0cbcb37fa43674c71b90f27589d7260b93ced662c1ceb0efe4cb1f91dab4c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4b932ff2b149c42a260b63c5bdd2b0515a398d1964de7381e0735756ee620b8e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"6fbda76757cae53d56b898432e232fb51847f0a1452503c1d53bf530847020ed\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a8ba5320fff14c281f32c2b0a9e757f0e205aace00c294b0d13fa46185724d35\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"8d788326bd35d2b328ba885da80b8eac2f0f1f55930d0bd275aa0c5fd637e227\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0ad1aa31e975e4b569a9617aed9c37982646578e71674b0d96896f60dc232a90\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"c8ee3691fdd0cb6a376274ca4ee98e52cb5718f985d4f539fb764ae6116296f6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0be4b31b8961f89b18ef02b2a56a0b76e7cb0d94a4440a467414ac2d9a504010\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"235df022eefeafa48d660af3720c4cb0c0fec34ddef36d3c467db88f9a57b07f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"69645d92530f5991fb0c1154aa418715dafc9eb9b4b827c33aa742687b00c4fc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"b449a8480f629d5de320a05efeec5a558221dbb03b4dac7572367202e5ec4e3a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"96d049688a520cd26e12f2232f544b815eac1611ab00713e2f641e57b40e5f84\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"bc1544ecfcc1a9c24b532fcd9001124011a4a99e354877a6f611310592c512dc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fbfa7264341556b62c34307c6c836c7e015aeca2df10913c89f8c2d9d38fd28d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"787567c7ebc18db7ec0598b9dbf1466caebf9a1d07f97cfb4afbc3f8bc3fd0e4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"03938d68f68953b697b7b9ec3a9bb3205251dab0d8c28c8488a51872990c74d6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"0d7a95a011dd25d93bb4476331e0b43d38df072b07b758073c5e89ae27e7c6e3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea4599ace477623ac871dedf5650245e6a589cd60cb7c50944431b6bd5453ebc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"06aff6eabb02cda098099e156015c1b3f2389b929e7df774b34188d1589de73e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"463f896d9e9b5a3f2518e764053718a018fbe93828587f90cc4250e5a67a2236\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"88eb8224ce85abcb39e51aee14e03c01d32d86bc4f686e66279e969a1413d263\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d2e0eee1c8e9f13da0b4cd4af8a834f482ac80e1620cc44747922a7c61d6a51b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"203a868aa43281568c0e425caebe830e36d9bb16cabaf6e7dd92722711d4e496\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0dcf2663d1fa4c3fb5056f3703d9d1a316345e3f4ea0e2503f77738258a9e6a2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"c4e555c424bbb24fa529375505443d3163dbb2379b150d3ae00c6689e4123fae\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"29a6e78291fb6eb1600fcc523c35316897713ec3a1f3092074998de0701a2bff\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"220018b07e05f37b279946d5b903a8c5295a21774b20d317b40db4ae44ab089f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea78fba3abdfbae2cfbad8389b4c97d45d924dfb8eebd29422ca7a2b62f9564f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"86fdf51aa1b29a978535560d7a45ad778e5802bfe467d27e1295c743248d1507\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"dcddce6770eda2db3f8f60d8b51b5ed927194e11c56d328f35000b6f5e92dbdf\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"df9a2fd989201e2d0ef8377583b501f9afac6836df894071bbae9e6b6b2598f4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b8e8a49e358e54b12e2aba59e563ba17bcf32315bebde13a721f3b7ebfae18ba\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"742ed2fd7d94f5d252aeaa965657e054bac8691ea31b81375ab8a5488c2f2888\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"327ad026e5a9c61ed15c52c9e2fb0c219e4d9a636a17ed736f525f2b42ebfd6d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"8b45807e9f971b175f77e49aa0f5e281c0245f33f6942f95c36aedfd7d419199\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"59093ab44195ceb3a72fd7400b422644d3d7c840cd3e838bafbbcf827cbcc073\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-0c9014\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-0c9014\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"bde801ad48bcba39a3cf88516077f8fad94dd2ce0692d0f274ab650cb9cc6614\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fbf5e5a312486cd624620a8628b976f89d3b75ffa1d3e47224c08e003294432f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-0c9014\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-0c9014\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"047906c5f7db776a9bd905e481a3347b0c84bd6edf626dc5626ed91115c7408a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cbaea0f78f7b655ed1c234a9fbf7020e12e29bee546d39c314b814aa1692620f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-0c9014\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-0c9014\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"1e414f5eaffdbc43cdaeda8552267e2b46abc1a6b41adfdb24735f3843a9c51f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2ab986aa56245948b966f417e9db684ac2bae70862e05b68a996c57de4d7c4c9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-0c9014\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-0c9014\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"3f61be5c1cb2e788fb6ec123b23519795a5d4fa05fbf9eb842b61931843e1834\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"83f9aef31a325eccb5ee1ca5935289e892a53f7f9d05ac2a6d2b8a973624d6db\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-0c9014\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-0c9014\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"ead8e640f12ec2a2a5b9632dbacd377499d067469c52a5e5c7791f29393639d3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"93867ab0bab47561de7ff57c3a2f54a4e134cfb5a3ee35d78ee703589d669077\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__5e1a7185\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"8f284dc026e8e45d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-simulator-w0-0c9014\"]}],\"name\":\"760f6f0b0f0dfc05ff96616a7ebd6878ae6a8e384823348a74bc46e7ee6e70ab\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"06c24ca69f585351676e3a47fdf7a96df9b9a8fe85641e1c3348c8cfdfe446cb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"2089b2caaee71efefb7e26192d15a3376881340fd07cbc304d192587b50b0c07\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f713c09235fdc689702761ce6f8fb3c2c03ea75f66382e5121160a24cf7aee9d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"78522ace7509d509793c07978801f1f4bab7d64f1ad59df33af972c953cd6851\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6b6f55f762b51c1f46156308a7f509359377c543fd3789f104b3416ff46e3216\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"06aab5232bb89b6e09b9780286eb3fceeee4557f3ea4efd5ede8278ad6c21170\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-worker-w0-0c9014"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-worker-w0-0c9014\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:53:22.216Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-worker-w4-d6cb38","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T21:21:30Z","generation":14,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"36c0d6c0-4ad3-4739-8e18-24485ab1bc48\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:52:39Z"}],"name":"kuadrant-e2e-worker-w4-d6cb38","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-worker-w4-d6cb38","uid":"36c0d6c0-4ad3-4739-8e18-24485ab1bc48"}],"resourceVersion":"78843","uid":"2255fc2d-ab48-428d-86a8-4726b25b244c"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7f9f489fba4cc345dba07951f043d704ea999478c1da34cd23037357dcdf1384\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"f61d2b7d2f64f1d64a2dcee70f47ce24c9c6eb4854589984128561c58f6171ac\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"12f3d170c629c434ef1558f623819a2294b75940427c1164b50933cdad3fb52f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"4d6b2e7d73dcdd0567dbe7811fffb6b677ae17a404dd4e000e5586417b4abff9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"af01177c39cc2acfc81deb8fed1e1062fd6125232da28da32592d4c0fd546c97\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"c66c5829a3315f16b0f26dd5daed466c5b2b261235b86bfb98043e96d7dd9de0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"16e9561ee4c6deff2fa31e8a5aec69ff1b5c963a2bd79d3413890752338a808c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"85bbc444688b414fd85af5d3f6532006d93d40793700cdf48cc119eb12135602\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-2-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7f9f489fba4cc345dba07951f043d704ea999478c1da34cd23037357dcdf1384\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"5b984da304c827646ff112362de545fa451a799e7f6999eac00f25f038606c2a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"12f3d170c629c434ef1558f623819a2294b75940427c1164b50933cdad3fb52f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"ad40721e9bd95807ea332811f94d79eb07b9dd045127a232886a7924332cbc73\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"af01177c39cc2acfc81deb8fed1e1062fd6125232da28da32592d4c0fd546c97\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"9190216f349b0595dc54d5cad3f429f840bbb0e4a2c199f4f2c79134aeb92beb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"16e9561ee4c6deff2fa31e8a5aec69ff1b5c963a2bd79d3413890752338a808c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"4447ac687428f773a4b67c9b5c06c6a0359aeee3ba2dd093ddd5af4018b5d896\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-2-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7f9f489fba4cc345dba07951f043d704ea999478c1da34cd23037357dcdf1384\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"b91256531abbaaf08ed45e4a93b53e9af9ebb53002123196214bb374517e81f0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"12f3d170c629c434ef1558f623819a2294b75940427c1164b50933cdad3fb52f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"597cf592078ae14c96f33099e96fee363339bedb2f5d430fdd69e28e8be2a8ff\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"af01177c39cc2acfc81deb8fed1e1062fd6125232da28da32592d4c0fd546c97\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"165316669577d87085504ec32756c6d6d67f595b2690025965232ab07a1da412\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"16e9561ee4c6deff2fa31e8a5aec69ff1b5c963a2bd79d3413890752338a808c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"b868f10bd5b40e8919994fca53311146eef16ba432d05144082d631a9418e83a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-2-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7f9f489fba4cc345dba07951f043d704ea999478c1da34cd23037357dcdf1384\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"490344715bd8708a2d31131fc3b4e370beef7eb7d9942ba89fc82080284e6244\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"12f3d170c629c434ef1558f623819a2294b75940427c1164b50933cdad3fb52f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"aeb99e2df9a1951917065c7b887084431b3e62a6f4d47287af43193676a5b8be\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"af01177c39cc2acfc81deb8fed1e1062fd6125232da28da32592d4c0fd546c97\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"76f141d8a065403b5c0a2fc7e2c76ce1301f93b13d91fd2078e5f2b4d2280197\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"16e9561ee4c6deff2fa31e8a5aec69ff1b5c963a2bd79d3413890752338a808c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"fb58ee2926965a2dcd5e496ba51d76076fbac1dbb0faeb6aaa8849736beb98ec\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-2-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7f9f489fba4cc345dba07951f043d704ea999478c1da34cd23037357dcdf1384\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"fa28a7ae652b865919d1ff4c61fd33bb8512d3139af38d1ceb9697a99e63cc6b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"12f3d170c629c434ef1558f623819a2294b75940427c1164b50933cdad3fb52f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"601d68ffdf7137fde779cf41214f1c74f63e6b717be0b7aad1eb56041a2d9b76\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"af01177c39cc2acfc81deb8fed1e1062fd6125232da28da32592d4c0fd546c97\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"b7d42066b553c2d03aee2da38514171a14e8ae8d343c0fda8f80d3265343c45c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"16e9561ee4c6deff2fa31e8a5aec69ff1b5c963a2bd79d3413890752338a808c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"157f8deef4224451e2a5d831c8369a39aa3b418062c8767a9f84de3947b7356c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-2-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7f9f489fba4cc345dba07951f043d704ea999478c1da34cd23037357dcdf1384\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"2dea78ba3797dedd7edd7b687182785345cfd95029e2131769c5797e3b752eb5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7f9f489fba4cc345dba07951f043d704ea999478c1da34cd23037357dcdf1384\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"cdb3a0c564011d63952f137daa521c84f02a66f8a75696ef9ac4f1f2cc9ea8c9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"12f3d170c629c434ef1558f623819a2294b75940427c1164b50933cdad3fb52f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"e019089f573a8879defa7fdce139828725d9f042c5a4dc9974b9185a8a382c51\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"12f3d170c629c434ef1558f623819a2294b75940427c1164b50933cdad3fb52f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"6a08c6dd0c7522c09a18466dfa733eb68e8c593cdc8d2890ccff2f5c9064fcc0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"af01177c39cc2acfc81deb8fed1e1062fd6125232da28da32592d4c0fd546c97\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"6f15db2f827c7eda1ecbf154277f01be4351cb08f525fa50ec0da278253b6d6b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"af01177c39cc2acfc81deb8fed1e1062fd6125232da28da32592d4c0fd546c97\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"5a27a9e4c9daab234151b3ade5f24a8f9f235443ec26586cc0a883b4ca237233\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"16e9561ee4c6deff2fa31e8a5aec69ff1b5c963a2bd79d3413890752338a808c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"1589c12ca11e6544f2b7072121804f185e5630b2cdcfa71c0561af4619194727\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-2-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"16e9561ee4c6deff2fa31e8a5aec69ff1b5c963a2bd79d3413890752338a808c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"1faaf26cba48036c2d95bf76257bcd6baf769ac5e6eed0a8964eec058af259eb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-2-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7f9f489fba4cc345dba07951f043d704ea999478c1da34cd23037357dcdf1384\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"31c0c96d54839068517aaeb062676423451143447943cafff7ee595d9fd1feca\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"12f3d170c629c434ef1558f623819a2294b75940427c1164b50933cdad3fb52f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"aebde4a102828558eb0fbde9709268d7adabc75fadf451c730e0573c086e2f07\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"af01177c39cc2acfc81deb8fed1e1062fd6125232da28da32592d4c0fd546c97\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"87ed1d3b3cd1e3027869c6fc197828ccea328c7f84e2acdf7e06e70b8842fdd7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"16e9561ee4c6deff2fa31e8a5aec69ff1b5c963a2bd79d3413890752338a808c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"d90c0faa5819af99665a29bf35d18a090fc213efb27bcb06e9cc9c8a2be3094c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-2-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a69bb45bad035c53dd8c7176828b1cc26d0c9d3f775d2059034b1639ca1b49d8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"79db77eb448edf55b65761a293f7f6fc07c9d4365912f7a8595364cdbf33d994\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"94dcd05ea37e3629c540245bc47fd87fca3f73a8e2994ead89bda609cefca74a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"f682bdd564171974ac50af1b79bec8319fb070d4f9ff054872e07f0bb5970828\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-2-w4-d6cb38/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e5e9b9fa41efe7f56f3ea6e9079d12a9f3e89cd596105815b30b04ba7ba1281b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"9b7cb9a28ed2fc7fdfa23c7d8d869cc573e3e72423805bef3f945a77d2785710\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"32a498b3029fba046b39d6c26d52ecb2de8f74b942f2d122b45240b1a839deae\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"7442c06fdbee3ca35e62201bfc1ded73b46ccce5d6905e07f6a1792cecd8bc10\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-w4-d6cb38/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"dff7a596e1042978304d40238abe84063cc499f4a6a2f9def85e7c84d1df1ebc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"4ebe0e741886c221cfcd8d1126bcb3535dcbe15c7f802a713d3b2ceb8cee37e1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ad3bad78fb2ca1b68182c777555c2a07f35742a0dc28e73d65c173489bf20bfe\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"adeaca08e9f8fd42fe69e77eee49140cfd5715eac018c5601b0d3378d917d2ce\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-2-w4-d6cb38/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4db1dd6250896b02d5f97b90471902db72d349ea082f211b7b5e4046c827d477\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"9e4cdffa79635674b661188290cd9c853017f5721accaa1f268edc6c6b7f2590\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1f3d6ce43ced512267c700bcaefac5fe1e5a0f56279d9c49efc4ca04e0d03518\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"a9a34f579b60868ec0be5a14bb835a3898e0c43fe25650166ed2178248bbe1f9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-w4-d6cb38/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c7906cc8021baa6797dfa1978c7ce78b494865d95b66f59ca1cd380376b5fba9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"6ae22229709f702a5686121e25321b1ca57a9a38cb7380c3cbc347a36b32a2f4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-2-w4-d6cb38/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8ea982efbe7afcd4f8dbaa4e864584b38ec852971d686ed11c87e99f1b9f4f9a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"1ed83021e2408187ee74cd1a66732d37b92c80d46439951ce5e0f654f1542381\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7d8b4229a4e8df0df0b627da5317c526c045e2ab5837161d638a7835193820d5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"36ee8c63f509519eef9ec6e2c257745b647d322586f8289611274ca06f90ec11\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"33871c6a0ae4feae1469b537cc1ea6bbbd60286eed4edf3f6b041e5ca65d4b23\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"44c4b2971f379de31e5b1b9aa432f9a0e14ca85e20312f6967c9581de8fe5e23\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-2-w4-d6cb38/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2c4b4abb753457c4ad4bd5815f6ce55723fcfcf44f298a47923e03e51d023a49\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"3ce9856de6f3b95cc2ed4fe4abeef13ecb59b5b1ef0102b858e5d3ec0d8afa89\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"99a01d66d9ba32727c09707b61669b110b150d8025da9291ae815b1d8e07454c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"77ec05cc7c773a3540c71498b5777588286f6a84b1595d80c4f1634ded3def93\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-w4-d6cb38/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7fdbd59414185d321c56439c757d9c725c67465b49a83a52b935fdd9c5f0df82\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"2eb3ad4b5e4be8080b2e0309815371172455a7e5f61cf9c3c595f17e99e6f681\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c806bf2d4d850ded382b88489831427afef078ecb67dd4c920a1355d1453a2f9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"ac190091ad6e540c35613b81dc40071b56f4f92355769f89e35c56f588a5f040\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-w4-d6cb38/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bb82cce53996fd9a50a4f33832b37ff599d227ab91d54895bf0ab989d1eb0b01\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"138b7da9a4ea2091f7b13106ba292672e2ca1d22138b32de717b07cab221eebc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9ba6421c13373b029e319749dfcc66205cba71509d9781aae6bc20029ca16a7b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"64d8cc6534e1f2b54595d10cceba7274e4820b1bc4cc4a0f7fffbb2bb61304a9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-2-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7ebdbd5a6be861834fc366408f369ad8f021dfe8f061cbc93334bc801f3df98f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"be4080fc1058816edd779c6c2b40a1657320a89a6a86b4ff7358026a6adb2e23\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6d3e7a9a4b4298310e0bfe2e3cbd62aec91a573c07d02cbee9db82354ce9ae45\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"8cc4fab950417e53f8887a857eadcd63e5254ca90ce535ac8312884267a353f5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b69fcfecbff8a7db20373884ddd2ca22e39f7a814dfc0946441bf6dc7f369a4d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"b2ed152f8ee7914ee5d821eac3bce97f229c18d303b8bf53e7c6d08dbd946a69\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a6e80d640d49da44f2b60f9db62279137aa6839ed5acbca6493b96977b1f3f9b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"b470ad22bfeca185d9d86c6a107cdea6e62f1aaf494ef31244de0d30052bbcfc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b1fdba63ead328fd43c505e06394bc2adb7e5e2dfb0a1e55ef2c41d8f345142f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"30a1d05fede91486be251352bb7291a36ac69d50b6fce18433612afe29f1b4b1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f333a7db2a4322946ba06e577de4e4465e1174fb5cc0bb60d8d97ffd9018dc4b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"ee6bf02baeb9e28323dc2d9fa206cb2ed963925f778322eed091490229b29e9e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f2655bcd7b6a7d3d8a4479c1c943c5f2b4d4fbb7d96408fc7ce07c4e7bd9f30c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"12835533e58f43762872e20b92b523339a9de435dc7d0f689b42133b367fae44\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e99af4c913dc9844409b7c31f2f26b7f80984fdcc4a30c1de535a7a3435d0ae8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"c9d5a4401f4154088ac8ced8673158a379ae2073a1dce32a0504c995271c0e88\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"309f6b916a61539853033efc6ca2e083c01c99e5b96f857a7c78b89f9816f598\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"788f4c0f9a4e5a97247c2043b8125cf170fe6674c40d873723dc972c4d5d93af\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"68beb50e573f7f8f729255a19248728f937beeab700e92bcc9c0a070e602e982\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"26447c99384ffe81ccfc09fad9c33ffe60c6796933a9e2734b738ff5de8c664b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6060eef24f1f9e109ceaa90837578da0e77128864be44cea71a6e4d056f6aed1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"075d582681ff3e0d68d4a835d43bc72dd6bc492d9a3ca8b6dd3ef470e6b6946d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9a1afd5e20de63bb2c85d93c9c3fd7aae15a0f45cb6e07dc467b8063b97decee\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"4c928eaa593596b5c3719a02958892d193943b2129a32e43035c896d93b232c1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4b5d6544ef7fd39f49a5af0551f4a404b0a5f49df3054a95306b7f797216c599\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"8773bca7122a801a4f199775b03693ad30e316ffebea5bcaf72af079bf14f24d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c5c4680765cefb123f1033aa2b612856432a81adb7bccb16df753674ddd4a42e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"cb4b2a4191c8a55c17ce5101bc78ca33035bffe16815d6ab6f63b4fa3147b68a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3474cd3af51b646106406cc4778f6a5608fdc62b1fd92f27ccbcf8ab285bc05c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"f0bc235629f48b82dcaad76bce5cdb80abfa82763d9ad220a11c3e27d70223d5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"af8712f819a09682d066de98c1b93feb5b0f27e478190be446e0c2d881c1e213\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"8ea734d5ea8e3432cc886f3fd011204345c05060f7991aff6617797636b9896a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c34c962f04362894a54cdf652c523865dbd1633f051244729b008181d474e55\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"2c3bfc8693c69427d3231717a8df2d14aba0f1fb87d9fd82bb191f0ebb31c308\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"915885eb7c9a3e141be9223dcd2bf03d4b850977922b9f3ad6f812809cf05a77\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"6816c53aa0b9171acb1b1522501aef6282ab95e3b7509a288af72c749a40063f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e12ef81cd87aec42f5b2528c46a9aeefe6b1bca82398f07b17a52a4bf6e91945\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"bd1615998be1912965bb2d26173bc1bd1e2565f8996f1f21fc476ccff3b1ad05\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a2f26131fa92b8ff5a24a34c4f1276e2ebde9d4239d1c79890c5f312ae6d007d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"199ebbeac914dfbab35c15e934f10f9f3b2214a0617964999f2157bf0c31b763\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a6fa5c95daf46871f07bc4e3ef7985a19659c040a1ef2a7baccccaa90e241705\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"3a34ac7af354fbf7d29872077cc2e557a29218e220d9e4e79e21710f2084e770\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"347ab4a75cfecc2353073cab067f0c183bd7a253c653eba93329ecf6aa4c77b2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"7eac06b7d9983846e2e0314ba9178882139d7919173fba3a84a8b264634346a5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"16cb85f469e7c5716866312b8b4cc95d7bd4782b54923c1571be2b995ef85c30\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"a65b58c28d5a781726a832c59d62e640ea9d347c008d6795a6bc79865414532f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3aa68add648f18fb79f3def0d73f0c2f29d8ab60b1352cf4548a1a038cf3d923\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"fad9cba453f811618739c6f08a8544a889f48ec7511f7d3ccac0f71ba988967b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"099191e40682a5a6b1df435c6dc10936b8b4e31a891f3520e8e9f8418b1acc3e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"adbf9660bf8db4b1489d019993fddbd2863d0cf7c72174df8663c00e565a1e21\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"13694f4cecc05b3e953bb7d1aa68f96fad9b8548456e1357cc504ba9936493bf\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"fd3f6d135cf69e39efa3702af6a7e665f47a40ddb90f71d1f37cad11438027bc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"db8ed9490207e877020d08d86f8a9769046fd69225998abd4e476e93ef7b9431\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"e3ae0784ebe4c51499f320023e5e93f640f2a33ae4fea237cb7e068df1c76739\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"12dec0ddb151cc18ef75cfe2b4260788095e28a391f359fc3f7da7c75381b728\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w4-d6cb38\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"8f6398fb66bae44affa747ad532a12445774a5b43ca2c7196a633d5d03da8c80\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"735d43fce555e32c36cd137abc0678ce944fbfe58a677497d16ab8d9ab37074f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__71cbb21c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"d849c6c9f966cd8e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/simulator-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-simulator-w4-d6cb38\"]}],\"name\":\"1016de6b3250a59509e3bc1de65ad0a68ae6faf776c4eaa853d86bce7dd96698\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/simulator-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9a442413f7e81c114c48c6bbdd04c0e3809cdcdf4def1f524f6d3adf70468027\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__15e6b18a\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c26f852a36a58962\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/premium-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w4-d6cb38/maas-trlp-premium-w4-d6cb38\"]}],\"name\":\"785762b8cbcc7dd30b578476b081ad2df517e9e450947fa2591a488b59407126\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/premium-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"204a90b318233d1075e557d2348b027549cbc82cda4c1d6aea6cfcfa28a96654\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"7bb190477ec8b722acf5b940486e283cbb3ed66f8b99945c184f13fdd5e8b25e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-w4-d6cb38')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e5f21bd702765764bb09a1ee4f30f2c44baa119970ede500be5eedb7653d9284\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w4-d6cb38-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__236ab6b3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w4-d6cb38/distinct-2-w4-d6cb38-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w4-d6cb38\"]}],\"name\":\"c83d6ce70647211ab5b215758b02838f2d1d66725baa3ae1e3b9d5635dc53006\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w4-d6cb38/models/e2e/distinct-2-w4-d6cb38')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-worker-w4-d6cb38"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-worker-w4-d6cb38\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:53:22.417Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w4-d6cb38","namespace":"e2e-models-e2e-worker-w4-d6cb38","uid":"486176e6-7786-40c4-9ce0-6f4a68b408b2","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w4-d6cb38\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:53:22.657Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w0-0c9014","namespace":"e2e-models-e2e-worker-w0-0c9014","uid":"4f647df6-1d5b-433b-b4fc-1279ff1755f7","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w0-0c9014\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:53:22.777Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-praxis-route-aa8aff","namespace":"ai-tenant-e2e-praxis-a-aa8aff","uid":"ec82f7f9-504c-4c30-bac2-f41119f212de","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-praxis-route-aa8aff\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:53:23.016Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-praxis-b-3c7706","namespace":"openshift-ingress","uid":"b0510110-7e9f-4e4e-8e3c-79563c2bd717","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-praxis-b-3c7706\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:53:23.087Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-praxis-b-3c7706-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-praxis-b-3c7706-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:53:23.312Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-praxis-a-aa8aff","namespace":"openshift-ingress","uid":"35c18d3c-7dd9-4528-af0f-0ffed5359ea0","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-praxis-a-aa8aff\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:53:23.790Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:53:23.790Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T21:53:23.870Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"praxis-route-aa8aff-kserve-route","namespace":"ai-tenant-e2e-praxis-a-aa8aff","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"praxis-route-aa8aff-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:53:23.956Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"distinct-w3-f51151-kserve-route","namespace":"e2e-models-e2e-worker-w3-f51151","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"distinct-w3-f51151-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:53:23.970Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-a-w4-7cde84","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-shared-a-w4-7cde84\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:53:24.125Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"distinct-2-w3-f51151-kserve-route","namespace":"e2e-models-e2e-worker-w3-f51151","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"distinct-2-w3-f51151-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:53:24.323Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"distinct-w0-0c9014-kserve-route","namespace":"e2e-models-e2e-worker-w0-0c9014","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"distinct-w0-0c9014-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:53:31.406Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway","HTTPRoute","Limitador","TokenRateLimitPolicy","EnvoyFilter","ConfigMap","AuthPolicy"],"eventTypes":{"update":17}}
{"level":"info","ts":"2026-11-02T21:53:31.719Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:53:34.156Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:53:34.275Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:53:34.275Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:53:37.984Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:53:37.984Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:53:38.032Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-02T21:53:38.032Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:53:38.044Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:53:38.046Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:53:38.046Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:53:40.673Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:53:40.673Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:53:45.187Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","ConfigMap","Limitador"],"eventTypes":{"update":18}}
{"level":"info","ts":"2026-11-02T21:53:45.637Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:53:47.251Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:53:47.356Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:53:47.356Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:53:50.381Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:53:50.387Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-02T21:53:50.387Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:53:50.388Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:53:50.423Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:53:50.423Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:53:50Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-shared-a-w3-97995b","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-a-w3-97995b","reconcileID":"39c9cf7c-fc71-4f46-8ddc-bd36beb7ae65","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-shared-a-w3-97995b","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:53:50Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-a-w3-97995b","event":"CREATE"}
{"level":"info","ts":"2026-11-02T21:53:50Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:53:51Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-02T21:53:51Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-02T21:53:51Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:53:51Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-shared-a-w3-97995b","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-a-w3-97995b","reconcileID":"3c6f3ca9-bc9d-4450-bd95-7b71718b2b9f","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-shared-a-w3-97995b","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:53:51Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-a-w3-97995b","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T21:53:51Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:53:52Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-02T21:53:52Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-02T21:53:52Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-02T21:53:52Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:53:52Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-shared-a-w3-97995b","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-a-w3-97995b","reconcileID":"f88be19d-d81a-4c8d-a929-5aefb92cda2e","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-shared-a-w3-97995b","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:53:52Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-a-w3-97995b","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T21:53:52Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-02T21:53:52.546Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-praxis-route-aa8aff","namespace":"ai-tenant-e2e-praxis-a-aa8aff","uid":"ec82f7f9-504c-4c30-bac2-f41119f212de","error":"tokenratelimitpolicies.kuadrant.io \"maas-trlp-praxis-route-aa8aff\" not found"}
{"level":"info","ts":"2026-11-02T21:53:52Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-02T21:53:52Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-02T21:53:52Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-02T21:53:52Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:53:53.109Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:53:53.109Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T21:53:53.230Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-a-w3-97995b","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-shared-a-w3-97995b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:53:53.825Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-praxis-a-aa8aff","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-praxis-a-aa8aff\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:54:00.667Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway","TokenRateLimitPolicy","HTTPRoute","AuthPolicy","Kuadrant","ConfigMap"],"eventTypes":{"create":3,"delete":2,"update":5}}
{"level":"info","ts":"2026-11-02T21:54:01.023Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:54:01.043Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:54:03.757Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:54:03.764Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:54:03.965Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:54:03.965Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:54:03.965Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:54:06Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-shared-a-w0-6e535d","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-a-w0-6e535d","reconcileID":"487ab2fb-0772-4d36-98e9-38fd4c686378","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-shared-a-w0-6e535d","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:54:06Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-a-w0-6e535d","event":"CREATE"}
{"level":"info","ts":"2026-11-02T21:54:06Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:54:07.027Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:54:07.032Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:54:07.036Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:54:07.036Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:54:07.038Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:54:07.040Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:54:07.154Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:54:07Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-02T21:54:07Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-02T21:54:07Z","logger":"telemetry-policy-extension-controller","msg":"Failed to update status: resource might just be outdated"}
{"level":"info","ts":"2026-11-02T21:54:07Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:54:07Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-shared-a-w0-6e535d","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-a-w0-6e535d","reconcileID":"584b1075-7717-40c1-8220-b5b4ed082286","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-shared-a-w0-6e535d","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:54:07Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-a-w0-6e535d","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T21:54:07Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:54:08Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-02T21:54:08Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-02T21:54:08Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:54:08Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-praxis-a-eabda2","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-a-eabda2","reconcileID":"e6b02c03-a92d-41f3-a6b3-147d18acadf6","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-praxis-a-eabda2","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:54:08Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-a-eabda2","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T21:54:08Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:54:08Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-11-02T21:54:08Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:54:08Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-11-02T21:54:08Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-praxis-a-eabda2","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-a-eabda2","reconcileID":"e6b02c03-a92d-41f3-a6b3-147d18acadf6","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-praxis-a-eabda2","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:54:08Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-shared-a-w0-6e535d","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-a-w0-6e535d","reconcileID":"295bbb28-4870-4398-bfb0-314eca116a0a","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-shared-a-w0-6e535d","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:54:08Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-a-w0-6e535d","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T21:54:08Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:54:09Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-02T21:54:09Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-02T21:54:09Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-02T21:54:09Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:54:09Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-a-eabda2","event":"DELETE"}
{"level":"info","ts":"2026-11-02T21:54:09Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-02T21:54:09Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-praxis-a-eabda2\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-02T21:54:09Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"error","ts":"2026-11-02T21:54:10.118Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-praxis-a-eabda2","namespace":"openshift-ingress","uid":"4812c33f-016c-4de8-b682-807639c9a87c","error":"tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-praxis-a-eabda2\" not found"}
{"level":"info","ts":"2026-11-02T21:54:10.369Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:54:10.369Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T21:54:10.431Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-praxis-a-eabda2","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-praxis-a-eabda2\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:54:10.633Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-a-w0-6e535d","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-shared-a-w0-6e535d\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:54:13Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-shared-a-w4-7cde84","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-a-w4-7cde84","reconcileID":"ddf9c557-44c0-4b00-bd47-508a8d214334","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-shared-a-w4-7cde84","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:54:13Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-a-w4-7cde84","event":"CREATE"}
{"level":"info","ts":"2026-11-02T21:54:13Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:54:13Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-02T21:54:13Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-02T21:54:13Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:54:13Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-shared-a-w4-7cde84","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-a-w4-7cde84","reconcileID":"baff509d-7313-455f-916e-532f6e6da365","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-shared-a-w4-7cde84","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:54:13Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-a-w4-7cde84","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T21:54:13Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:54:14Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-02T21:54:14Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-02T21:54:14Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-02T21:54:14Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:54:22.184Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","TokenRateLimitPolicy","AuthPolicy","Limitador","ConfigMap","EnvoyFilter","Gateway","Kuadrant","HTTPRoute"],"eventTypes":{"create":14,"delete":14,"update":33}}
{"level":"info","ts":"2026-11-02T21:54:22.631Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:54:22.646Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:54:25Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-praxis-b-3c7706","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-b-3c7706","reconcileID":"a5325385-8c97-4f6b-a9a1-23415535d608","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-praxis-b-3c7706","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:54:25Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-b-3c7706","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T21:54:25Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:54:25Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-11-02T21:54:25Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:54:25.663Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:54:25.864Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:54:25.864Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:54:25Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-11-02T21:54:25Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-praxis-b-3c7706","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-b-3c7706","reconcileID":"a5325385-8c97-4f6b-a9a1-23415535d608","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-praxis-b-3c7706","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:54:25.947Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T21:54:25Z","logger":"telemetry-policy-extension-controller","msg":"Reconciler error","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-praxis-b-3c7706","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-b-3c7706","reconcileID":"bdee76ee-763f-4f62-af07-12afb01ec663","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-praxis-b-3c7706\" not found","stacktrace":"sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:353\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-02T21:54:25Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-b-3c7706","event":"DELETE"}
{"level":"info","ts":"2026-11-02T21:54:25Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-02T21:54:25Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-praxis-b-3c7706\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-02T21:54:25Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:54:26.325Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:54:29.252Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:54:29.255Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:54:29.262Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:54:29.266Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:54:29.270Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:54:29.270Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-02T21:54:29.366Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:54:29.366Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T21:54:30.981Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-praxis-b-3c7706","namespace":"openshift-ingress","uid":"b0510110-7e9f-4e4e-8e3c-79563c2bd717","error":"tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-praxis-b-3c7706\" not found"}
{"level":"info","ts":"2026-11-02T21:54:32.220Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:54:32.220Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T21:54:32.483Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-praxis-b-3c7706","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-praxis-b-3c7706\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:54:33.462Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Kuadrant","TokenRateLimitPolicy","EnvoyFilter","AuthPolicy","Gateway"],"eventTypes":{"create":1,"delete":5,"update":1}}
{"level":"info","ts":"2026-11-02T21:54:33.762Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:54:33.768Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:54:36.065Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:54:36.271Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:54:36.443Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:54:36.460Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:54:36.460Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:54:39.649Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:54:39.654Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:54:39.654Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:54:39.655Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:54:39.645Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:54:39.656Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-11-02T21:54:39.738Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-shared-a-w4-7cde84","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/ratelimit":"true"},"name":"kuadrant-ratelimiting-e2e-shared-a-w4-7cde84","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-a-w4-7cde84","uid":"30a49997-f3b8-4b9e-a63d-efe4d247c707"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"limitador-limitador.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-ratelimit-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"limitador-limitador.kuadrant-system.svc.cluster.local","port_value":8081}}}}]}]},"name":"kuadrant-ratelimit-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-shared-a-w4-7cde84"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-shared-a-w4-7cde84\" already exists"}
{"level":"error","ts":"2026-11-02T21:54:39.739Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-shared-a-w0-6e535d","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"kuadrant-auth-e2e-shared-a-w0-6e535d","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-a-w0-6e535d","uid":"bb413150-c71f-467a-b73c-fc346914ff7a"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-auth-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local","port_value":50051}}}}]}]},"name":"kuadrant-auth-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-shared-a-w0-6e535d"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-shared-a-w0-6e535d\" already exists"}
{"level":"error","ts":"2026-11-02T21:54:39.761Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:54:39.761Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T21:54:39.772Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d#rule-4"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"8b7e784474461510a9d9970d39fe03c297fc6f9a5f80873c40898bdfcb389e5f","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["8b7e784474461510a9d9970d39fe03c297fc6f9a5f80873c40898bdfcb389e5f"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"8b7e784474461510a9d9970d39fe03c297fc6f9a5f80873c40898bdfcb389e5f\" already exists"}
{"level":"error","ts":"2026-11-02T21:54:39.823Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-shared-a-w0-6e535d","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/ratelimit":"true"},"name":"kuadrant-ratelimiting-e2e-shared-a-w0-6e535d","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-a-w0-6e535d","uid":"bb413150-c71f-467a-b73c-fc346914ff7a"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"limitador-limitador.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-ratelimit-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"limitador-limitador.kuadrant-system.svc.cluster.local","port_value":8081}}}}]}]},"name":"kuadrant-ratelimit-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-shared-a-w0-6e535d"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-shared-a-w0-6e535d\" already exists"}
{"level":"error","ts":"2026-11-02T21:54:39.824Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-shared-a-w4-7cde84","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"kuadrant-auth-e2e-shared-a-w4-7cde84","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-a-w4-7cde84","uid":"30a49997-f3b8-4b9e-a63d-efe4d247c707"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-auth-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local","port_value":50051}}}}]}]},"name":"kuadrant-auth-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-shared-a-w4-7cde84"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-shared-a-w4-7cde84\" already exists"}
{"level":"error","ts":"2026-11-02T21:54:39.905Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-7cde84","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-7cde84#rule-6"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"0f923fa7f17446f382fb056bef7c9cc2146361c32cb89e19da4e6397505de43c","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["0f923fa7f17446f382fb056bef7c9cc2146361c32cb89e19da4e6397505de43c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-7cde84.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-7cde84.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"0f923fa7f17446f382fb056bef7c9cc2146361c32cb89e19da4e6397505de43c\" already exists"}
{"level":"error","ts":"2026-11-02T21:54:39.990Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-7cde84","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-7cde84#rule-1"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"75661500a5114b056fb7b7fa79b052930433ec107cb332756c581a2f0de24173","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["75661500a5114b056fb7b7fa79b052930433ec107cb332756c581a2f0de24173"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-7cde84.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-7cde84.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"75661500a5114b056fb7b7fa79b052930433ec107cb332756c581a2f0de24173\" already exists"}
{"level":"error","ts":"2026-11-02T21:54:40.067Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d#rule-6"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"376d56a711fbb2b29d7c46a8a0998936174b738443f0db294a13f85fd8478a94","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["376d56a711fbb2b29d7c46a8a0998936174b738443f0db294a13f85fd8478a94"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"376d56a711fbb2b29d7c46a8a0998936174b738443f0db294a13f85fd8478a94\" already exists"}
{"level":"error","ts":"2026-11-02T21:54:40.132Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d#rule-3"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"c3ead856f0c0807270869b6a467d9281b93eaaa8c65e788c4b6393073db2cbe8","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["c3ead856f0c0807270869b6a467d9281b93eaaa8c65e788c4b6393073db2cbe8"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"c3ead856f0c0807270869b6a467d9281b93eaaa8c65e788c4b6393073db2cbe8\" already exists"}
{"level":"error","ts":"2026-11-02T21:54:40.203Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d#rule-5"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"71e8c9bf81b77581f96b1cca4bb909b8434efbbb06bf9c9ec1aa5c8f412b9c76","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["71e8c9bf81b77581f96b1cca4bb909b8434efbbb06bf9c9ec1aa5c8f412b9c76"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"71e8c9bf81b77581f96b1cca4bb909b8434efbbb06bf9c9ec1aa5c8f412b9c76\" already exists"}
{"level":"error","ts":"2026-11-02T21:54:40.271Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-7cde84","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-7cde84#rule-5"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"45531229ceac4cfcba16f0f8d809077fb7e19e248278c544ac9fd018c419ef18","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["45531229ceac4cfcba16f0f8d809077fb7e19e248278c544ac9fd018c419ef18"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-7cde84.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-7cde84.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"45531229ceac4cfcba16f0f8d809077fb7e19e248278c544ac9fd018c419ef18\" already exists"}
{"level":"error","ts":"2026-11-02T21:54:40.345Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-7cde84","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-7cde84#rule-3"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"f6229ee2157250d6d160cdc978e612aa3a7c43bb558942020078c3f42c450c79","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f6229ee2157250d6d160cdc978e612aa3a7c43bb558942020078c3f42c450c79"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-7cde84.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-7cde84.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"f6229ee2157250d6d160cdc978e612aa3a7c43bb558942020078c3f42c450c79\" already exists"}
{"level":"error","ts":"2026-11-02T21:54:40.414Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-shared-a-w0-6e535d","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"name":"kuadrant-e2e-shared-a-w0-6e535d","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-a-w0-6e535d","uid":"bb413150-c71f-467a-b73c-fc346914ff7a"}]},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"376d56a711fbb2b29d7c46a8a0998936174b738443f0db294a13f85fd8478a94\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"3aa9e48facd88e18a7acef348feeaf654a1d4310d58727df558a9c5543ced772\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"65ad30c331bd08b64f99c2bfc9d23db3979d37b9d3b916cb76d08a0dfabf963a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"4593350858282f0ebeaf11b57850d5bccfa270a4b6088784a058e2d70b5cbe7c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"71e8c9bf81b77581f96b1cca4bb909b8434efbbb06bf9c9ec1aa5c8f412b9c76\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"01c09092684d0d3ed9db0ad6f53595f8d2c97286804d29e76075f2c30f05f44e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c3ead856f0c0807270869b6a467d9281b93eaaa8c65e788c4b6393073db2cbe8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"7d0e9eabd4ff8a0b65212f3d03a7b14a1e695503c8c41fb7cd6e844984ba7c69\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8b7e784474461510a9d9970d39fe03c297fc6f9a5f80873c40898bdfcb389e5f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"3cb722466e22fc9e58ad8f75bb3dbd6e1d2f9d75c3cfaafc5c6350857d59f964\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7482755e6f782100b8480fa82045aac768a6400e192241b0d0cf93403dad8edb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"af29fffcd438904723a318f8c7cd8dbe79f55578faf5560452874252825fdf46\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-shared-a-w0-6e535d"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-e2e-shared-a-w0-6e535d\" already exists"}
{"level":"error","ts":"2026-11-02T21:54:40.415Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-7cde84","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-7cde84#rule-2"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"150da2804d58820302b448e24151b1f189b717cd68a8c1e110fba61141165eb0","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["150da2804d58820302b448e24151b1f189b717cd68a8c1e110fba61141165eb0"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-7cde84.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-7cde84.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"150da2804d58820302b448e24151b1f189b717cd68a8c1e110fba61141165eb0\" already exists"}
{"level":"error","ts":"2026-11-02T21:54:40.482Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d#rule-2"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"65ad30c331bd08b64f99c2bfc9d23db3979d37b9d3b916cb76d08a0dfabf963a","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["65ad30c331bd08b64f99c2bfc9d23db3979d37b9d3b916cb76d08a0dfabf963a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"65ad30c331bd08b64f99c2bfc9d23db3979d37b9d3b916cb76d08a0dfabf963a\" already exists"}
{"level":"error","ts":"2026-11-02T21:54:40.549Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-7cde84","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-7cde84#rule-4"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"96cad25fbcf27b7341cae948477117cfaf58cb098cf23b68e9b61e9380b5dbab","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["96cad25fbcf27b7341cae948477117cfaf58cb098cf23b68e9b61e9380b5dbab"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-7cde84.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-7cde84.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"96cad25fbcf27b7341cae948477117cfaf58cb098cf23b68e9b61e9380b5dbab\" already exists"}
{"level":"error","ts":"2026-11-02T21:54:40.636Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d#rule-1"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"7482755e6f782100b8480fa82045aac768a6400e192241b0d0cf93403dad8edb","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["7482755e6f782100b8480fa82045aac768a6400e192241b0d0cf93403dad8edb"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"7482755e6f782100b8480fa82045aac768a6400e192241b0d0cf93403dad8edb\" already exists"}
{"level":"error","ts":"2026-11-02T21:54:40.701Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/0fe24c7f7d08947fd014881b6e705a1e251458731f0d96804cd597d460f9107b","error":"authconfigs.authorino.kuadrant.io \"0fe24c7f7d08947fd014881b6e705a1e251458731f0d96804cd597d460f9107b\" not found"}
{"level":"error","ts":"2026-11-02T21:54:40.756Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/7df5d096da5fd659154e0d3c98c88e9983e4433c9792bc2dae188af06f76a8cf","error":"authconfigs.authorino.kuadrant.io \"7df5d096da5fd659154e0d3c98c88e9983e4433c9792bc2dae188af06f76a8cf\" not found"}
{"level":"error","ts":"2026-11-02T21:54:40.810Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/08eb736dbf0b0e36e1844f790537f5df28cacaf4f79d2b22bf82d08896117bee","error":"authconfigs.authorino.kuadrant.io \"08eb736dbf0b0e36e1844f790537f5df28cacaf4f79d2b22bf82d08896117bee\" not found"}
{"level":"error","ts":"2026-11-02T21:54:40.821Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-praxis-b-3c7706","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T21:52:39Z","generation":1,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"f7acdca2-f093-49ea-ba06-65d8698226a2\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:52:39Z"}],"name":"kuadrant-e2e-praxis-b-3c7706","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-praxis-b-3c7706","uid":"f7acdca2-f093-49ea-ba06-65d8698226a2"}],"resourceVersion":"78855","uid":"4dd6f257-40fe-4b54-92ac-5a79962060fd"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a9cfab4dee1081bfcc7b618cb58ae36fc9c49b8e2b26b899c1807178fca8c87d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-b-3c7706-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__b48c10ea\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-3c7706\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-3c7706\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__b48c10ea\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-3c7706\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-3c7706\"]}],\"name\":\"6762a423c54dae74b2d867c7f9ef460722f4039829b96350e86f5c62f12b2433\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a39665f55e0cac822a1aab86029467ea93e90af6ab75122f73087728caf0470f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-b-3c7706-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__b48c10ea\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-3c7706\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-3c7706\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__b48c10ea\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-3c7706\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-3c7706\"]}],\"name\":\"eb014591d77d3e9e1274226ff5927dedc018eb9a9d35ca280c5c342d314b0057\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"323178fa83a1efa41905caf97801bbc5f5ddd425df8246a546a2100d28797d9f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-b-3c7706-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__b48c10ea\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-3c7706\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-3c7706\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__b48c10ea\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-3c7706\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-3c7706\"]}],\"name\":\"5f642a06761d65bba18547508b31699581daa2ff8313d5164cdcc1f09cde4d2c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"de0d805f3826b837284e5cca2fc58406c648b6e9332a019d49bdf318c846a7cd\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-b-3c7706-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__b48c10ea\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-3c7706\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-3c7706\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__b48c10ea\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-3c7706\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-3c7706\"]}],\"name\":\"71078740952ed02dd8f96f4a7bb8652215ddef272737af51ad8cb40538f277d3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e56184489c8a08052ac4e3a9c868c0f2bf5cbb5e2206bc5e78b6d47312c445aa\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-b-3c7706-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__b48c10ea\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-3c7706\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-3c7706\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__b48c10ea\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-3c7706\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-3c7706\"]}],\"name\":\"8afc81aad81386a7daddae8767aabf651b446d86023df74ee49d97a394f309f1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"201c10375b73212bcc98e077fed390b4de9f61c5e39c038588ca40148514dec1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-praxis-b-3c7706-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__b48c10ea\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-3c7706\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-3c7706\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__b48c10ea\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-praxis-b-3c7706\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-praxis-b-3c7706\"]}],\"name\":\"e00b09080c795bb000bb4fb16f20a734f2c19952b207e120677d64e58fb63c39\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}}],\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-praxis-b-3c7706"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-praxis-b-3c7706\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:54:40.865Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/c1f5cc9b3e2fc0996bb33d74f1102ae531285cb111260042dabda8882e6ba5cd","error":"authconfigs.authorino.kuadrant.io \"c1f5cc9b3e2fc0996bb33d74f1102ae531285cb111260042dabda8882e6ba5cd\" not found"}
{"level":"error","ts":"2026-11-02T21:54:40.920Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/d3b4b6f20daf3ab19f8ed240d94ff1aa885ad7406c34a7dce1bd6d4abe157d6b","error":"authconfigs.authorino.kuadrant.io \"d3b4b6f20daf3ab19f8ed240d94ff1aa885ad7406c34a7dce1bd6d4abe157d6b\" not found"}
{"level":"error","ts":"2026-11-02T21:54:40.975Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/b292303b0383d9028631c54341428ce710902edc983e3105d6fe7e1cd83e4a8d","error":"authconfigs.authorino.kuadrant.io \"b292303b0383d9028631c54341428ce710902edc983e3105d6fe7e1cd83e4a8d\" not found"}
{"level":"error","ts":"2026-11-02T21:54:41.058Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-shared-a-w4-7cde84","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"name":"kuadrant-e2e-shared-a-w4-7cde84","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-a-w4-7cde84","uid":"30a49997-f3b8-4b9e-a63d-efe4d247c707"}]},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0f923fa7f17446f382fb056bef7c9cc2146361c32cb89e19da4e6397505de43c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-7cde84-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-7cde84\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-7cde84\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]}],\"name\":\"6fb04747cbba17c2d2edd73660c4e50eec6f0ee924099f26ff442586021553ed\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"150da2804d58820302b448e24151b1f189b717cd68a8c1e110fba61141165eb0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-7cde84-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-7cde84\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-7cde84\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]}],\"name\":\"e314acde8746b9db89412919be5da708b16f912df85d7b1e19c5983d2065f729\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"45531229ceac4cfcba16f0f8d809077fb7e19e248278c544ac9fd018c419ef18\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-7cde84-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-7cde84\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-7cde84\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]}],\"name\":\"5d1e4a29bea3f2db952d9e19481c737e780a5cc72dc0934c1c2012a39bc18efd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f6229ee2157250d6d160cdc978e612aa3a7c43bb558942020078c3f42c450c79\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-7cde84-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-7cde84\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-7cde84\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]}],\"name\":\"228840b91d117fcc6420f8e81c02a72767236079f030e5ad6e1f7df8d2bfef2f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"96cad25fbcf27b7341cae948477117cfaf58cb098cf23b68e9b61e9380b5dbab\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-7cde84-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-7cde84\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-7cde84\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]}],\"name\":\"7f37843572934e12cedf2d78614afd5eacc9ed1f0ea54fe933bb17625146accc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"75661500a5114b056fb7b7fa79b052930433ec107cb332756c581a2f0de24173\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-7cde84-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-7cde84\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-7cde84\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]}],\"name\":\"f6e55ef63865313913827adc1faf8eb8ccb447468294af4335a4df4ebb61a404\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-shared-a-w4-7cde84"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-e2e-shared-a-w4-7cde84\" already exists"}
{"level":"error","ts":"2026-11-02T21:54:41.185Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-a-w4-7cde84-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-a-w4-7cde84-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:54:41.249Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-praxis-a-aa8aff-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-praxis-a-aa8aff-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:54:41.381Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-a-w0-6e535d-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-a-w0-6e535d-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:54:41.475Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-a-w4-7cde84","namespace":"openshift-ingress","uid":"83e46bfa-f121-4136-adc9-a9e6690edeab","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-a-w4-7cde84\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:54:41.521Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-a-w3-97995b-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-a-w3-97995b-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:54:41.712Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-a-w3-97995b","namespace":"openshift-ingress","uid":"9405e4ea-22ff-4c46-bbc0-f492e0e403dc","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-a-w3-97995b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:54:42.129Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-a-w0-6e535d","namespace":"openshift-ingress","uid":"0eae774a-4032-4461-b2be-6f3edd911a80","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-a-w0-6e535d\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:54:42Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-praxis-a-aa8aff","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-a-aa8aff","reconcileID":"23b5d2fe-8f43-4669-8688-c1b5ea3526eb","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-praxis-a-aa8aff","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:54:42Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-a-aa8aff","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T21:54:42Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:54:42Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-11-02T21:54:42Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"error","ts":"2026-11-02T21:54:42.370Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-praxis-b-3c7706","namespace":"openshift-ingress","uid":"b0510110-7e9f-4e4e-8e3c-79563c2bd717","error":"tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-praxis-b-3c7706\" not found"}
{"level":"info","ts":"2026-11-02T21:54:42.492Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:54:42.492Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:54:42Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-11-02T21:54:42Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-praxis-a-aa8aff","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-a-aa8aff","reconcileID":"23b5d2fe-8f43-4669-8688-c1b5ea3526eb","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-praxis-a-aa8aff","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:54:42Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-a-aa8aff","event":"DELETE"}
{"level":"info","ts":"2026-11-02T21:54:42Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-02T21:54:42Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-praxis-a-aa8aff\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-02T21:54:42Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"error","ts":"2026-11-02T21:54:42.823Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-praxis-a-aa8aff","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-praxis-a-aa8aff\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:54:42.881Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-a-w0-6e535d","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-shared-a-w0-6e535d\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:54:42.883Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"maas-api-route-e2e-shared-a-w0-6e535d","namespace":"odh-ai-gateway-infra","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"maas-api-route-e2e-shared-a-w0-6e535d\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:54:43.058Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"maas-api-route-e2e-shared-a-w4-7cde84","namespace":"odh-ai-gateway-infra","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"maas-api-route-e2e-shared-a-w4-7cde84\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:54:43.129Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-praxis-b-3c7706","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-praxis-b-3c7706\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:54:43.310Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-a-w4-7cde84","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-shared-a-w4-7cde84\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:54:47.040Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","TokenRateLimitPolicy","AuthPolicy","EnvoyFilter","Gateway","HTTPRoute","Limitador","ConfigMap","Kuadrant"],"eventTypes":{"create":18,"delete":10,"update":17}}
{"level":"info","ts":"2026-11-02T21:54:47.343Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:54:47.363Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:54:50.054Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:54:50.362Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:54:50.541Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:54:50.541Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:54:50.541Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:54:53.062Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:54:53.071Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:54:53.123Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:54:53.134Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:54:53.134Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:54:53.148Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"error","ts":"2026-11-02T21:54:53.181Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to delete envoyfilter object","envoyfilter":"openshift-ingress/kuadrant-ratelimiting-e2e-praxis-a-aa8aff","error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-praxis-a-aa8aff\" not found"}
{"level":"error","ts":"2026-11-02T21:54:53.403Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to delete envoyfilter object","envoyfilter":"openshift-ingress/kuadrant-auth-e2e-praxis-a-aa8aff","error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-praxis-a-aa8aff\" not found"}
{"level":"info","ts":"2026-11-02T21:54:53.403Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:54:54Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-praxis-b-bb45bc","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-b-bb45bc","reconcileID":"b95071e2-ea03-4a9d-842c-c558cba46811","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-praxis-b-bb45bc","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:54:54Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-b-bb45bc","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T21:54:54Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:54:54Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-11-02T21:54:54Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:54:54Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-11-02T21:54:54Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-praxis-b-bb45bc","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-b-bb45bc","reconcileID":"b95071e2-ea03-4a9d-842c-c558cba46811","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-praxis-b-bb45bc","namespace":"openshift-ingress"}
{"level":"error","ts":"2026-11-02T21:54:54.623Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to delete envoyfilter object","gateway":"openshift-ingress/e2e-praxis-a-aa8aff","envoyfilter":"openshift-ingress/kuadrant-e2e-praxis-a-aa8aff","error":"envoyfilters.networking.istio.io \"kuadrant-e2e-praxis-a-aa8aff\" not found"}
{"level":"info","ts":"2026-11-02T21:54:54Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-praxis-b-bb45bc","event":"DELETE"}
{"level":"info","ts":"2026-11-02T21:54:54Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-02T21:54:54Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-praxis-b-bb45bc\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-02T21:54:54Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"error","ts":"2026-11-02T21:54:55.209Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-praxis-a-aa8aff-maas-auth","namespace":"openshift-ingress","error":"authpolicies.kuadrant.io \"e2e-praxis-a-aa8aff-maas-auth\" not found"}
{"level":"error","ts":"2026-11-02T21:54:55.560Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-praxis-b-bb45bc","namespace":"openshift-ingress","uid":"66889525-16ed-4175-84b2-b9c4e9b2628e","error":"tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-praxis-b-bb45bc\" not found"}
{"level":"info","ts":"2026-11-02T21:54:55.985Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:54:55.985Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T21:54:56.381Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-praxis-b-bb45bc","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-praxis-b-bb45bc\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:54:56.867Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-praxis-a-aa8aff","error":"gateways.gateway.networking.k8s.io \"e2e-praxis-a-aa8aff\" not found"}
{"level":"info","ts":"2026-11-02T21:55:06.906Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","ConfigMap","Gateway","AuthPolicy","Limitador","Kuadrant","AuthConfig","EnvoyFilter","HTTPRoute"],"eventTypes":{"create":1,"delete":22,"update":10}}
{"level":"info","ts":"2026-11-02T21:55:07.128Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:55:07.149Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:55:09.536Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:55:09.570Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:55:09.760Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:55:09.760Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:55:10.056Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:55:12.545Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:55:12.545Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:55:12.551Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:55:12.562Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:55:12.562Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:55:12.574Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-11-02T21:55:12.611Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:55:12.611Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:55:15.017Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:55:15.018Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:55:16.162Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway","EnvoyFilter","AuthPolicy"],"eventTypes":{"delete":5}}
{"level":"info","ts":"2026-11-02T21:55:20.602Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:55:20.631Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:55:20.631Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:55:20.643Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:55:20.649Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:55:20.660Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-11-02T21:55:20.707Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:55:20.707Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T21:55:20.757Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/05b7655e28ac4f99b38e71ab11768f6c739c948e4c29d456d7cafbec546d4821","error":"authconfigs.authorino.kuadrant.io \"05b7655e28ac4f99b38e71ab11768f6c739c948e4c29d456d7cafbec546d4821\" not found"}
{"level":"error","ts":"2026-11-02T21:55:20.839Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/66a2f1b25c30b4de312a281d6f85a275736e95cb51a304aadd00de820866861f","error":"authconfigs.authorino.kuadrant.io \"66a2f1b25c30b4de312a281d6f85a275736e95cb51a304aadd00de820866861f\" not found"}
{"level":"error","ts":"2026-11-02T21:55:20.939Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/712d5a33c2a24a26b7a686bc8d990bfef7f2549be23e9936ec3e62675c2b878f","error":"authconfigs.authorino.kuadrant.io \"712d5a33c2a24a26b7a686bc8d990bfef7f2549be23e9936ec3e62675c2b878f\" not found"}
{"level":"error","ts":"2026-11-02T21:55:21.023Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/bdead2c26fcb19419cc57c3a27e846c98b566baaa401c4f77fa6b80fe1a8741d","error":"authconfigs.authorino.kuadrant.io \"bdead2c26fcb19419cc57c3a27e846c98b566baaa401c4f77fa6b80fe1a8741d\" not found"}
{"level":"error","ts":"2026-11-02T21:55:21.093Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/c6361ed4597b7cff406006a2b443834e54a512e30345a531a05c571637e09f05","error":"authconfigs.authorino.kuadrant.io \"c6361ed4597b7cff406006a2b443834e54a512e30345a531a05c571637e09f05\" not found"}
{"level":"error","ts":"2026-11-02T21:55:21.148Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/fbe4ed3247bf7eefe5f90247e520e77c0e8d4f90a9d404abe1a37d8d776638ef","error":"authconfigs.authorino.kuadrant.io \"fbe4ed3247bf7eefe5f90247e520e77c0e8d4f90a9d404abe1a37d8d776638ef\" not found"}
{"level":"error","ts":"2026-11-02T21:55:22.942Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w2-6fa533","namespace":"e2e-models-e2e-worker-w2-6fa533","uid":"3a128bb2-de88-49aa-ab9e-c8626107a077","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w2-6fa533\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:55:23.060Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:55:23.060Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:55:33.632Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","Gateway","TokenRateLimitPolicy","Limitador","AuthConfig"],"eventTypes":{"create":2,"delete":6,"update":3}}
{"level":"info","ts":"2026-11-02T21:55:33.820Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:55:35.543Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:55:35.639Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:55:35.639Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:55:38.610Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:55:38.624Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:55:38.624Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:55:38.628Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:55:38.628Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:55:38.634Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:55:38.742Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:55:40.937Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:55:40.937Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T21:55:41.709Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-explicit-4ca09f","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-explicit-4ca09f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:55:42.377Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","Gateway","AuthPolicy"],"eventTypes":{"create":2,"delete":2,"update":1}}
{"level":"info","ts":"2026-11-02T21:55:46.771Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:55:46.777Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:55:46.783Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:55:46.783Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:55:46.823Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:55:46.771Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-11-02T21:55:46.854Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:55:46.854Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T21:55:48.269Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w2-6fa533","namespace":"e2e-models-e2e-worker-w2-6fa533","uid":"3a128bb2-de88-49aa-ab9e-c8626107a077","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w2-6fa533\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:55:49.158Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:55:49.158Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T21:55:49.809Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-explicit-4ca09f","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-explicit-4ca09f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:55:56Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-shared-b-w3-a1d751","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-b-w3-a1d751","reconcileID":"d89c17b1-3505-4899-aba1-a8a0f39dc9ae","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-shared-b-w3-a1d751","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:55:56Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-b-w3-a1d751","event":"CREATE"}
{"level":"info","ts":"2026-11-02T21:55:56Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:55:56Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-02T21:55:56Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-02T21:55:56Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:55:56Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-shared-b-w3-a1d751","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-b-w3-a1d751","reconcileID":"df2c467d-92b1-432a-9592-7186d89afe0a","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-shared-b-w3-a1d751","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:55:56Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-b-w3-a1d751","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T21:55:56Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:55:57Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-02T21:55:57Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-02T21:55:57Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-02T21:55:57Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:55:59.417Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","ConfigMap","Limitador","Gateway"],"eventTypes":{"update":4}}
{"level":"info","ts":"2026-11-02T21:55:59.699Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:56:01.361Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:56:01.571Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:56:01.571Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:56:04.545Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:56:04.568Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:56:04.623Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:56:04.626Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:56:04.633Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:56:04.633Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-02T21:56:04.686Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:56:04.686Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:56:07.063Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:56:07.063Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:56:08.450Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","HTTPRoute","Kuadrant","AuthPolicy","Gateway"],"eventTypes":{"create":3,"update":2}}
{"level":"info","ts":"2026-11-02T21:56:08.696Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:56:08.704Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:56:11.135Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:56:11.323Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:56:11Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-shared-b-w0-0f0874","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-b-w0-0f0874","reconcileID":"01780f3d-e61b-4541-8866-063868879fa6","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-shared-b-w0-0f0874","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:56:11Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-b-w0-0f0874","event":"CREATE"}
{"level":"info","ts":"2026-11-02T21:56:11Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:56:11.462Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:56:11.660Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:56:11.660Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:56:12Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-02T21:56:12Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-02T21:56:12Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:56:12Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-shared-b-w0-0f0874","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-b-w0-0f0874","reconcileID":"bd5bac2b-32cd-446b-9cba-470711cdf3fe","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-shared-b-w0-0f0874","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:56:12Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-b-w0-0f0874","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T21:56:12Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:56:14Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-02T21:56:14Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-02T21:56:14Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-02T21:56:14Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:56:14.345Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:56:14.355Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:56:14.361Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:56:14.362Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:56:14.368Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:56:14.369Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-02T21:56:14.468Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:56:14.468Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T21:56:14.471Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-shared-b-w3-a1d751","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"kuadrant-auth-e2e-shared-b-w3-a1d751","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-b-w3-a1d751","uid":"b4f450f8-3314-4538-8376-5bc4682213ba"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-auth-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local","port_value":50051}}}}]}]},"name":"kuadrant-auth-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-shared-b-w3-a1d751"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-shared-b-w3-a1d751\" already exists"}
{"level":"error","ts":"2026-11-02T21:56:14.472Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-shared-b-w3-a1d751","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/ratelimit":"true"},"name":"kuadrant-ratelimiting-e2e-shared-b-w3-a1d751","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-b-w3-a1d751","uid":"b4f450f8-3314-4538-8376-5bc4682213ba"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"limitador-limitador.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-ratelimit-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"limitador-limitador.kuadrant-system.svc.cluster.local","port_value":8081}}}}]}]},"name":"kuadrant-ratelimit-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-shared-b-w3-a1d751"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-shared-b-w3-a1d751\" already exists"}
{"level":"error","ts":"2026-11-02T21:56:14.515Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-a1d751","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-a1d751#rule-5"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"3e1c5c0bad150c663f60d190f6837f1f47449a9fb1dd0f8b15a5a049a5785836","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["3e1c5c0bad150c663f60d190f6837f1f47449a9fb1dd0f8b15a5a049a5785836"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-a1d751.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-a1d751.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"3e1c5c0bad150c663f60d190f6837f1f47449a9fb1dd0f8b15a5a049a5785836\" already exists"}
{"level":"error","ts":"2026-11-02T21:56:14.582Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-a1d751","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-a1d751#rule-4"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"54678c70bb572c34d6f6ed39e879f5beb1891cc61c4ee64dec6d9d3d0ed9c115","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["54678c70bb572c34d6f6ed39e879f5beb1891cc61c4ee64dec6d9d3d0ed9c115"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-a1d751.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-a1d751.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"54678c70bb572c34d6f6ed39e879f5beb1891cc61c4ee64dec6d9d3d0ed9c115\" already exists"}
{"level":"error","ts":"2026-11-02T21:56:14.657Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-a1d751","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-a1d751#rule-3"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"45692dd8f986fdd88aa79ac3fde6dd1db9cc5cbaa9003e3fe62a6a019e62eb23","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["45692dd8f986fdd88aa79ac3fde6dd1db9cc5cbaa9003e3fe62a6a019e62eb23"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-a1d751.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-a1d751.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"45692dd8f986fdd88aa79ac3fde6dd1db9cc5cbaa9003e3fe62a6a019e62eb23\" already exists"}
{"level":"error","ts":"2026-11-02T21:56:14.734Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-a1d751","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-a1d751#rule-2"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"9ed0ddd0e1ea68b359e326fba62a585324a528f116f0bf6d3f085360f79ed877","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["9ed0ddd0e1ea68b359e326fba62a585324a528f116f0bf6d3f085360f79ed877"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-a1d751.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-a1d751.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"9ed0ddd0e1ea68b359e326fba62a585324a528f116f0bf6d3f085360f79ed877\" already exists"}
{"level":"error","ts":"2026-11-02T21:56:14.819Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-a1d751","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-a1d751#rule-6"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"e5c3e46343f841520ecdb272dac135e882471a34b6fbd1dfe102bb1535df2522","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["e5c3e46343f841520ecdb272dac135e882471a34b6fbd1dfe102bb1535df2522"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-a1d751.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-a1d751.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"e5c3e46343f841520ecdb272dac135e882471a34b6fbd1dfe102bb1535df2522\" already exists"}
{"level":"error","ts":"2026-11-02T21:56:14.890Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-a1d751","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-a1d751#rule-1"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"afffab50bac2693d1a47a43cedfba11a37634e625c51a64f41e14d037dc9bc9a","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["afffab50bac2693d1a47a43cedfba11a37634e625c51a64f41e14d037dc9bc9a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-a1d751.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-a1d751.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"afffab50bac2693d1a47a43cedfba11a37634e625c51a64f41e14d037dc9bc9a\" already exists"}
{"level":"error","ts":"2026-11-02T21:56:15.029Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-shared-b-w3-a1d751","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"name":"kuadrant-e2e-shared-b-w3-a1d751","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-b-w3-a1d751","uid":"b4f450f8-3314-4538-8376-5bc4682213ba"}]},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e5c3e46343f841520ecdb272dac135e882471a34b6fbd1dfe102bb1535df2522\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-a1d751\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-a1d751\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]}],\"name\":\"4309e9a901e490b5923f5e9c24699d2e857cbb6dc20e790330c076d768763498\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9ed0ddd0e1ea68b359e326fba62a585324a528f116f0bf6d3f085360f79ed877\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-a1d751\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-a1d751\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]}],\"name\":\"7017ce065aadb4ec3cd123f3de90d4b298418b4cb0d6f2943ce905f0b6fa1973\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3e1c5c0bad150c663f60d190f6837f1f47449a9fb1dd0f8b15a5a049a5785836\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-a1d751\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-a1d751\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]}],\"name\":\"4b9629b6a0dc02e424027c37c202c248a532fff8b8cebe3888b35f432e4237a0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"45692dd8f986fdd88aa79ac3fde6dd1db9cc5cbaa9003e3fe62a6a019e62eb23\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-a1d751\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-a1d751\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]}],\"name\":\"8762492ec17ca2d96d70f7661ea91bc6dd105b52e7f7927e5f87422dad69cdf1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"54678c70bb572c34d6f6ed39e879f5beb1891cc61c4ee64dec6d9d3d0ed9c115\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-a1d751\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-a1d751\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]}],\"name\":\"6e67ae0eecb22274f490861a930e85a9d3cf386bb0d1179f4c67c60e1ed8eb2c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"afffab50bac2693d1a47a43cedfba11a37634e625c51a64f41e14d037dc9bc9a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-a1d751\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-a1d751\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]}],\"name\":\"5df45cb848791fb94dcb78fb658eb490c82f995f9d95444c8a546b5cddad1a1b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-shared-b-w3-a1d751"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-e2e-shared-b-w3-a1d751\" already exists"}
{"level":"error","ts":"2026-11-02T21:56:15.721Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-b-w3-a1d751-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-b-w3-a1d751-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:56:15.749Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-b-w3-a1d751","namespace":"openshift-ingress","uid":"2c7a0593-2f35-427a-b6f0-958582546c18","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-b-w3-a1d751\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:56:16.830Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:56:16.830Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T21:56:17.154Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"maas-api-route-e2e-shared-b-w3-a1d751","namespace":"odh-ai-gateway-infra","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"maas-api-route-e2e-shared-b-w3-a1d751\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:56:17.543Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-b-w0-0f0874","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-shared-b-w0-0f0874\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:56:17.800Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-b-w3-a1d751","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-shared-b-w3-a1d751\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:56:21Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-shared-b-w4-58ca7f","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-b-w4-58ca7f","reconcileID":"7b970d0a-922e-442c-96be-4c4c531bc6ac","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-shared-b-w4-58ca7f","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:56:21Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-b-w4-58ca7f","event":"CREATE"}
{"level":"info","ts":"2026-11-02T21:56:21Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:56:22Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-02T21:56:22Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-02T21:56:22Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:56:22Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-shared-b-w4-58ca7f","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-b-w4-58ca7f","reconcileID":"9bb4b408-e6af-4406-9fe4-71472c285b02","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-shared-b-w4-58ca7f","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:56:22Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-b-w4-58ca7f","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T21:56:22Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:56:22Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-02T21:56:22Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-02T21:56:22Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-02T21:56:22Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:56:27.576Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["HTTPRoute","TokenRateLimitPolicy","AuthConfig","Gateway","Kuadrant","EnvoyFilter","AuthPolicy","Limitador","ConfigMap"],"eventTypes":{"create":13,"update":9}}
{"level":"info","ts":"2026-11-02T21:56:27.827Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:56:27.847Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:56:30.323Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:56:30.525Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:56:30.525Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:56:30.628Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:56:30.642Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:56:33.467Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:56:33.469Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:56:33.469Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:56:33.473Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:56:33.473Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:56:33.460Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:56:33.634Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:56:36.192Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:56:36.192Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:56:37.592Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","AuthPolicy","Kuadrant"],"eventTypes":{"create":2,"update":1}}
{"level":"info","ts":"2026-11-02T21:56:37.782Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:56:37.789Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:56:40.371Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:56:40.427Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:56:40.843Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:56:41.024Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:56:41.024Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:56:41Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-shared-a-w2-06e461","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-a-w2-06e461","reconcileID":"226ebddb-f210-43f1-8a8b-9451f912c530","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-shared-a-w2-06e461","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:56:41Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-a-w2-06e461","event":"CREATE"}
{"level":"info","ts":"2026-11-02T21:56:41Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:56:43Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-02T21:56:43Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-02T21:56:43Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:56:43Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-shared-a-w2-06e461","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-a-w2-06e461","reconcileID":"0e7d2b97-689c-4124-9e10-1de9251fb69e","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-shared-a-w2-06e461","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:56:43Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-a-w2-06e461","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T21:56:43Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:56:43.787Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:56:43.787Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:56:43.827Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:56:43.840Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:56:43.846Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:56:43.846Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-02T21:56:43.943Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-shared-b-w0-0f0874","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/ratelimit":"true"},"name":"kuadrant-ratelimiting-e2e-shared-b-w0-0f0874","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-b-w0-0f0874","uid":"31926cb6-a222-454e-b0b0-713de52d3591"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"limitador-limitador.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-ratelimit-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"limitador-limitador.kuadrant-system.svc.cluster.local","port_value":8081}}}}]}]},"name":"kuadrant-ratelimit-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-shared-b-w0-0f0874"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-shared-b-w0-0f0874\" already exists"}
{"level":"error","ts":"2026-11-02T21:56:43.945Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-shared-b-w4-58ca7f","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"kuadrant-auth-e2e-shared-b-w4-58ca7f","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-b-w4-58ca7f","uid":"c11bd7aa-0f34-4363-b9b9-7f75323c0b3b"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-auth-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local","port_value":50051}}}}]}]},"name":"kuadrant-auth-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-shared-b-w4-58ca7f"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-shared-b-w4-58ca7f\" already exists"}
{"level":"error","ts":"2026-11-02T21:56:43.946Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:56:43.946Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T21:56:43.958Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-58ca7f","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-58ca7f#rule-5"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"f84e45e70df6f2c62c67fba14ae375620e4a3732a0ed6adeb79c70fb4031c1d5","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f84e45e70df6f2c62c67fba14ae375620e4a3732a0ed6adeb79c70fb4031c1d5"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-58ca7f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-58ca7f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"f84e45e70df6f2c62c67fba14ae375620e4a3732a0ed6adeb79c70fb4031c1d5\" already exists"}
{"level":"error","ts":"2026-11-02T21:56:44.005Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-shared-b-w4-58ca7f","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/ratelimit":"true"},"name":"kuadrant-ratelimiting-e2e-shared-b-w4-58ca7f","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-b-w4-58ca7f","uid":"c11bd7aa-0f34-4363-b9b9-7f75323c0b3b"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"limitador-limitador.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-ratelimit-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"limitador-limitador.kuadrant-system.svc.cluster.local","port_value":8081}}}}]}]},"name":"kuadrant-ratelimit-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-shared-b-w4-58ca7f"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-shared-b-w4-58ca7f\" already exists"}
{"level":"error","ts":"2026-11-02T21:56:44.023Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-shared-b-w0-0f0874","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"kuadrant-auth-e2e-shared-b-w0-0f0874","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-b-w0-0f0874","uid":"31926cb6-a222-454e-b0b0-713de52d3591"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-auth-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local","port_value":50051}}}}]}]},"name":"kuadrant-auth-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-shared-b-w0-0f0874"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-shared-b-w0-0f0874\" already exists"}
{"level":"error","ts":"2026-11-02T21:56:44.025Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w0-0f0874","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w0-0f0874#rule-2"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"8ccf868b0c716a18e90e502ebb2284ce90d5ee3fcd5779be4d996fb8a3d03b43","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["8ccf868b0c716a18e90e502ebb2284ce90d5ee3fcd5779be4d996fb8a3d03b43"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"8ccf868b0c716a18e90e502ebb2284ce90d5ee3fcd5779be4d996fb8a3d03b43\" already exists"}
{"level":"info","ts":"2026-11-02T21:56:44Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-02T21:56:44Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-02T21:56:44Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-02T21:56:44Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"error","ts":"2026-11-02T21:56:44.096Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w0-0f0874","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w0-0f0874#rule-4"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"6e2c4c40ad28f1eeda9eca533706722536247311f5ede5be2cbe544e374719a6","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["6e2c4c40ad28f1eeda9eca533706722536247311f5ede5be2cbe544e374719a6"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"6e2c4c40ad28f1eeda9eca533706722536247311f5ede5be2cbe544e374719a6\" already exists"}
{"level":"error","ts":"2026-11-02T21:56:44.168Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-58ca7f","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-58ca7f#rule-4"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"a87be006d97d67fcdec172b6143f1db733cd2c78dc7239fae4e7b34930fb681c","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a87be006d97d67fcdec172b6143f1db733cd2c78dc7239fae4e7b34930fb681c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-58ca7f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-58ca7f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"a87be006d97d67fcdec172b6143f1db733cd2c78dc7239fae4e7b34930fb681c\" already exists"}
{"level":"error","ts":"2026-11-02T21:56:44.234Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-58ca7f","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-58ca7f#rule-3"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"8e6ff67d93e4d9b2ea87c487a06f947d8b76a18c9c78078c58dee29914a5b47c","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["8e6ff67d93e4d9b2ea87c487a06f947d8b76a18c9c78078c58dee29914a5b47c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-58ca7f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-58ca7f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"8e6ff67d93e4d9b2ea87c487a06f947d8b76a18c9c78078c58dee29914a5b47c\" already exists"}
{"level":"error","ts":"2026-11-02T21:56:44.302Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w0-0f0874","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w0-0f0874#rule-1"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"ffaef4e77ab77e038e2181351f7ed710141739ce5f70351bf42c0606b9215e72","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["ffaef4e77ab77e038e2181351f7ed710141739ce5f70351bf42c0606b9215e72"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"ffaef4e77ab77e038e2181351f7ed710141739ce5f70351bf42c0606b9215e72\" already exists"}
{"level":"error","ts":"2026-11-02T21:56:44.371Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-58ca7f","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-58ca7f#rule-1"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"5b294df7b29e8cb61b717640614fa36dd2c243ed540ecb057e57e5c1fc26ab65","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["5b294df7b29e8cb61b717640614fa36dd2c243ed540ecb057e57e5c1fc26ab65"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-58ca7f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-58ca7f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"5b294df7b29e8cb61b717640614fa36dd2c243ed540ecb057e57e5c1fc26ab65\" already exists"}
{"level":"error","ts":"2026-11-02T21:56:44.394Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-shared-b-w4-58ca7f","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"name":"kuadrant-e2e-shared-b-w4-58ca7f","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-b-w4-58ca7f","uid":"c11bd7aa-0f34-4363-b9b9-7f75323c0b3b"}]},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9dccfbfbcf84c5edf4e0a3cc993bd8181b6febef066c8d0c3b0f13de64710295\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-58ca7f-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__50a1e7c4\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-58ca7f\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-58ca7f\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__50a1e7c4\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-58ca7f\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-58ca7f\"]}],\"name\":\"9cac59daced143b8d180cdc28d5c60985cfb4dc4b4384228e194211a1ad12e11\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6acb8fe5e02ded3380a75376f0b127d4a9709eeca703e4ffefd97996bba073a8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-58ca7f-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__50a1e7c4\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-58ca7f\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-58ca7f\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__50a1e7c4\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-58ca7f\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-58ca7f\"]}],\"name\":\"0e48f35372f1ca63bf72ce3f982d42904086167b37407e934620b88a6b1d9b7a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f84e45e70df6f2c62c67fba14ae375620e4a3732a0ed6adeb79c70fb4031c1d5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-58ca7f-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__50a1e7c4\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-58ca7f\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-58ca7f\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__50a1e7c4\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-58ca7f\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-58ca7f\"]}],\"name\":\"b80f6cfb2ca9e5d7e0fe43d0578b85961ada60649dea4023cbfa83f4c2a1d4d6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8e6ff67d93e4d9b2ea87c487a06f947d8b76a18c9c78078c58dee29914a5b47c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-58ca7f-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__50a1e7c4\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-58ca7f\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-58ca7f\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__50a1e7c4\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-58ca7f\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-58ca7f\"]}],\"name\":\"62f62b2b98d219d9fa11e8eeef1788a1092ab9c645c7eed86eda513c2534a8e3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a87be006d97d67fcdec172b6143f1db733cd2c78dc7239fae4e7b34930fb681c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-58ca7f-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__50a1e7c4\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-58ca7f\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-58ca7f\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__50a1e7c4\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-58ca7f\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-58ca7f\"]}],\"name\":\"583ad00400c0381e6333f121438204f6c80cc03dd7dbf5e71cf01e41c7c43dc1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5b294df7b29e8cb61b717640614fa36dd2c243ed540ecb057e57e5c1fc26ab65\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-58ca7f-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__50a1e7c4\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-58ca7f\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-58ca7f\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__50a1e7c4\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-58ca7f\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-58ca7f\"]}],\"name\":\"719700e803a3a5f0d2be4857f415edce300561ebb593aa6f57ee43dd1dbbc501\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-shared-b-w4-58ca7f"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-e2e-shared-b-w4-58ca7f\" already exists"}
{"level":"error","ts":"2026-11-02T21:56:44.437Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w0-0f0874","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w0-0f0874#rule-6"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"4676855aaad0efd1f263930f7407a2242dda7211d0408fa3820678f475f20874","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["4676855aaad0efd1f263930f7407a2242dda7211d0408fa3820678f475f20874"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"4676855aaad0efd1f263930f7407a2242dda7211d0408fa3820678f475f20874\" already exists"}
{"level":"error","ts":"2026-11-02T21:56:44.505Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w0-0f0874","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w0-0f0874#rule-3"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"b0dda7ce592fb57a979446129e21c491a217f4c5c9a704c19a519ee42c367e92","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["b0dda7ce592fb57a979446129e21c491a217f4c5c9a704c19a519ee42c367e92"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"b0dda7ce592fb57a979446129e21c491a217f4c5c9a704c19a519ee42c367e92\" already exists"}
{"level":"error","ts":"2026-11-02T21:56:44.574Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w0-0f0874","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w0-0f0874#rule-5"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"848b20842f79c8cc02bec7966c894853251e29e5c14c8a4cff729041c180e15c","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["848b20842f79c8cc02bec7966c894853251e29e5c14c8a4cff729041c180e15c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"848b20842f79c8cc02bec7966c894853251e29e5c14c8a4cff729041c180e15c\" already exists"}
{"level":"error","ts":"2026-11-02T21:56:44.647Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-58ca7f","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-58ca7f#rule-2"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"6acb8fe5e02ded3380a75376f0b127d4a9709eeca703e4ffefd97996bba073a8","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["6acb8fe5e02ded3380a75376f0b127d4a9709eeca703e4ffefd97996bba073a8"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-58ca7f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-58ca7f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"6acb8fe5e02ded3380a75376f0b127d4a9709eeca703e4ffefd97996bba073a8\" already exists"}
{"level":"error","ts":"2026-11-02T21:56:44.716Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-shared-b-w0-0f0874","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"name":"kuadrant-e2e-shared-b-w0-0f0874","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-b-w0-0f0874","uid":"31926cb6-a222-454e-b0b0-713de52d3591"}]},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4676855aaad0efd1f263930f7407a2242dda7211d0408fa3820678f475f20874\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w0-0f0874-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w0-0f0874\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w0-0f0874\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]}],\"name\":\"3d902dff08fca5c2bb562975c1b916ca54e6236ecd9cc50b17e3b37999d911ec\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8ccf868b0c716a18e90e502ebb2284ce90d5ee3fcd5779be4d996fb8a3d03b43\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w0-0f0874-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w0-0f0874\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w0-0f0874\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]}],\"name\":\"e51fac9c5a01bb319b1deb20eaa60eeb3cb0f05fa44b2dfb2cac5ec6b7cbd8fd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"848b20842f79c8cc02bec7966c894853251e29e5c14c8a4cff729041c180e15c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w0-0f0874-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w0-0f0874\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w0-0f0874\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]}],\"name\":\"a73356366d107cd5992220a58c6f2b0f6bf70196a187bc3534c68088f7abd636\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b0dda7ce592fb57a979446129e21c491a217f4c5c9a704c19a519ee42c367e92\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w0-0f0874-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w0-0f0874\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w0-0f0874\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]}],\"name\":\"098f7ba551981a4029ff8c66c0d0234e632f325a01b723001668c0e56481bd87\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6e2c4c40ad28f1eeda9eca533706722536247311f5ede5be2cbe544e374719a6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w0-0f0874-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w0-0f0874\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w0-0f0874\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]}],\"name\":\"fd25786cbc9657425a1956e65052da9d0b96f50c6eca843a1c5af4671e05425e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ffaef4e77ab77e038e2181351f7ed710141739ce5f70351bf42c0606b9215e72\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w0-0f0874-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w0-0f0874\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w0-0f0874\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]}],\"name\":\"d6fb22990981f2cd0325455675dc804fada0a031b35d72d782173400f3a24d44\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-shared-b-w0-0f0874"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-e2e-shared-b-w0-0f0874\" already exists"}
{"level":"error","ts":"2026-11-02T21:56:44.717Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-58ca7f","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-58ca7f#rule-6"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"9dccfbfbcf84c5edf4e0a3cc993bd8181b6febef066c8d0c3b0f13de64710295","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["9dccfbfbcf84c5edf4e0a3cc993bd8181b6febef066c8d0c3b0f13de64710295"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-58ca7f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-58ca7f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"9dccfbfbcf84c5edf4e0a3cc993bd8181b6febef066c8d0c3b0f13de64710295\" already exists"}
{"level":"error","ts":"2026-11-02T21:56:45.307Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-b-w0-0f0874-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-b-w0-0f0874-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:56:45.365Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-b-w0-0f0874","namespace":"openshift-ingress","uid":"8b4ec7cb-daa9-467a-b2f6-528aa3d837fc","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-b-w0-0f0874\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:56:45.372Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-b-w3-a1d751-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-b-w3-a1d751-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:56:45.722Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-b-w4-58ca7f-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-b-w4-58ca7f-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:56:45.960Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-b-w4-58ca7f","namespace":"openshift-ingress","uid":"5187151d-dfe9-40c2-b03b-5e9a20a0d12c","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-b-w4-58ca7f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:56:46.199Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-b-w3-a1d751","namespace":"openshift-ingress","uid":"2c7a0593-2f35-427a-b6f0-958582546c18","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-b-w3-a1d751\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:56:46.685Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:56:46.685Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:56:46Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-explicit-4ca09f","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-explicit-4ca09f","reconcileID":"04bf96f7-2e17-4840-a807-b0fb581481e6","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-explicit-4ca09f","namespace":"openshift-ingress"}
{"level":"error","ts":"2026-11-02T21:56:46.807Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-b-w4-58ca7f","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-shared-b-w4-58ca7f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:56:46Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-explicit-4ca09f","event":"CREATE"}
{"level":"info","ts":"2026-11-02T21:56:46Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-02T21:56:47.030Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"maas-api-route-e2e-shared-b-w4-58ca7f","namespace":"odh-ai-gateway-infra","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"maas-api-route-e2e-shared-b-w4-58ca7f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:56:47.131Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"maas-api-route-e2e-shared-b-w0-0f0874","namespace":"odh-ai-gateway-infra","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"maas-api-route-e2e-shared-b-w0-0f0874\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:56:47.246Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-a-w2-06e461","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-shared-a-w2-06e461\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:56:47.305Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-b-w0-0f0874","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-shared-b-w0-0f0874\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:56:47Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-02T21:56:47Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-02T21:56:47Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:56:47Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-explicit-4ca09f","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-explicit-4ca09f","reconcileID":"ad8bb0a7-4fc7-49d2-ae8b-5bfc48946e72","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-explicit-4ca09f","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:56:47Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-explicit-4ca09f","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T21:56:47Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-02T21:56:47.551Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-explicit-4ca09f","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-explicit-4ca09f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:56:47Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-02T21:56:47Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-02T21:56:47Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-02T21:56:47Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:56:54.365Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["EnvoyFilter","AuthConfig","TokenRateLimitPolicy","Gateway","HTTPRoute","AuthPolicy","Limitador","Kuadrant","ConfigMap"],"eventTypes":{"create":24,"update":15}}
{"level":"info","ts":"2026-11-02T21:56:54.615Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:56:54.635Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:56:57.355Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:56:57.368Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:56:57.623Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:56:57.623Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:56:57.624Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:57:00.644Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:57:00.644Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:57:00.651Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:57:00.655Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:57:00.660Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:57:00.660Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:57:00.865Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:57:03.786Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:57:03.786Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:57:11.386Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["EnvoyFilter","ConfigMap","AuthConfig","TokenRateLimitPolicy","AuthPolicy","HTTPRoute","Limitador","Gateway"],"eventTypes":{"create":18,"update":14}}
{"level":"info","ts":"2026-11-02T21:57:11.795Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:57:13.742Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:57:13.937Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:57:13.937Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:57:17.356Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:57:17.367Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:57:17.367Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:57:17.374Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:57:17.374Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:57:17.380Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-02T21:57:17.380Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:57:20.463Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:57:20.463Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T21:57:20.996Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-a-w3-97995b","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-shared-a-w3-97995b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:57:28.210Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthPolicy","TokenRateLimitPolicy","HTTPRoute","ConfigMap","Gateway","Limitador"],"eventTypes":{"create":1,"update":25}}
{"level":"info","ts":"2026-11-02T21:57:28.479Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:57:30.563Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:57:30.658Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:57:30.658Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:57:34.157Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:57:34.158Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:57:34.165Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:57:34.166Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:57:34.173Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:57:34.173Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:57:34.337Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:57:37.471Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:57:37.471Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:57:45.308Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","AuthPolicy","HTTPRoute","TokenRateLimitPolicy","Limitador","EnvoyFilter","ConfigMap"],"eventTypes":{"create":12,"update":25}}
{"level":"info","ts":"2026-11-02T21:57:45.751Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:57:47.448Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:57:47.636Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:57:47.636Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:57:50.957Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:57:50.964Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-02T21:57:50.964Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:57:50.957Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:57:50.971Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:57:50.971Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:57:50.975Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:57:53.980Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:57:53.980Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:57:58.662Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","AuthPolicy","Limitador","ConfigMap"],"eventTypes":{"update":23}}
{"level":"info","ts":"2026-11-02T21:57:59.065Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:58:00.765Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:58:00.933Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:58:00.933Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:58:04.839Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:58:04.839Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:58:04.845Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-02T21:58:04.845Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:58:04.860Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:58:04.860Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:58:04.864Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:58:07.798Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:58:07.798Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:58:15.622Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","Gateway"],"eventTypes":{"create":1,"update":1}}
{"level":"info","ts":"2026-11-02T21:58:21.579Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:58:21.592Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:58:21.592Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:58:21.599Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:58:21.599Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:58:21.646Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-02T21:58:21.646Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:58:24.637Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:58:24.637Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T21:58:25.390Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-a-w0-6e535d","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-shared-a-w0-6e535d\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:58:35.943Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","Gateway","HTTPRoute"],"eventTypes":{"create":1,"update":2}}
{"level":"info","ts":"2026-11-02T21:58:42.377Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:58:42.387Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:58:42.388Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:58:42.388Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:58:42.389Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:58:42.425Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:58:42.548Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:58:45.887Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:58:45.888Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:58:47.448Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["HTTPRoute","Gateway"],"eventTypes":{"create":1,"update":1}}
{"level":"info","ts":"2026-11-02T21:58:53.549Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:58:53.556Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:58:53.562Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:58:53.562Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:58:53.567Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:58:53.568Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"error","ts":"2026-11-02T21:58:53.666Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:58:53.666Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T21:58:53.674Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-a-w4-7cde84/auth-test-model-7cde84-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w4-7cde84/auth-test-model-7cde84-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"dd010c172c72fd48c51e28a4460597e56fdbfdd446ca72b922184a35932738ed","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["dd010c172c72fd48c51e28a4460597e56fdbfdd446ca72b922184a35932738ed"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-7cde84.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-7cde84.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"dd010c172c72fd48c51e28a4460597e56fdbfdd446ca72b922184a35932738ed\" already exists"}
{"level":"error","ts":"2026-11-02T21:58:53.741Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route#v1-responses-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"488fa6498257bae79da02565203c68726b20b3ff1190dd0f76f1d15f3016b91c","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["488fa6498257bae79da02565203c68726b20b3ff1190dd0f76f1d15f3016b91c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"488fa6498257bae79da02565203c68726b20b3ff1190dd0f76f1d15f3016b91c\" already exists"}
{"level":"error","ts":"2026-11-02T21:58:53.807Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route#v1-catch-all-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"2ebd46ffb051e67477198ab6753e8d28c9a38e121382759fb2d52a04e59f9b60","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["2ebd46ffb051e67477198ab6753e8d28c9a38e121382759fb2d52a04e59f9b60"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"2ebd46ffb051e67477198ab6753e8d28c9a38e121382759fb2d52a04e59f9b60\" already exists"}
{"level":"error","ts":"2026-11-02T21:58:53.875Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route#v1-completions-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"570e5848a361e3c9dd1e04eedfa2b9e8bd67123ca48082b249c1e62ddac6aa45","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["570e5848a361e3c9dd1e04eedfa2b9e8bd67123ca48082b249c1e62ddac6aa45"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"570e5848a361e3c9dd1e04eedfa2b9e8bd67123ca48082b249c1e62ddac6aa45\" already exists"}
{"level":"error","ts":"2026-11-02T21:58:54.025Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-a-w4-7cde84/auth-test-model-7cde84-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w4-7cde84/auth-test-model-7cde84-kserve-route#v1-messages-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"d8de5232c6cb8746e6aa4c7f7b0b3a4dded70343ecbd9902be4a0ed74410c67d","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d8de5232c6cb8746e6aa4c7f7b0b3a4dded70343ecbd9902be4a0ed74410c67d"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-7cde84.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-7cde84.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"d8de5232c6cb8746e6aa4c7f7b0b3a4dded70343ecbd9902be4a0ed74410c67d\" already exists"}
{"level":"error","ts":"2026-11-02T21:58:54.094Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-a-w4-7cde84/auth-test-model-7cde84-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w4-7cde84/auth-test-model-7cde84-kserve-route#v1-model-routing"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"f094d0f2e223afe06fc7ed6aadc41776a6cc59dda5ac644c150533c875567d8d","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f094d0f2e223afe06fc7ed6aadc41776a6cc59dda5ac644c150533c875567d8d"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-7cde84.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-7cde84.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"f094d0f2e223afe06fc7ed6aadc41776a6cc59dda5ac644c150533c875567d8d\" already exists"}
{"level":"error","ts":"2026-11-02T21:58:54.160Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"e7b7d686afb3e980f4fa7e5e90b69836684133b1852ad79e11efb71a5156e402","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["e7b7d686afb3e980f4fa7e5e90b69836684133b1852ad79e11efb71a5156e402"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"e7b7d686afb3e980f4fa7e5e90b69836684133b1852ad79e11efb71a5156e402\" already exists"}
{"level":"error","ts":"2026-11-02T21:58:54.226Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"22782c8aa7f396a4922a49f49140671294f2d19b32614fd09a7f9d26e94f5aa9","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["22782c8aa7f396a4922a49f49140671294f2d19b32614fd09a7f9d26e94f5aa9"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"22782c8aa7f396a4922a49f49140671294f2d19b32614fd09a7f9d26e94f5aa9\" already exists"}
{"level":"error","ts":"2026-11-02T21:58:54.293Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-a-w4-7cde84/auth-test-model-7cde84-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w4-7cde84/auth-test-model-7cde84-kserve-route#v1-completions-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"601c281199237b14b77723b8a3a2ef6b8c0cbc3d025cea3c982fb1f47fa4e0f1","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["601c281199237b14b77723b8a3a2ef6b8c0cbc3d025cea3c982fb1f47fa4e0f1"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-7cde84.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-7cde84.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"601c281199237b14b77723b8a3a2ef6b8c0cbc3d025cea3c982fb1f47fa4e0f1\" already exists"}
{"level":"error","ts":"2026-11-02T21:58:54.365Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route#v1-messages-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"a7a0dc3cdf8fe8f61255465b2a28cb24f80d6467505607084b4be4b883494ef6","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a7a0dc3cdf8fe8f61255465b2a28cb24f80d6467505607084b4be4b883494ef6"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"a7a0dc3cdf8fe8f61255465b2a28cb24f80d6467505607084b4be4b883494ef6\" already exists"}
{"level":"error","ts":"2026-11-02T21:58:54.476Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-shared-a-w0-6e535d","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T21:54:30Z","generation":1,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"bb413150-c71f-467a-b73c-fc346914ff7a\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:54:30Z"}],"name":"kuadrant-e2e-shared-a-w0-6e535d","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-a-w0-6e535d","uid":"bb413150-c71f-467a-b73c-fc346914ff7a"}],"resourceVersion":"82210","uid":"79ec4380-cbc0-4c66-b610-cdb28384077b"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c88daf14f697a484e9c4281c2194076dd57e1afe0e40819b6ea26599cb703e8b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"5d0e9408d69754c488902bd340f6b0a6f1864fac10f1f8e367ff40e50ae5ce01\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w0-6e535d/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c88daf14f697a484e9c4281c2194076dd57e1afe0e40819b6ea26599cb703e8b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"b076dfbfd5d7663e530e8a29a4789267e6429f59d51ebac8a69ff33b93f91f45\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w0-6e535d/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c88daf14f697a484e9c4281c2194076dd57e1afe0e40819b6ea26599cb703e8b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"da00003130e20f19532bdecff616a160b89d1e063f591c906554b89d0bb4263e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w0-6e535d/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c88daf14f697a484e9c4281c2194076dd57e1afe0e40819b6ea26599cb703e8b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"5b3fe1c533d5d79dd6aded892a6fe0d9d623fa4b1fb990ab35d2d88eac062a4c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w0-6e535d/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c88daf14f697a484e9c4281c2194076dd57e1afe0e40819b6ea26599cb703e8b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"250bc93087c31cc5a282a19ab15f80ee1861f55d7415d75e3025836a8a2e8c51\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w0-6e535d/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c88daf14f697a484e9c4281c2194076dd57e1afe0e40819b6ea26599cb703e8b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"bac9dc1d9dd43ed5dcbd51a5ae508efe4045bfb79f818a7f155d8f1fbef8acde\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w0-6e535d/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c88daf14f697a484e9c4281c2194076dd57e1afe0e40819b6ea26599cb703e8b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"54727fdd6fe954678377cabf073d49155df15982b405dc503c28a1a1a9fb6462\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w0-6e535d/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c88daf14f697a484e9c4281c2194076dd57e1afe0e40819b6ea26599cb703e8b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"fc810dd26a41e3e710c7c25ab1324c0430624820a9bfe8f128113df2c8a8e150\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w0-6e535d/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"376d56a711fbb2b29d7c46a8a0998936174b738443f0db294a13f85fd8478a94\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"3aa9e48facd88e18a7acef348feeaf654a1d4310d58727df558a9c5543ced772\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"22782c8aa7f396a4922a49f49140671294f2d19b32614fd09a7f9d26e94f5aa9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"c082a06d8a8f9278e6c1f845fca54a717a0293281a68b2c7bc7449a2e599733c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-a-w0-6e535d/models/facebook/opt-125m/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d82605cc2995db10d6c22eaf50ce1b24ce92305a4b1b2cf9ef796dc4a0e019f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"118d368999575d560f991f40640a453764e7c0b6268ed87505baec55580bd619\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-a-w0-6e535d/models/facebook/opt-125m/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"404142835a3977e1a9c2c43dac43764640a7632eade56ba3651c850858555e55\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"160b7ea1c7e8177306ef3c92ab8011b36af7fe1d3a7699455acbefab2e870174\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-a-w0-6e535d/models/facebook/opt-125m/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a7a0dc3cdf8fe8f61255465b2a28cb24f80d6467505607084b4be4b883494ef6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"f6c097cc138c92b1b467164e77ec3a1f2f6e8e07441cdd0df65ae38065ae2698\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-a-w0-6e535d/models/facebook/opt-125m/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"17286683a6178785a8017d68de67b058e3a1963e7ba7f06b1101054db0cebfb1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"e72329ef02d0afc0ab8652712a5954a5037a4a5eb0b766375a86ff513eb92c07\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"570e5848a361e3c9dd1e04eedfa2b9e8bd67123ca48082b249c1e62ddac6aa45\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"639c799e4de16c75644b4448049c991d6072805f0202a39c30f55e37d08ab1f4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"488fa6498257bae79da02565203c68726b20b3ff1190dd0f76f1d15f3016b91c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"f7d599fbb9563d1af06dc7949981399a5ce6e0411dea789e86b236b300ec5a00\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e7b7d686afb3e980f4fa7e5e90b69836684133b1852ad79e11efb71a5156e402\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"a61a55c32a9a90b21b2be93f5deae56314af3c4c247f64ec034990e3224b05c2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-a-w0-6e535d/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"45c0e8af5bd103871f78f35176ade26570f4cd362b56658e846eb717266590b0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"46a2bba503f657cce3aaa7181591c9cf2a233ab3641309c5709bdfc1462466ac\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2ebd46ffb051e67477198ab6753e8d28c9a38e121382759fb2d52a04e59f9b60\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"58ceed85289173525de25d7f2a84abcfca5c0fecd2525ef3063338d7a23601a7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"65ad30c331bd08b64f99c2bfc9d23db3979d37b9d3b916cb76d08a0dfabf963a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"4593350858282f0ebeaf11b57850d5bccfa270a4b6088784a058e2d70b5cbe7c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"71e8c9bf81b77581f96b1cca4bb909b8434efbbb06bf9c9ec1aa5c8f412b9c76\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"01c09092684d0d3ed9db0ad6f53595f8d2c97286804d29e76075f2c30f05f44e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c3ead856f0c0807270869b6a467d9281b93eaaa8c65e788c4b6393073db2cbe8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"7d0e9eabd4ff8a0b65212f3d03a7b14a1e695503c8c41fb7cd6e844984ba7c69\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8b7e784474461510a9d9970d39fe03c297fc6f9a5f80873c40898bdfcb389e5f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"3cb722466e22fc9e58ad8f75bb3dbd6e1d2f9d75c3cfaafc5c6350857d59f964\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7482755e6f782100b8480fa82045aac768a6400e192241b0d0cf93403dad8edb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"af29fffcd438904723a318f8c7cd8dbe79f55578faf5560452874252825fdf46\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c8ebd64b293ad7c614b7021be06db91b0e0b0afb406d42f6c2500255bf064935\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"e00a02f312942a27da8eda94534fbd032cea948dcae834521b0d6ce91553a090\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w0-6e535d/models/facebook/opt-125m')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-shared-a-w0-6e535d"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-shared-a-w0-6e535d\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:58:54.483Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-a-w4-7cde84/auth-test-model-7cde84-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w4-7cde84/auth-test-model-7cde84-kserve-route#v1-messages-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"306fe676dfc4eeb84a7c1f3a78b631a24fea353e25b6003715990d4436533a42","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["306fe676dfc4eeb84a7c1f3a78b631a24fea353e25b6003715990d4436533a42"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-7cde84.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-7cde84.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"306fe676dfc4eeb84a7c1f3a78b631a24fea353e25b6003715990d4436533a42\" already exists"}
{"level":"error","ts":"2026-11-02T21:58:54.552Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-a-w4-7cde84/auth-test-model-7cde84-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w4-7cde84/auth-test-model-7cde84-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"ce915460df65410db1fd4ff8dd446cf14e70be86a1abdc1b3ee163aeb0f06056","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["ce915460df65410db1fd4ff8dd446cf14e70be86a1abdc1b3ee163aeb0f06056"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-7cde84.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-7cde84.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"ce915460df65410db1fd4ff8dd446cf14e70be86a1abdc1b3ee163aeb0f06056\" already exists"}
{"level":"error","ts":"2026-11-02T21:58:54.603Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-shared-a-w4-7cde84","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T21:54:29Z","generation":1,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"30a49997-f3b8-4b9e-a63d-efe4d247c707\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:54:29Z"}],"name":"kuadrant-e2e-shared-a-w4-7cde84","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-a-w4-7cde84","uid":"30a49997-f3b8-4b9e-a63d-efe4d247c707"}],"resourceVersion":"82169","uid":"a9161c5c-8421-407e-b216-c0f311a76a78"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f094d0f2e223afe06fc7ed6aadc41776a6cc59dda5ac644c150533c875567d8d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-7cde84-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/auth-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/auth-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]}],\"name\":\"e0111cf534990c5ef0dd56e75e3c4d91d51c85b44c04d545e22d35e167bab05f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w4-7cde84/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f094d0f2e223afe06fc7ed6aadc41776a6cc59dda5ac644c150533c875567d8d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-7cde84-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/auth-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/auth-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]}],\"name\":\"a9a815bfc98d80d4106ffec1c7de097591d1c24a1e6581d90e650a196e451ff9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w4-7cde84/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f094d0f2e223afe06fc7ed6aadc41776a6cc59dda5ac644c150533c875567d8d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-7cde84-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/auth-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/auth-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]}],\"name\":\"13f1606b5fdc71d5c366fb8c684ef968cc32b700b944276668894f80eaf4e924\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w4-7cde84/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f094d0f2e223afe06fc7ed6aadc41776a6cc59dda5ac644c150533c875567d8d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-7cde84-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/auth-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/auth-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]}],\"name\":\"4e932ba956790dd7e7e73270796e7f0aebf3a2a5f3919c8fdfced9b3d92d98e6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w4-7cde84/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f094d0f2e223afe06fc7ed6aadc41776a6cc59dda5ac644c150533c875567d8d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-7cde84-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/auth-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/auth-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]}],\"name\":\"6da19ffe2b311d9a78389a447244effb024ac2ffb6e6916d5117acefe4a19b06\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w4-7cde84/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f094d0f2e223afe06fc7ed6aadc41776a6cc59dda5ac644c150533c875567d8d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-7cde84-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/auth-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/auth-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]}],\"name\":\"f6f6019cb96125ca49299956536423ff9825e821d35cc0e26ab86b7d395a8eac\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w4-7cde84/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f094d0f2e223afe06fc7ed6aadc41776a6cc59dda5ac644c150533c875567d8d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-7cde84-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/auth-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/auth-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]}],\"name\":\"cfae647dee73dc9cb5e8b46832f70d4b4dbcab4da08405e06d5f78fc40f4d1ef\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w4-7cde84/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f094d0f2e223afe06fc7ed6aadc41776a6cc59dda5ac644c150533c875567d8d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-7cde84-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/auth-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/auth-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]}],\"name\":\"9e38481563d9b7be54c217c600558e868968f073d604ee1cbc866e211e76a366\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w4-7cde84/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0f923fa7f17446f382fb056bef7c9cc2146361c32cb89e19da4e6397505de43c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-7cde84-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-7cde84\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-7cde84\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]}],\"name\":\"6fb04747cbba17c2d2edd73660c4e50eec6f0ee924099f26ff442586021553ed\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"dd010c172c72fd48c51e28a4460597e56fdbfdd446ca72b922184a35932738ed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-7cde84-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/auth-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/auth-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]}],\"name\":\"5642800b42cb5a776cfe56c859382bfd5addf8d879d35f942035aaf884ec0208\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-a-w4-7cde84/models/facebook/opt-125m/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"45f9d7d09f974f5d9052f9533c8f3080f9da3799b3cc3a935a234851c01d48a6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-7cde84-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/auth-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/auth-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]}],\"name\":\"4db1ae2d126f7ec1580f836c0a9bd66e99fe08587046bb6f00c9e2ea0bbd868b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-a-w4-7cde84/models/facebook/opt-125m/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"94f9a5561f450c328575596e31e002775cbaced6edccf16a3a845fc83e5c6674\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-7cde84-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/auth-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/auth-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]}],\"name\":\"585b0eb85ecf584f1cf508c333365b20a24b3e122b2b49844e8b9eb963c396b5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-a-w4-7cde84/models/facebook/opt-125m/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d8de5232c6cb8746e6aa4c7f7b0b3a4dded70343ecbd9902be4a0ed74410c67d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-7cde84-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/auth-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/auth-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]}],\"name\":\"a506ac7642a9e6741e52f79704b5298288b12d72c049a3f883c5c73fac266556\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-a-w4-7cde84/models/facebook/opt-125m/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5b93fc9c5e970990ffcb287b0d50656f12bc0e49af91a8d2ec4b5eeb13bf1605\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-7cde84-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/auth-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/auth-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]}],\"name\":\"92f96c124ee5c65254cfe96e606beace7db0804dca8226c01c6aae1aa4068ac8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-a-w4-7cde84/auth-test-model-7cde84/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"601c281199237b14b77723b8a3a2ef6b8c0cbc3d025cea3c982fb1f47fa4e0f1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-7cde84-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/auth-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/auth-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]}],\"name\":\"3966d73f2d97816a10f933e903c26455289ee82b8d1fcd6d2070e5923338f84c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-a-w4-7cde84/auth-test-model-7cde84/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ca7eaca12054f736e1a75bbf6bd1ae5564a0b1bf6a98bf677f639993d7694776\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-7cde84-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/auth-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/auth-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]}],\"name\":\"84beaa70a791549b9ef855190b6a63b7f7aaf4694f7074d66cf8fb8caf81ce36\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-a-w4-7cde84/auth-test-model-7cde84/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ce915460df65410db1fd4ff8dd446cf14e70be86a1abdc1b3ee163aeb0f06056\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-7cde84-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/auth-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/auth-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]}],\"name\":\"d1bb09cb51511b0962b21431afb769f7cca26e319870b349235ddcc563f9b9ac\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-a-w4-7cde84/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"306fe676dfc4eeb84a7c1f3a78b631a24fea353e25b6003715990d4436533a42\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-7cde84-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/auth-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/auth-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]}],\"name\":\"ee5163881ece110e7bc3230bebb042887545dea3b775aaa705629def059541db\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-a-w4-7cde84/auth-test-model-7cde84/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7d3a19ba3d0056b14ca28c38813af8fa97210159c5ccca4047769f3e771355d0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-7cde84-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/auth-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/auth-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]}],\"name\":\"ec2847e2093c689d2f10e64dfe26e773250301cd0cea12afb4fc8382a429b313\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-a-w4-7cde84/auth-test-model-7cde84')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"150da2804d58820302b448e24151b1f189b717cd68a8c1e110fba61141165eb0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-7cde84-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-7cde84\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-7cde84\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]}],\"name\":\"e314acde8746b9db89412919be5da708b16f912df85d7b1e19c5983d2065f729\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"45531229ceac4cfcba16f0f8d809077fb7e19e248278c544ac9fd018c419ef18\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-7cde84-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-7cde84\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-7cde84\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]}],\"name\":\"5d1e4a29bea3f2db952d9e19481c737e780a5cc72dc0934c1c2012a39bc18efd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f6229ee2157250d6d160cdc978e612aa3a7c43bb558942020078c3f42c450c79\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-7cde84-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-7cde84\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-7cde84\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]}],\"name\":\"228840b91d117fcc6420f8e81c02a72767236079f030e5ad6e1f7df8d2bfef2f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"96cad25fbcf27b7341cae948477117cfaf58cb098cf23b68e9b61e9380b5dbab\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-7cde84-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-7cde84\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-7cde84\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]}],\"name\":\"7f37843572934e12cedf2d78614afd5eacc9ed1f0ea54fe933bb17625146accc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"75661500a5114b056fb7b7fa79b052930433ec107cb332756c581a2f0de24173\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-7cde84-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-7cde84\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-7cde84\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]}],\"name\":\"f6e55ef63865313913827adc1faf8eb8ccb447468294af4335a4df4ebb61a404\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"09131f977263f1238410e0a8c5d46f7d7f662ec9e1cc5421b4e618f4a8b3901a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-7cde84-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/auth-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/auth-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]}],\"name\":\"18353c58ccefd2011a7687649649d4f00ee770c2a6b4900ae2a74fbf2d541cf6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w4-7cde84/models/facebook/opt-125m')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-shared-a-w4-7cde84"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-shared-a-w4-7cde84\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:58:54.617Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-a-w4-7cde84/auth-test-model-7cde84-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w4-7cde84/auth-test-model-7cde84-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"09131f977263f1238410e0a8c5d46f7d7f662ec9e1cc5421b4e618f4a8b3901a","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["09131f977263f1238410e0a8c5d46f7d7f662ec9e1cc5421b4e618f4a8b3901a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-7cde84.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-7cde84.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"09131f977263f1238410e0a8c5d46f7d7f662ec9e1cc5421b4e618f4a8b3901a\" already exists"}
{"level":"error","ts":"2026-11-02T21:58:54.685Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"c8ebd64b293ad7c614b7021be06db91b0e0b0afb406d42f6c2500255bf064935","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["c8ebd64b293ad7c614b7021be06db91b0e0b0afb406d42f6c2500255bf064935"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"c8ebd64b293ad7c614b7021be06db91b0e0b0afb406d42f6c2500255bf064935\" already exists"}
{"level":"error","ts":"2026-11-02T21:58:54.761Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route#v1-completions-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"d82605cc2995db10d6c22eaf50ce1b24ce92305a4b1b2cf9ef796dc4a0e019f0","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d82605cc2995db10d6c22eaf50ce1b24ce92305a4b1b2cf9ef796dc4a0e019f0"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"d82605cc2995db10d6c22eaf50ce1b24ce92305a4b1b2cf9ef796dc4a0e019f0\" already exists"}
{"level":"error","ts":"2026-11-02T21:58:54.830Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route#v1-responses-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"404142835a3977e1a9c2c43dac43764640a7632eade56ba3651c850858555e55","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["404142835a3977e1a9c2c43dac43764640a7632eade56ba3651c850858555e55"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"404142835a3977e1a9c2c43dac43764640a7632eade56ba3651c850858555e55\" already exists"}
{"level":"error","ts":"2026-11-02T21:58:54.897Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route#v1-messages-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"45c0e8af5bd103871f78f35176ade26570f4cd362b56658e846eb717266590b0","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["45c0e8af5bd103871f78f35176ade26570f4cd362b56658e846eb717266590b0"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"45c0e8af5bd103871f78f35176ade26570f4cd362b56658e846eb717266590b0\" already exists"}
{"level":"error","ts":"2026-11-02T21:58:54.970Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-a-w4-7cde84/auth-test-model-7cde84-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w4-7cde84/auth-test-model-7cde84-kserve-route#v1-responses-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"ca7eaca12054f736e1a75bbf6bd1ae5564a0b1bf6a98bf677f639993d7694776","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["ca7eaca12054f736e1a75bbf6bd1ae5564a0b1bf6a98bf677f639993d7694776"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-7cde84.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-7cde84.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"ca7eaca12054f736e1a75bbf6bd1ae5564a0b1bf6a98bf677f639993d7694776\" already exists"}
{"level":"error","ts":"2026-11-02T21:58:55.038Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-a-w4-7cde84/auth-test-model-7cde84-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w4-7cde84/auth-test-model-7cde84-kserve-route#v1-catch-all-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"7d3a19ba3d0056b14ca28c38813af8fa97210159c5ccca4047769f3e771355d0","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["7d3a19ba3d0056b14ca28c38813af8fa97210159c5ccca4047769f3e771355d0"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-7cde84.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-7cde84.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"7d3a19ba3d0056b14ca28c38813af8fa97210159c5ccca4047769f3e771355d0\" already exists"}
{"level":"error","ts":"2026-11-02T21:58:55.105Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route#v1-chat-completions-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"17286683a6178785a8017d68de67b058e3a1963e7ba7f06b1101054db0cebfb1","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["17286683a6178785a8017d68de67b058e3a1963e7ba7f06b1101054db0cebfb1"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"17286683a6178785a8017d68de67b058e3a1963e7ba7f06b1101054db0cebfb1\" already exists"}
{"level":"error","ts":"2026-11-02T21:58:55.171Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-a-w4-7cde84/auth-test-model-7cde84-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w4-7cde84/auth-test-model-7cde84-kserve-route#v1-chat-completions-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"5b93fc9c5e970990ffcb287b0d50656f12bc0e49af91a8d2ec4b5eeb13bf1605","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["5b93fc9c5e970990ffcb287b0d50656f12bc0e49af91a8d2ec4b5eeb13bf1605"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-7cde84.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-7cde84.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"5b93fc9c5e970990ffcb287b0d50656f12bc0e49af91a8d2ec4b5eeb13bf1605\" already exists"}
{"level":"error","ts":"2026-11-02T21:58:55.238Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-a-w4-7cde84/auth-test-model-7cde84-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w4-7cde84/auth-test-model-7cde84-kserve-route#v1-completions-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"45f9d7d09f974f5d9052f9533c8f3080f9da3799b3cc3a935a234851c01d48a6","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["45f9d7d09f974f5d9052f9533c8f3080f9da3799b3cc3a935a234851c01d48a6"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-7cde84.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-7cde84.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"45f9d7d09f974f5d9052f9533c8f3080f9da3799b3cc3a935a234851c01d48a6\" already exists"}
{"level":"error","ts":"2026-11-02T21:58:55.306Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route#v1-model-routing"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"c88daf14f697a484e9c4281c2194076dd57e1afe0e40819b6ea26599cb703e8b","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["c88daf14f697a484e9c4281c2194076dd57e1afe0e40819b6ea26599cb703e8b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"c88daf14f697a484e9c4281c2194076dd57e1afe0e40819b6ea26599cb703e8b\" already exists"}
{"level":"error","ts":"2026-11-02T21:58:55.376Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-a-w4-7cde84/auth-test-model-7cde84-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w4-7cde84/auth-test-model-7cde84-kserve-route#v1-responses-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"94f9a5561f450c328575596e31e002775cbaced6edccf16a3a845fc83e5c6674","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["94f9a5561f450c328575596e31e002775cbaced6edccf16a3a845fc83e5c6674"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-7cde84.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-7cde84.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"94f9a5561f450c328575596e31e002775cbaced6edccf16a3a845fc83e5c6674\" already exists"}
{"level":"error","ts":"2026-11-02T21:58:55.437Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w1-5f765a","namespace":"e2e-models-e2e-worker-w1-5f765a","uid":"7188eadc-9748-4be8-a5e2-d904cf5b6130","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w1-5f765a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:58:55.495Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-a-w0-6e535d","namespace":"openshift-ingress","uid":"0eae774a-4032-4461-b2be-6f3edd911a80","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-a-w0-6e535d\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:58:55.554Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w3-f51151","namespace":"e2e-models-e2e-worker-w3-f51151","uid":"c78aa03a-e3ca-4797-8a09-ab0d9cd88148","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w3-f51151\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:58:55.613Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-b-w4-58ca7f","namespace":"openshift-ingress","uid":"5187151d-dfe9-40c2-b03b-5e9a20a0d12c","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-b-w4-58ca7f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:58:55.731Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-b-w0-0f0874","namespace":"openshift-ingress","uid":"8b4ec7cb-daa9-467a-b2f6-528aa3d837fc","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-b-w0-0f0874\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:58:55.789Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-a-w2-06e461","namespace":"openshift-ingress","uid":"c459fc7a-4e41-4226-a9ad-15cf3c29611a","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-a-w2-06e461\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:58:55.790Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-a-w0-6e535d-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-a-w0-6e535d-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:58:55.848Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-a-w3-97995b","namespace":"openshift-ingress","uid":"9405e4ea-22ff-4c46-bbc0-f492e0e403dc","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-a-w3-97995b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:58:55.854Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-a-w4-7cde84-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-a-w4-7cde84-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:58:55.906Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-facebook-opt-125m-simulated","namespace":"llm","uid":"da8edb1a-ed61-454d-939f-fc7cd235d9fb","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-facebook-opt-125m-simulated\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:58:56.083Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w0-0c9014","namespace":"e2e-models-e2e-worker-w0-0c9014","uid":"dcb5a0e4-7049-4ddc-91de-e14d55b09789","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w0-0c9014\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:58:56.143Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w2-6fa533","namespace":"e2e-models-e2e-worker-w2-6fa533","uid":"3a128bb2-de88-49aa-ab9e-c8626107a077","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w2-6fa533\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:58:56.201Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-b-w3-a1d751","namespace":"openshift-ingress","uid":"2c7a0593-2f35-427a-b6f0-958582546c18","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-b-w3-a1d751\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:58:56.260Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w0-0c9014","namespace":"e2e-models-e2e-worker-w0-0c9014","uid":"4f647df6-1d5b-433b-b4fc-1279ff1755f7","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w0-0c9014\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:58:56.378Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w4-d6cb38","namespace":"e2e-models-e2e-worker-w4-d6cb38","uid":"486176e6-7786-40c4-9ce0-6f4a68b408b2","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w4-d6cb38\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:58:56.437Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w1-5f765a","namespace":"e2e-models-e2e-worker-w1-5f765a","uid":"9c852546-ee7c-4e72-855c-111315f7bf82","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w1-5f765a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:58:56.495Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-a-w4-7cde84","namespace":"openshift-ingress","uid":"83e46bfa-f121-4136-adc9-a9e6690edeab","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-a-w4-7cde84\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:58:56.617Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w3-f51151","namespace":"e2e-models-e2e-worker-w3-f51151","uid":"e3340067-224a-43ad-8020-ca9e00ead152","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w3-f51151\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:58:56.675Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w4-d6cb38","namespace":"e2e-models-e2e-worker-w4-d6cb38","uid":"0d3ebd35-5005-4ee4-a055-ff95546e3673","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w4-d6cb38\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:58:56.733Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-explicit-4ca09f","namespace":"openshift-ingress","uid":"9dfe3e52-73db-49bd-bcb1-a3af9840edf2","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-explicit-4ca09f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:58:56.851Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-simulated-simulated-premium","namespace":"llm","uid":"447993be-3c57-4e68-8ffa-6fc998a39c77","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-simulated-simulated-premium\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:58:56.909Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w2-6fa533","namespace":"e2e-models-e2e-worker-w2-6fa533","uid":"2ff73667-c2c3-4579-9503-b6ca098f1021","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w2-6fa533\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:58:56.909Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:58:56.909Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T21:58:57.100Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"auth-test-model-7cde84-kserve-route","namespace":"ai-tenant-e2e-shared-a-w4-7cde84","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"auth-test-model-7cde84-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:58:57.212Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"auth-test-model-6e535d-kserve-route","namespace":"ai-tenant-e2e-shared-a-w0-6e535d","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"auth-test-model-6e535d-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:58:57.222Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-explicit-4ca09f","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-explicit-4ca09f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:59:05.105Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","AuthConfig","EnvoyFilter","HTTPRoute","Gateway","ConfigMap","AuthPolicy","Limitador"],"eventTypes":{"create":25,"update":29}}
{"level":"info","ts":"2026-11-02T21:59:05.402Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:59:07.771Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:59:07.960Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:59:07.960Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:59:11.983Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:59:11.983Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:59:11.991Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:59:11.991Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:59:12.001Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:59:12.001Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-02T21:59:12.095Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:59:12.096Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:59:15.180Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:59:15.180Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:59:21Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-shared-b-w2-c7e71f","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-b-w2-c7e71f","reconcileID":"1534c8d2-9e9b-4592-8828-95aaae3ffccb","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-shared-b-w2-c7e71f","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:59:21Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-b-w2-c7e71f","event":"CREATE"}
{"level":"info","ts":"2026-11-02T21:59:21Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:59:22Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-02T21:59:22Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-02T21:59:22Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:59:22Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-shared-b-w2-c7e71f","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-b-w2-c7e71f","reconcileID":"259bce41-af96-4fde-b0d3-a9a35e3eb980","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-shared-b-w2-c7e71f","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:59:22Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-b-w2-c7e71f","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T21:59:22Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:59:22Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-02T21:59:22Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-02T21:59:22Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-02T21:59:22Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:59:22Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-shared-b-w2-c7e71f","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-b-w2-c7e71f","reconcileID":"563525a6-2fd9-42a6-a522-32f4fa82ca7f","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-shared-b-w2-c7e71f","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T21:59:22Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-b-w2-c7e71f","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T21:59:22Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T21:59:23Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-02T21:59:23Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-02T21:59:23Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-02T21:59:23Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T21:59:27.061Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","AuthPolicy","HTTPRoute","ConfigMap","Limitador","Gateway","EnvoyFilter"],"eventTypes":{"create":13,"update":8}}
{"level":"info","ts":"2026-11-02T21:59:27.360Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:59:29.854Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:59:30.034Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:59:30.034Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:59:34.279Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:59:34.282Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:59:34.290Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:59:34.324Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:59:34.325Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:59:34.325Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:59:34.467Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:59:37.696Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:59:37.696Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T21:59:39.309Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Kuadrant","Gateway","AuthPolicy","HTTPRoute","TokenRateLimitPolicy"],"eventTypes":{"create":3,"update":2}}
{"level":"info","ts":"2026-11-02T21:59:39.529Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:59:39.550Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T21:59:43.050Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T21:59:43.150Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T21:59:43.334Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:59:43.437Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T21:59:43.437Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T21:59:47.859Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T21:59:47.865Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T21:59:47.872Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T21:59:47.872Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T21:59:47.873Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T21:59:47.876Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-11-02T21:59:47.923Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-shared-b-w2-c7e71f","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/ratelimit":"true"},"name":"kuadrant-ratelimiting-e2e-shared-b-w2-c7e71f","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-b-w2-c7e71f","uid":"ebcff346-2b0d-4f9a-a3f4-224ad73d2413"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"limitador-limitador.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-ratelimit-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"limitador-limitador.kuadrant-system.svc.cluster.local","port_value":8081}}}}]}]},"name":"kuadrant-ratelimit-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-shared-b-w2-c7e71f"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-shared-b-w2-c7e71f\" already exists"}
{"level":"error","ts":"2026-11-02T21:59:47.976Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-shared-b-w2-c7e71f","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"kuadrant-auth-e2e-shared-b-w2-c7e71f","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-b-w2-c7e71f","uid":"ebcff346-2b0d-4f9a-a3f4-224ad73d2413"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-auth-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local","port_value":50051}}}}]}]},"name":"kuadrant-auth-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-shared-b-w2-c7e71f"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-shared-b-w2-c7e71f\" already exists"}
{"level":"error","ts":"2026-11-02T21:59:47.977Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:59:47.977Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T21:59:47.983Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-b-w3-a1d751/auth-test-model-a1d751-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w3-a1d751/auth-test-model-a1d751-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"092b41a66cf67ed4e6a2c9bf77e895326026460a706c001b31da262d99eacc93","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["092b41a66cf67ed4e6a2c9bf77e895326026460a706c001b31da262d99eacc93"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-a1d751.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-a1d751.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"092b41a66cf67ed4e6a2c9bf77e895326026460a706c001b31da262d99eacc93\" already exists"}
{"level":"error","ts":"2026-11-02T21:59:48.051Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-c7e71f","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-c7e71f#rule-4"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"5384f5c4ddc9ccb72784e0e07297d2dd640458e7b7a22716374ed0b8930f3320","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["5384f5c4ddc9ccb72784e0e07297d2dd640458e7b7a22716374ed0b8930f3320"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-c7e71f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-c7e71f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"5384f5c4ddc9ccb72784e0e07297d2dd640458e7b7a22716374ed0b8930f3320\" already exists"}
{"level":"error","ts":"2026-11-02T21:59:48.126Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-b-w3-a1d751/auth-test-model-a1d751-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w3-a1d751/auth-test-model-a1d751-kserve-route#v1-model-routing"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"6faa33cd34744fe698d6c36fe17815db636806edd32daed477695c8c93e9279d","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["6faa33cd34744fe698d6c36fe17815db636806edd32daed477695c8c93e9279d"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-a1d751.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-a1d751.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"6faa33cd34744fe698d6c36fe17815db636806edd32daed477695c8c93e9279d\" already exists"}
{"level":"error","ts":"2026-11-02T21:59:48.224Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-b-w3-a1d751/auth-test-model-a1d751-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w3-a1d751/auth-test-model-a1d751-kserve-route#v1-completions-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"4a6b47f013376c0e795759f619021480508173f8406eea0572248751de621d67","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["4a6b47f013376c0e795759f619021480508173f8406eea0572248751de621d67"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-a1d751.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-a1d751.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"4a6b47f013376c0e795759f619021480508173f8406eea0572248751de621d67\" already exists"}
{"level":"error","ts":"2026-11-02T21:59:48.323Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-b-w3-a1d751/auth-test-model-a1d751-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w3-a1d751/auth-test-model-a1d751-kserve-route#v1-catch-all-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"b985f4406ff1617c8d3f11a181bf0a591ce78473c6f9a011411719c028135dd2","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["b985f4406ff1617c8d3f11a181bf0a591ce78473c6f9a011411719c028135dd2"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-a1d751.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-a1d751.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"b985f4406ff1617c8d3f11a181bf0a591ce78473c6f9a011411719c028135dd2\" already exists"}
{"level":"error","ts":"2026-11-02T21:59:48.393Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-b-w3-a1d751/auth-test-model-a1d751-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w3-a1d751/auth-test-model-a1d751-kserve-route#v1-responses-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"e60f76f1d52a6f962e63a78677c20411b0971d24da7f416f039fb602ae0ae6f6","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["e60f76f1d52a6f962e63a78677c20411b0971d24da7f416f039fb602ae0ae6f6"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-a1d751.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-a1d751.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"e60f76f1d52a6f962e63a78677c20411b0971d24da7f416f039fb602ae0ae6f6\" already exists"}
{"level":"error","ts":"2026-11-02T21:59:48.480Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-b-w3-a1d751/auth-test-model-a1d751-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w3-a1d751/auth-test-model-a1d751-kserve-route#v1-messages-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"37e8360925309e51a50fee25233602cbda3d126226da3458efae924e9fe8a093","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["37e8360925309e51a50fee25233602cbda3d126226da3458efae924e9fe8a093"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-a1d751.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-a1d751.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"37e8360925309e51a50fee25233602cbda3d126226da3458efae924e9fe8a093\" already exists"}
{"level":"error","ts":"2026-11-02T21:59:48.575Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-c7e71f","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-c7e71f#rule-3"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"4a53308e71fbbb856396e651af44b1538dffa452616a580a700fb2b56d6332f1","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["4a53308e71fbbb856396e651af44b1538dffa452616a580a700fb2b56d6332f1"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-c7e71f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-c7e71f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"4a53308e71fbbb856396e651af44b1538dffa452616a580a700fb2b56d6332f1\" already exists"}
{"level":"error","ts":"2026-11-02T21:59:48.635Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-shared-b-w2-c7e71f","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"name":"kuadrant-e2e-shared-b-w2-c7e71f","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-b-w2-c7e71f","uid":"ebcff346-2b0d-4f9a-a3f4-224ad73d2413"}]},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"12167602fd6f0121f28300ae64a13003d4a0fa7f5ff7d0cb33d38b9e60b0d728\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-c7e71f-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__33bcb143\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-c7e71f\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-c7e71f\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__33bcb143\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-c7e71f\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-c7e71f\"]}],\"name\":\"d6fd397a77e8ba7bd2b80982953233d4c16560b8b52f01f81a3012b140803648\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7ed2ba1aeffbfe14d596981ced332ed955f46afacea1925e585ea9fdc0e6c4fc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-c7e71f-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__33bcb143\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-c7e71f\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-c7e71f\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__33bcb143\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-c7e71f\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-c7e71f\"]}],\"name\":\"1259a3c59f69156cefd87eb3fe06722a4ecdbf218855b5a7c71a7377f9548f3b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1c842f011243ad9a03724d6985fbcc2786da0a851d4830084a6dd6535b142162\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-c7e71f-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__33bcb143\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-c7e71f\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-c7e71f\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__33bcb143\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-c7e71f\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-c7e71f\"]}],\"name\":\"af900efc7a2e3b9f60be113185d106a0451a229cf9370f0929a4d72c529cb925\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4a53308e71fbbb856396e651af44b1538dffa452616a580a700fb2b56d6332f1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-c7e71f-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__33bcb143\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-c7e71f\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-c7e71f\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__33bcb143\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-c7e71f\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-c7e71f\"]}],\"name\":\"492d64afae2da60bbcf76896d263ddb4805c85282b2bcbb4bc8e8b1db4911994\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5384f5c4ddc9ccb72784e0e07297d2dd640458e7b7a22716374ed0b8930f3320\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-c7e71f-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__33bcb143\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-c7e71f\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-c7e71f\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__33bcb143\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-c7e71f\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-c7e71f\"]}],\"name\":\"8e5687b6a8c279faab35816724c8db684cc4abc2316eccc4624fe39e3db0597e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"17c8e0f32f1474abdd1596736289f0ee22b2ff3b2707aefff8f6535c03b8536a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-c7e71f-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__33bcb143\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-c7e71f\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-c7e71f\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__33bcb143\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-c7e71f\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-c7e71f\"]}],\"name\":\"a6d20ccac542be62116e052eda23f0e7a87a985220b8de577336362a77406dd5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-shared-b-w2-c7e71f"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-e2e-shared-b-w2-c7e71f\" already exists"}
{"level":"error","ts":"2026-11-02T21:59:48.640Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-b-w3-a1d751/auth-test-model-a1d751-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w3-a1d751/auth-test-model-a1d751-kserve-route#v1-responses-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"207c3449a263306e15e305b5a43ba16f8e7fcab7621c25b30b7a0f243ed9655c","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["207c3449a263306e15e305b5a43ba16f8e7fcab7621c25b30b7a0f243ed9655c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-a1d751.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-a1d751.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"207c3449a263306e15e305b5a43ba16f8e7fcab7621c25b30b7a0f243ed9655c\" already exists"}
{"level":"error","ts":"2026-11-02T21:59:48.711Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-b-w3-a1d751/auth-test-model-a1d751-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w3-a1d751/auth-test-model-a1d751-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"84812803be79f39f7028929de0fda826ef26570945340f374b5e4583722a406e","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["84812803be79f39f7028929de0fda826ef26570945340f374b5e4583722a406e"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-a1d751.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-a1d751.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"84812803be79f39f7028929de0fda826ef26570945340f374b5e4583722a406e\" already exists"}
{"level":"error","ts":"2026-11-02T21:59:48.780Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-b-w3-a1d751/auth-test-model-a1d751-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w3-a1d751/auth-test-model-a1d751-kserve-route#v1-messages-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"07097d32546de997387a70f93207fec9fa4ced8f7b979ca18027cc4cad08bbb6","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["07097d32546de997387a70f93207fec9fa4ced8f7b979ca18027cc4cad08bbb6"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-a1d751.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-a1d751.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"07097d32546de997387a70f93207fec9fa4ced8f7b979ca18027cc4cad08bbb6\" already exists"}
{"level":"error","ts":"2026-11-02T21:59:48.848Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-b-w3-a1d751/auth-test-model-a1d751-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w3-a1d751/auth-test-model-a1d751-kserve-route#v1-completions-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"6427b0a7dae5d6e00d2da72c6c8209480d852659ec75de3cba811ba018065b1f","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["6427b0a7dae5d6e00d2da72c6c8209480d852659ec75de3cba811ba018065b1f"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-a1d751.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-a1d751.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"6427b0a7dae5d6e00d2da72c6c8209480d852659ec75de3cba811ba018065b1f\" already exists"}
{"level":"error","ts":"2026-11-02T21:59:48.914Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-b-w3-a1d751/auth-test-model-a1d751-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w3-a1d751/auth-test-model-a1d751-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"45e18a69a53f8022df003ef870a3c9c7ee58bdafebadd742398aa710d6731e7e","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["45e18a69a53f8022df003ef870a3c9c7ee58bdafebadd742398aa710d6731e7e"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-a1d751.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-a1d751.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"45e18a69a53f8022df003ef870a3c9c7ee58bdafebadd742398aa710d6731e7e\" already exists"}
{"level":"error","ts":"2026-11-02T21:59:48.990Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-b-w3-a1d751/auth-test-model-a1d751-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w3-a1d751/auth-test-model-a1d751-kserve-route#v1-chat-completions-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"132d5f08efa09a93a4af1226cb401fdbae0b5352102d82a5806add5fb5fa0bda","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["132d5f08efa09a93a4af1226cb401fdbae0b5352102d82a5806add5fb5fa0bda"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-a1d751.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-a1d751.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"132d5f08efa09a93a4af1226cb401fdbae0b5352102d82a5806add5fb5fa0bda\" already exists"}
{"level":"error","ts":"2026-11-02T21:59:49.059Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-c7e71f","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-c7e71f#rule-1"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"17c8e0f32f1474abdd1596736289f0ee22b2ff3b2707aefff8f6535c03b8536a","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["17c8e0f32f1474abdd1596736289f0ee22b2ff3b2707aefff8f6535c03b8536a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-c7e71f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-c7e71f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"17c8e0f32f1474abdd1596736289f0ee22b2ff3b2707aefff8f6535c03b8536a\" already exists"}
{"level":"error","ts":"2026-11-02T21:59:49.125Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-c7e71f","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-c7e71f#rule-2"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"7ed2ba1aeffbfe14d596981ced332ed955f46afacea1925e585ea9fdc0e6c4fc","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["7ed2ba1aeffbfe14d596981ced332ed955f46afacea1925e585ea9fdc0e6c4fc"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-c7e71f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-c7e71f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"7ed2ba1aeffbfe14d596981ced332ed955f46afacea1925e585ea9fdc0e6c4fc\" already exists"}
{"level":"error","ts":"2026-11-02T21:59:49.191Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-c7e71f","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-c7e71f#rule-6"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"12167602fd6f0121f28300ae64a13003d4a0fa7f5ff7d0cb33d38b9e60b0d728","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["12167602fd6f0121f28300ae64a13003d4a0fa7f5ff7d0cb33d38b9e60b0d728"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-c7e71f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-c7e71f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"12167602fd6f0121f28300ae64a13003d4a0fa7f5ff7d0cb33d38b9e60b0d728\" already exists"}
{"level":"error","ts":"2026-11-02T21:59:49.263Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-c7e71f","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-c7e71f#rule-5"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"1c842f011243ad9a03724d6985fbcc2786da0a851d4830084a6dd6535b142162","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["1c842f011243ad9a03724d6985fbcc2786da0a851d4830084a6dd6535b142162"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-c7e71f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-c7e71f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"1c842f011243ad9a03724d6985fbcc2786da0a851d4830084a6dd6535b142162\" already exists"}
{"level":"error","ts":"2026-11-02T21:59:49.506Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-shared-b-w3-a1d751","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T21:56:05Z","generation":1,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"b4f450f8-3314-4538-8376-5bc4682213ba\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:56:05Z"}],"name":"kuadrant-e2e-shared-b-w3-a1d751","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-b-w3-a1d751","uid":"b4f450f8-3314-4538-8376-5bc4682213ba"}],"resourceVersion":"85127","uid":"f193cccb-926b-43ad-b8dd-0f35a235191b"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6faa33cd34744fe698d6c36fe17815db636806edd32daed477695c8c93e9279d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/auth-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/auth-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]}],\"name\":\"d4b3861e3b8c07175d5e331b49650fd2ee1739569997deeb31967106a801bdf7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w3-a1d751/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6faa33cd34744fe698d6c36fe17815db636806edd32daed477695c8c93e9279d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/auth-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/auth-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]}],\"name\":\"7f15bd2c8c3950a6146714e557637872a8f850c887bd6546f42fbd4f9d7d12ec\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w3-a1d751/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6faa33cd34744fe698d6c36fe17815db636806edd32daed477695c8c93e9279d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/auth-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/auth-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]}],\"name\":\"880fc010a24826859e075a49f400ef4c205a35d39ca5da0bdd72a6f0619fa27d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w3-a1d751/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6faa33cd34744fe698d6c36fe17815db636806edd32daed477695c8c93e9279d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/auth-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/auth-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]}],\"name\":\"67cb85a2459715d1d4a362b382f1d94bd98ebca10b18d2a37d48c6f4d36bd864\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w3-a1d751/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6faa33cd34744fe698d6c36fe17815db636806edd32daed477695c8c93e9279d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/auth-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/auth-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]}],\"name\":\"fe6a54f7b0127a2ae00bf800f5794a569d25bfff92aa665a96428b98f33f2440\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w3-a1d751/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6faa33cd34744fe698d6c36fe17815db636806edd32daed477695c8c93e9279d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/auth-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/auth-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]}],\"name\":\"553a48e741008255af5666b49f0d5ae21b5693603b8445c0fb28c8711da78172\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w3-a1d751/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6faa33cd34744fe698d6c36fe17815db636806edd32daed477695c8c93e9279d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/auth-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/auth-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]}],\"name\":\"5d39f73283fac115426868249e55def06f47b766610ebff9baeb0baea6a7e4f2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w3-a1d751/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6faa33cd34744fe698d6c36fe17815db636806edd32daed477695c8c93e9279d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/auth-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/auth-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]}],\"name\":\"bc0599d7e6d57c832a1ecd77c47e8fd8c74f740d19c51db4cb14aac25aac8567\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w3-a1d751/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e5c3e46343f841520ecdb272dac135e882471a34b6fbd1dfe102bb1535df2522\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-a1d751\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-a1d751\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]}],\"name\":\"4309e9a901e490b5923f5e9c24699d2e857cbb6dc20e790330c076d768763498\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"84812803be79f39f7028929de0fda826ef26570945340f374b5e4583722a406e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/auth-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/auth-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]}],\"name\":\"c9e69464aec044895b4a747f3d121df9a1d6cbc38cc422cf4abfc2a9a9cbe1a6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w3-a1d751/models/facebook/opt-125m/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6427b0a7dae5d6e00d2da72c6c8209480d852659ec75de3cba811ba018065b1f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/auth-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/auth-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]}],\"name\":\"accac78c7394ec6ad633f05bd603a21e22c1c0e6aca8aa483bde228a6edfbf3b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w3-a1d751/models/facebook/opt-125m/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e60f76f1d52a6f962e63a78677c20411b0971d24da7f416f039fb602ae0ae6f6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/auth-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/auth-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]}],\"name\":\"27e235a750ab5f634ea797ae07e6b6063a75d79ef0482aaa98f7461949f53689\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w3-a1d751/models/facebook/opt-125m/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"37e8360925309e51a50fee25233602cbda3d126226da3458efae924e9fe8a093\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/auth-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/auth-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]}],\"name\":\"62b0e900bb1ed853ca9009628decafa178d62bee92824bcc17083c60e6eac861\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w3-a1d751/models/facebook/opt-125m/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"132d5f08efa09a93a4af1226cb401fdbae0b5352102d82a5806add5fb5fa0bda\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/auth-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/auth-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]}],\"name\":\"ab85193ed1ba957f9bdf47211c8e30834edaa49868ae1e74eb06f0f98f8900f8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w3-a1d751/auth-test-model-a1d751/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4a6b47f013376c0e795759f619021480508173f8406eea0572248751de621d67\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/auth-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/auth-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]}],\"name\":\"d5d0528ffd6c046324821ab08c8310828680966452fb764ae5f86bae9b61eab0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w3-a1d751/auth-test-model-a1d751/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"207c3449a263306e15e305b5a43ba16f8e7fcab7621c25b30b7a0f243ed9655c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/auth-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/auth-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]}],\"name\":\"953d970e0b270b1734a29de05d0cef403ecbb3b28c9ba4e96a260ffada790db6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w3-a1d751/auth-test-model-a1d751/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"092b41a66cf67ed4e6a2c9bf77e895326026460a706c001b31da262d99eacc93\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/auth-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/auth-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]}],\"name\":\"2740e951ebdf4f3b3b9563aa42a2ec12a66503222e34252933c9bc63cf2c8f0e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w3-a1d751/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"07097d32546de997387a70f93207fec9fa4ced8f7b979ca18027cc4cad08bbb6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/auth-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/auth-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]}],\"name\":\"813e289e78115203a739adcf44e304d11d6225cac654d02b118f465437ddaa44\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w3-a1d751/auth-test-model-a1d751/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b985f4406ff1617c8d3f11a181bf0a591ce78473c6f9a011411719c028135dd2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/auth-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/auth-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]}],\"name\":\"1af35876f5bd5f6ea952f654c5788ef54ca3e8cd011798b8e9ebf829db555630\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w3-a1d751/auth-test-model-a1d751')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9ed0ddd0e1ea68b359e326fba62a585324a528f116f0bf6d3f085360f79ed877\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-a1d751\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-a1d751\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]}],\"name\":\"7017ce065aadb4ec3cd123f3de90d4b298418b4cb0d6f2943ce905f0b6fa1973\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3e1c5c0bad150c663f60d190f6837f1f47449a9fb1dd0f8b15a5a049a5785836\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-a1d751\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-a1d751\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]}],\"name\":\"4b9629b6a0dc02e424027c37c202c248a532fff8b8cebe3888b35f432e4237a0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"45692dd8f986fdd88aa79ac3fde6dd1db9cc5cbaa9003e3fe62a6a019e62eb23\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-a1d751\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-a1d751\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]}],\"name\":\"8762492ec17ca2d96d70f7661ea91bc6dd105b52e7f7927e5f87422dad69cdf1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"54678c70bb572c34d6f6ed39e879f5beb1891cc61c4ee64dec6d9d3d0ed9c115\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-a1d751\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-a1d751\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]}],\"name\":\"6e67ae0eecb22274f490861a930e85a9d3cf386bb0d1179f4c67c60e1ed8eb2c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"afffab50bac2693d1a47a43cedfba11a37634e625c51a64f41e14d037dc9bc9a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-a1d751\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-a1d751\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]}],\"name\":\"5df45cb848791fb94dcb78fb658eb490c82f995f9d95444c8a546b5cddad1a1b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"45e18a69a53f8022df003ef870a3c9c7ee58bdafebadd742398aa710d6731e7e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/auth-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/auth-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]}],\"name\":\"51a6e1b4524f8d211a7a15188e5d47b7b387451c362351583f28841d3829f343\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w3-a1d751/models/facebook/opt-125m')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-shared-b-w3-a1d751"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-shared-b-w3-a1d751\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:59:49.718Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-explicit-4ca09f-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-explicit-4ca09f-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:59:50.150Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-b-w3-a1d751-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-b-w3-a1d751-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:59:50.409Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-b-w2-c7e71f","namespace":"openshift-ingress","uid":"6decd2e5-6aa1-451b-97e5-5dd8911def76","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-b-w2-c7e71f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:59:50.630Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-b-w2-c7e71f-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-b-w2-c7e71f-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T21:59:51.120Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T21:59:51.120Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T21:59:51.330Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"auth-test-model-a1d751-kserve-route","namespace":"ai-tenant-e2e-shared-b-w3-a1d751","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"auth-test-model-a1d751-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:59:51.410Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"maas-api-route-e2e-shared-b-w2-c7e71f","namespace":"odh-ai-gateway-infra","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"maas-api-route-e2e-shared-b-w2-c7e71f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:59:51.463Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-explicit-4ca09f","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-explicit-4ca09f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:59:51.521Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-b-w2-c7e71f","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-shared-b-w2-c7e71f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T21:59:52.031Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-b-w0-0f0874","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-shared-b-w0-0f0874\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:00:02.983Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthPolicy","EnvoyFilter","AuthConfig","ConfigMap","HTTPRoute","TokenRateLimitPolicy","Limitador","Gateway"],"eventTypes":{"create":22,"delete":1,"update":12}}
{"level":"info","ts":"2026-11-02T22:00:03.279Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T22:00:05.726Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T22:00:05.862Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:00:05.862Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T22:00:10.466Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:00:10.472Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:00:10.478Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:00:10.478Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T22:00:10.480Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T22:00:10.484Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:00:10.648Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T22:00:15.095Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T22:00:15.095Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T22:00:16.679Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthPolicy"],"eventTypes":{"update":1}}
{"level":"info","ts":"2026-11-02T22:00:23.345Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:00:23.360Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:00:23.360Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T22:00:23Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-explicit-4ca09f","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-explicit-4ca09f","reconcileID":"ada4cc4f-61b9-4fe1-9e93-d5b3b555894c","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-explicit-4ca09f","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T22:00:23Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-explicit-4ca09f","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T22:00:23Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T22:00:23Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-11-02T22:00:23Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"error","ts":"2026-11-02T22:00:23.468Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route#v1-messages-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"bbf734a8f7cb8f7a4d8f6abc6cee8a1e0f3a91a1d6f325d722ffa80ed8951fdf","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["bbf734a8f7cb8f7a4d8f6abc6cee8a1e0f3a91a1d6f325d722ffa80ed8951fdf"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"bbf734a8f7cb8f7a4d8f6abc6cee8a1e0f3a91a1d6f325d722ffa80ed8951fdf\" already exists"}
{"level":"error","ts":"2026-11-02T22:00:23.538Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route#v1-completions-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"d7ae6cb43b0fd921cbdca5537d3e42177a4e37ae3027e062325ff19c6b954181","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d7ae6cb43b0fd921cbdca5537d3e42177a4e37ae3027e062325ff19c6b954181"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"d7ae6cb43b0fd921cbdca5537d3e42177a4e37ae3027e062325ff19c6b954181\" already exists"}
{"level":"info","ts":"2026-11-02T22:00:23Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-11-02T22:00:23Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-explicit-4ca09f","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-explicit-4ca09f","reconcileID":"ada4cc4f-61b9-4fe1-9e93-d5b3b555894c","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-explicit-4ca09f","namespace":"openshift-ingress"}
{"level":"error","ts":"2026-11-02T22:00:23.601Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-97995b","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-97995b#rule-2"},"creationTimestamp":"2026-11-02T21:54:07Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:54:07Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:54:08Z"}],"name":"64610b2b1b14c01fb91d85773d211a6d8b173cb847914d22204a29dbf00c051b","namespace":"kuadrant-system","resourceVersion":"81600","uid":"fe278c19-5f46-42de-861c-4acd306183f5"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["64610b2b1b14c01fb91d85773d211a6d8b173cb847914d22204a29dbf00c051b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-97995b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-97995b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:54:08Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:54:08Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["64610b2b1b14c01fb91d85773d211a6d8b173cb847914d22204a29dbf00c051b"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"64610b2b1b14c01fb91d85773d211a6d8b173cb847914d22204a29dbf00c051b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:00:23Z","logger":"telemetry-policy-extension-controller","msg":"Reconciler error","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-explicit-4ca09f","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-explicit-4ca09f","reconcileID":"7581f7c9-27b0-4ddc-b44a-a8aa1edf0cee","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-explicit-4ca09f\" not found","stacktrace":"sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:353\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-02T22:00:23Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-explicit-4ca09f","event":"DELETE"}
{"level":"info","ts":"2026-11-02T22:00:23Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-02T22:00:23Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-explicit-4ca09f\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-02T22:00:23Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"error","ts":"2026-11-02T22:00:23.664Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-97995b","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-97995b#rule-3"},"creationTimestamp":"2026-11-02T21:54:07Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:54:07Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:54:07Z"}],"name":"abffb2b80b2e83749e48ad9bc9e2b132b4526ff5c2ddee7e3c63dcaac739cb58","namespace":"kuadrant-system","resourceVersion":"81572","uid":"3d148990-75e7-4b0f-8e0d-c5bae3e9e89e"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["abffb2b80b2e83749e48ad9bc9e2b132b4526ff5c2ddee7e3c63dcaac739cb58"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-97995b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-97995b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:54:07Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:54:07Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["abffb2b80b2e83749e48ad9bc9e2b132b4526ff5c2ddee7e3c63dcaac739cb58"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"abffb2b80b2e83749e48ad9bc9e2b132b4526ff5c2ddee7e3c63dcaac739cb58\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:00:23.726Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-97995b","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-97995b#rule-6"},"creationTimestamp":"2026-11-02T21:54:08Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:54:08Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:54:08Z"}],"name":"feca5257a3a136afa9ca4bb6226e83b9e72a014fd57c59db758c454f118180b2","namespace":"kuadrant-system","resourceVersion":"81628","uid":"723bca8b-1d42-4c5c-80dd-8efa3359954d"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["feca5257a3a136afa9ca4bb6226e83b9e72a014fd57c59db758c454f118180b2"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-97995b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-97995b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:54:08Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:54:08Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["feca5257a3a136afa9ca4bb6226e83b9e72a014fd57c59db758c454f118180b2"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"feca5257a3a136afa9ca4bb6226e83b9e72a014fd57c59db758c454f118180b2\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:00:23.792Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route#v1-responses-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"ca46caeca16a2930e3e73b5d3e2f07945518abac4c9b3519cdc1f8068f758273","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["ca46caeca16a2930e3e73b5d3e2f07945518abac4c9b3519cdc1f8068f758273"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"ca46caeca16a2930e3e73b5d3e2f07945518abac4c9b3519cdc1f8068f758273\" already exists"}
{"level":"error","ts":"2026-11-02T22:00:23.859Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"6cb6688d420ac5b2b570d91ccae4187381d55d206452803585e3aab02552fbe9","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["6cb6688d420ac5b2b570d91ccae4187381d55d206452803585e3aab02552fbe9"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"6cb6688d420ac5b2b570d91ccae4187381d55d206452803585e3aab02552fbe9\" already exists"}
{"level":"error","ts":"2026-11-02T22:00:23.876Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-explicit-4ca09f","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T21:57:02Z","generation":2,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"a67e9cb6-2733-4b5b-a0e1-fcd2ba70816b\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:59:13Z"}],"name":"kuadrant-e2e-explicit-4ca09f","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-explicit-4ca09f","uid":"a67e9cb6-2733-4b5b-a0e1-fcd2ba70816b"}],"resourceVersion":"89169","uid":"69100faf-685c-45f8-ad80-92b8704d67f4"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6d7a15a804e8eb8e558fa87ad4ab2bf37f9a057314f08ea906f96d0d9dfdb484\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-explicit-4ca09f-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__e5fea9e3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-explicit-4ca09f\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-explicit-4ca09f\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__e5fea9e3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-explicit-4ca09f\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-explicit-4ca09f\"]}],\"name\":\"992f43e99674ae2dcd0814291b77983669ac95d81e19c831c944eae3bcb485f4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8eed28edac5e9e0ffe26c0daed06a5a76f7f4885bc1a2ca304571764b624fa51\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-explicit-4ca09f-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__e5fea9e3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-explicit-4ca09f\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-explicit-4ca09f\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__e5fea9e3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-explicit-4ca09f\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-explicit-4ca09f\"]}],\"name\":\"013f07d6f98be531a3e85d857c65c95dc2ac5a567b93eb0492d4bcb218a1c5d8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"12213b92601a7d4224ba3b0655eea9815bfecc753c20f322108f549ff4451969\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-explicit-4ca09f-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__e5fea9e3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-explicit-4ca09f\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-explicit-4ca09f\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__e5fea9e3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-explicit-4ca09f\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-explicit-4ca09f\"]}],\"name\":\"dee9d192961fb4f1e09f90a5bf86adee1109a45e703ec7ebd0e840ac5e4bf148\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9c8ab96cfd8b1f4eee5233a6cb80537be2f626801dfc93e078e2bfb1b92c08bc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-explicit-4ca09f-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__e5fea9e3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-explicit-4ca09f\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-explicit-4ca09f\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__e5fea9e3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-explicit-4ca09f\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-explicit-4ca09f\"]}],\"name\":\"5a19576eed5cdceb0c79e37509d54203bc940f6ee761853bca31479575a8b1d4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d07ccad2a17a578a39e022cd8d6a3001d23bbfcb08350322c127878d53782e8b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-explicit-4ca09f-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__e5fea9e3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-explicit-4ca09f\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-explicit-4ca09f\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__e5fea9e3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-explicit-4ca09f\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-explicit-4ca09f\"]}],\"name\":\"d6d2066575d44485776d05a13f0725b46f24b2ba28633f92eb87789c12534ea6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0792ee00f157f0af02ff26dfdb4834622c27b422320860bd98a0199b940bdcc8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-explicit-4ca09f-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__e5fea9e3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-explicit-4ca09f\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-explicit-4ca09f\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__e5fea9e3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-explicit-4ca09f\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-explicit-4ca09f\"]}],\"name\":\"302a441bbc3f6310d2c7a746a428a2fae8d8f755498906b3ad5d000a6a898c9c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}}],\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-explicit-4ca09f"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-explicit-4ca09f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:00:23.923Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w3-97995b/auth-test-model-97995b-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w3-97995b/auth-test-model-97995b-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-02T21:57:34Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:57:34Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:57:34Z"}],"name":"cdb9e2097a960951089e8bf406b69027223f661835df0854c973f5c378796c27","namespace":"kuadrant-system","resourceVersion":"86975","uid":"79d0b9d3-edf6-4247-8dd0-03b75e21e8e0"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["cdb9e2097a960951089e8bf406b69027223f661835df0854c973f5c378796c27"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-97995b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-97995b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:57:34Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:57:34Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["cdb9e2097a960951089e8bf406b69027223f661835df0854c973f5c378796c27"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"cdb9e2097a960951089e8bf406b69027223f661835df0854c973f5c378796c27\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:00:23.986Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w3-97995b/auth-test-model-97995b-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w3-97995b/auth-test-model-97995b-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-02T21:57:34Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:57:34Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:57:34Z"}],"name":"ddce824d6c6ab28c0eb965153db4af0b62a2269e2617650031db73be6ccc595f","namespace":"kuadrant-system","resourceVersion":"86977","uid":"28543c97-d206-42c3-826d-7a5b41580159"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["ddce824d6c6ab28c0eb965153db4af0b62a2269e2617650031db73be6ccc595f"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-97995b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-97995b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:57:34Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:57:34Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["ddce824d6c6ab28c0eb965153db4af0b62a2269e2617650031db73be6ccc595f"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"ddce824d6c6ab28c0eb965153db4af0b62a2269e2617650031db73be6ccc595f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:00:24.059Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"91970f7ac4ae9dc8cc6500e528bc955ad2f35aa953cbdaa553658695f4221e2b","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["91970f7ac4ae9dc8cc6500e528bc955ad2f35aa953cbdaa553658695f4221e2b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"91970f7ac4ae9dc8cc6500e528bc955ad2f35aa953cbdaa553658695f4221e2b\" already exists"}
{"level":"error","ts":"2026-11-02T22:00:24.134Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-97995b","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-97995b#rule-1"},"creationTimestamp":"2026-11-02T21:54:07Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:54:07Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:54:08Z"}],"name":"6de91d16ed05414ab83195af7a0e61dc3b464cde05b3f5b5c1cb41079af7d577","namespace":"kuadrant-system","resourceVersion":"81584","uid":"a4f9446c-17f0-4b21-8887-734403122d6a"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["6de91d16ed05414ab83195af7a0e61dc3b464cde05b3f5b5c1cb41079af7d577"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-97995b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-97995b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:54:08Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:54:08Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["6de91d16ed05414ab83195af7a0e61dc3b464cde05b3f5b5c1cb41079af7d577"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"6de91d16ed05414ab83195af7a0e61dc3b464cde05b3f5b5c1cb41079af7d577\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:00:24.196Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w3-97995b/auth-test-model-97995b-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w3-97995b/auth-test-model-97995b-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-02T21:57:35Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:57:35Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:57:35Z"}],"name":"3c4a94a653303d191934e4a5d5f546c8aec93cc70258197c790fd18796b337fb","namespace":"kuadrant-system","resourceVersion":"86994","uid":"6158e0dc-9385-407b-aa1c-a5bbfa662eb9"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["3c4a94a653303d191934e4a5d5f546c8aec93cc70258197c790fd18796b337fb"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-97995b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-97995b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:57:35Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:57:35Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["3c4a94a653303d191934e4a5d5f546c8aec93cc70258197c790fd18796b337fb"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"3c4a94a653303d191934e4a5d5f546c8aec93cc70258197c790fd18796b337fb\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:00:24.258Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w3-97995b/auth-test-model-97995b-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w3-97995b/auth-test-model-97995b-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-02T21:57:34Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:57:34Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:57:34Z"}],"name":"db5b542eac4f151cd78fef497800374a070c51f4872ca44557847c1be70dd14c","namespace":"kuadrant-system","resourceVersion":"86955","uid":"af05325a-4bea-4452-b422-65c3556717d5"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["db5b542eac4f151cd78fef497800374a070c51f4872ca44557847c1be70dd14c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-97995b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-97995b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:57:34Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:57:34Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["db5b542eac4f151cd78fef497800374a070c51f4872ca44557847c1be70dd14c"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"db5b542eac4f151cd78fef497800374a070c51f4872ca44557847c1be70dd14c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:00:24.321Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w3-97995b/auth-test-model-97995b-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w3-97995b/auth-test-model-97995b-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-02T21:57:35Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:57:35Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:57:35Z"}],"name":"435c1572ef09e42cae0e34b4ee56603b1f6f5cc3dde7b532e7c0dab1aeca1299","namespace":"kuadrant-system","resourceVersion":"87001","uid":"c1c7cacd-1d2e-4bd9-9f85-def5252a0a75"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["435c1572ef09e42cae0e34b4ee56603b1f6f5cc3dde7b532e7c0dab1aeca1299"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-97995b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-97995b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:57:35Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:57:35Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["435c1572ef09e42cae0e34b4ee56603b1f6f5cc3dde7b532e7c0dab1aeca1299"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"435c1572ef09e42cae0e34b4ee56603b1f6f5cc3dde7b532e7c0dab1aeca1299\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:00:24.390Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route#v1-catch-all-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"2eec8b123e2f232f097c8135f01e126de58c05e263e638ca62d7eefdb47f0999","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["2eec8b123e2f232f097c8135f01e126de58c05e263e638ca62d7eefdb47f0999"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"2eec8b123e2f232f097c8135f01e126de58c05e263e638ca62d7eefdb47f0999\" already exists"}
{"level":"error","ts":"2026-11-02T22:00:24.458Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route#v1-completions-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"4623541d4c172040d64c605b4e3945edb2d59ccdd3ec6ed31cc6feffeeae1ab4","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["4623541d4c172040d64c605b4e3945edb2d59ccdd3ec6ed31cc6feffeeae1ab4"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"4623541d4c172040d64c605b4e3945edb2d59ccdd3ec6ed31cc6feffeeae1ab4\" already exists"}
{"level":"error","ts":"2026-11-02T22:00:24.535Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-97995b","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-97995b#rule-4"},"creationTimestamp":"2026-11-02T21:54:07Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:54:07Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:54:07Z"}],"name":"861bd69371a3568d3786b56a91d3af9c85fd73ef3e549606a38eed24c8a99b89","namespace":"kuadrant-system","resourceVersion":"81576","uid":"89ab541a-5df9-4304-8a04-21e122f37f9e"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["861bd69371a3568d3786b56a91d3af9c85fd73ef3e549606a38eed24c8a99b89"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-97995b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-97995b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:54:07Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:54:07Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["861bd69371a3568d3786b56a91d3af9c85fd73ef3e549606a38eed24c8a99b89"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"861bd69371a3568d3786b56a91d3af9c85fd73ef3e549606a38eed24c8a99b89\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:00:24.626Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"e9438ab25aed0d4ff0ae6ae8d98bf3aafec82cbf8347ba6b7c99e884f66303ec","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["e9438ab25aed0d4ff0ae6ae8d98bf3aafec82cbf8347ba6b7c99e884f66303ec"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"e9438ab25aed0d4ff0ae6ae8d98bf3aafec82cbf8347ba6b7c99e884f66303ec\" already exists"}
{"level":"error","ts":"2026-11-02T22:00:24.689Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w3-97995b/auth-test-model-97995b-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w3-97995b/auth-test-model-97995b-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-02T21:57:34Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:57:34Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:57:34Z"}],"name":"45d944066c06db97baf90c68e80caad343e1a9bb057998700c80ee7af4d35061","namespace":"kuadrant-system","resourceVersion":"86967","uid":"da130a2d-b7da-4035-8701-d149495c7391"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["45d944066c06db97baf90c68e80caad343e1a9bb057998700c80ee7af4d35061"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-97995b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-97995b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:57:34Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:57:34Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["45d944066c06db97baf90c68e80caad343e1a9bb057998700c80ee7af4d35061"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"45d944066c06db97baf90c68e80caad343e1a9bb057998700c80ee7af4d35061\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:00:24.703Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-shared-b-w0-0f0874","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T21:56:34Z","generation":1,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"31926cb6-a222-454e-b0b0-713de52d3591\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:56:34Z"}],"name":"kuadrant-e2e-shared-b-w0-0f0874","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-b-w0-0f0874","uid":"31926cb6-a222-454e-b0b0-713de52d3591"}],"resourceVersion":"85701","uid":"1ec69299-baab-478d-87f9-565d3c2b35f2"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"192e3562b7ee19e64d41cd2b1ee110bdaa9d5e15bce45548d64e1cea83654553\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w0-0f0874-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]}],\"name\":\"96d612820c735a5c7f49aca0c5e3210a65bd84c7bb74aa59c6f11c388432988c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w0-0f0874/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"192e3562b7ee19e64d41cd2b1ee110bdaa9d5e15bce45548d64e1cea83654553\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w0-0f0874-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]}],\"name\":\"594ceea023dc6fd2036a4f6bc0ef534a12446fba2a3d3f58954345c8b77602fc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w0-0f0874/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"192e3562b7ee19e64d41cd2b1ee110bdaa9d5e15bce45548d64e1cea83654553\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w0-0f0874-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]}],\"name\":\"c51e02e9856e386dc171e8734da540cbc49b7b0a238f138ef22e444882e1613e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w0-0f0874/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"192e3562b7ee19e64d41cd2b1ee110bdaa9d5e15bce45548d64e1cea83654553\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w0-0f0874-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]}],\"name\":\"0888f39ff7d886257585cb922ded42c24041e07dc083ec596213dc7fcacccaea\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w0-0f0874/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"192e3562b7ee19e64d41cd2b1ee110bdaa9d5e15bce45548d64e1cea83654553\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w0-0f0874-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]}],\"name\":\"3c5fc1537f41b6f3804e88f6ec215ae6ef9524f53e1717c0cdec4029128cef05\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w0-0f0874/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"192e3562b7ee19e64d41cd2b1ee110bdaa9d5e15bce45548d64e1cea83654553\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w0-0f0874-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]}],\"name\":\"63aeeda6478ed352b03fb88743f4aedf116245422cae0681ee45af616c2000d5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w0-0f0874/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"192e3562b7ee19e64d41cd2b1ee110bdaa9d5e15bce45548d64e1cea83654553\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w0-0f0874-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]}],\"name\":\"b11f193dcf2be073ad3e9e40f3ad858efbf2de4d12c8bc1773a982144d661807\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w0-0f0874/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"192e3562b7ee19e64d41cd2b1ee110bdaa9d5e15bce45548d64e1cea83654553\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w0-0f0874-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]}],\"name\":\"be4b695e04605c0ca74f7b8190b972d0117c076eed01c4f0844ed25b0c3be637\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w0-0f0874/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4676855aaad0efd1f263930f7407a2242dda7211d0408fa3820678f475f20874\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w0-0f0874-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w0-0f0874\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w0-0f0874\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]}],\"name\":\"3d902dff08fca5c2bb562975c1b916ca54e6236ecd9cc50b17e3b37999d911ec\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6cb6688d420ac5b2b570d91ccae4187381d55d206452803585e3aab02552fbe9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w0-0f0874-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]}],\"name\":\"50fad7c8f3f0705a071ee5516dae4e63f442232e0a8eb11002d4c8b2f7b9039b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w0-0f0874/models/facebook/opt-125m/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4623541d4c172040d64c605b4e3945edb2d59ccdd3ec6ed31cc6feffeeae1ab4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w0-0f0874-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]}],\"name\":\"c812882d08c914362c20379f96d7022ad56d171d701c3c7ca4ff1757d4e109b2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w0-0f0874/models/facebook/opt-125m/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4fa2f2c1a3c0df3206f544f6ff837542a51e9515367baad5062e6a22eee81f04\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w0-0f0874-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]}],\"name\":\"ce8e43804485dd1338d30ad454b30041ac6b29b1b0c0e85e0085cd9abbc9e1e2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w0-0f0874/models/facebook/opt-125m/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"85163453d99bec350a3cce90e62f08f7ca26ab8a22960123c6d310178b1a50a8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w0-0f0874-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]}],\"name\":\"0379ad91c1f93b81155b541997ae37102c499869790fbd1483d631d2bcf4f79a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w0-0f0874/models/facebook/opt-125m/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e583136fa4e58c701ec7e6c48633505d9721ef080a15d621144f572174f6b87e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w0-0f0874-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]}],\"name\":\"b3cb87978351bfd72bc463105cba3b004e1586be0f3569c173fb637e093d5b0c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d7ae6cb43b0fd921cbdca5537d3e42177a4e37ae3027e062325ff19c6b954181\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w0-0f0874-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]}],\"name\":\"ba88551c983b0ba140904b68c7c7ef9857734f0019c63b85dbe43e7cbcb9307f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ca46caeca16a2930e3e73b5d3e2f07945518abac4c9b3519cdc1f8068f758273\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w0-0f0874-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]}],\"name\":\"6f0e56cfa964fd7af7b380781cd35bbd8a191aceba6852fff53d1efc008f0b81\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e9438ab25aed0d4ff0ae6ae8d98bf3aafec82cbf8347ba6b7c99e884f66303ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w0-0f0874-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]}],\"name\":\"23cdb90fab9cf66008bfaf0a6dd2b32a1294366bf64c4959293feda0ab809577\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w0-0f0874/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bbf734a8f7cb8f7a4d8f6abc6cee8a1e0f3a91a1d6f325d722ffa80ed8951fdf\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w0-0f0874-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]}],\"name\":\"ee38902643d390e24ee40e376a99f15504d5a6e8fb05035cedea3731206e4979\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2eec8b123e2f232f097c8135f01e126de58c05e263e638ca62d7eefdb47f0999\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w0-0f0874-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]}],\"name\":\"b7f33fdc0477b101212634363f5ff89b4f8bf42c996b487e6c9e78ff9bfa7ac8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8ccf868b0c716a18e90e502ebb2284ce90d5ee3fcd5779be4d996fb8a3d03b43\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w0-0f0874-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w0-0f0874\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w0-0f0874\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]}],\"name\":\"e51fac9c5a01bb319b1deb20eaa60eeb3cb0f05fa44b2dfb2cac5ec6b7cbd8fd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"848b20842f79c8cc02bec7966c894853251e29e5c14c8a4cff729041c180e15c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w0-0f0874-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w0-0f0874\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w0-0f0874\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]}],\"name\":\"a73356366d107cd5992220a58c6f2b0f6bf70196a187bc3534c68088f7abd636\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b0dda7ce592fb57a979446129e21c491a217f4c5c9a704c19a519ee42c367e92\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w0-0f0874-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w0-0f0874\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w0-0f0874\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]}],\"name\":\"098f7ba551981a4029ff8c66c0d0234e632f325a01b723001668c0e56481bd87\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6e2c4c40ad28f1eeda9eca533706722536247311f5ede5be2cbe544e374719a6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w0-0f0874-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w0-0f0874\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w0-0f0874\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]}],\"name\":\"fd25786cbc9657425a1956e65052da9d0b96f50c6eca843a1c5af4671e05425e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ffaef4e77ab77e038e2181351f7ed710141739ce5f70351bf42c0606b9215e72\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w0-0f0874-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w0-0f0874\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w0-0f0874\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]}],\"name\":\"d6fb22990981f2cd0325455675dc804fada0a031b35d72d782173400f3a24d44\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"91970f7ac4ae9dc8cc6500e528bc955ad2f35aa953cbdaa553658695f4221e2b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w0-0f0874-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]}],\"name\":\"ad56e4a3a6243f2b466c3c5486e30cb51678182b9e5b825b1c9dbb8915635a46\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w0-0f0874/models/facebook/opt-125m')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-shared-b-w0-0f0874"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-shared-b-w0-0f0874\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:00:24.753Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w3-97995b/auth-test-model-97995b-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w3-97995b/auth-test-model-97995b-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-02T21:57:34Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:57:34Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:57:34Z"}],"name":"987d2d277080ec70256da8bc2596c9b4a6f0b1d33eecb2547c818f1fce464fd9","namespace":"kuadrant-system","resourceVersion":"86958","uid":"c1b47fc3-28b6-4722-ad31-d499e07a299e"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["987d2d277080ec70256da8bc2596c9b4a6f0b1d33eecb2547c818f1fce464fd9"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-97995b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-97995b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:57:34Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:57:34Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["987d2d277080ec70256da8bc2596c9b4a6f0b1d33eecb2547c818f1fce464fd9"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"987d2d277080ec70256da8bc2596c9b4a6f0b1d33eecb2547c818f1fce464fd9\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:00:24.821Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route#v1-messages-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"85163453d99bec350a3cce90e62f08f7ca26ab8a22960123c6d310178b1a50a8","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["85163453d99bec350a3cce90e62f08f7ca26ab8a22960123c6d310178b1a50a8"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"85163453d99bec350a3cce90e62f08f7ca26ab8a22960123c6d310178b1a50a8\" already exists"}
{"level":"error","ts":"2026-11-02T22:00:24.885Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w3-97995b/auth-test-model-97995b-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w3-97995b/auth-test-model-97995b-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-02T21:57:34Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:57:34Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:57:35Z"}],"name":"79b917dbd65d1863778bb874d9ec325d6f65ebf5b0aaa7598aac106ed07a453d","namespace":"kuadrant-system","resourceVersion":"86983","uid":"ecddd19e-b645-456e-a601-90d7203d7404"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["79b917dbd65d1863778bb874d9ec325d6f65ebf5b0aaa7598aac106ed07a453d"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-97995b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-97995b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:57:35Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:57:35Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["79b917dbd65d1863778bb874d9ec325d6f65ebf5b0aaa7598aac106ed07a453d"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"79b917dbd65d1863778bb874d9ec325d6f65ebf5b0aaa7598aac106ed07a453d\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:00:24.949Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w3-97995b/auth-test-model-97995b-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w3-97995b/auth-test-model-97995b-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-02T21:57:34Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:57:34Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:57:34Z"}],"name":"2ff4aaca3e39fd0a84ca9db8e0eefa9d4367e60ed5bd4187e89ae045c89adfbb","namespace":"kuadrant-system","resourceVersion":"86969","uid":"230c7e6e-50b0-45e8-bac4-57b23f9d9c79"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["2ff4aaca3e39fd0a84ca9db8e0eefa9d4367e60ed5bd4187e89ae045c89adfbb"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-97995b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-97995b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:57:34Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:57:34Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["2ff4aaca3e39fd0a84ca9db8e0eefa9d4367e60ed5bd4187e89ae045c89adfbb"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"2ff4aaca3e39fd0a84ca9db8e0eefa9d4367e60ed5bd4187e89ae045c89adfbb\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:00:25.017Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route#v1-responses-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"4fa2f2c1a3c0df3206f544f6ff837542a51e9515367baad5062e6a22eee81f04","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["4fa2f2c1a3c0df3206f544f6ff837542a51e9515367baad5062e6a22eee81f04"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"4fa2f2c1a3c0df3206f544f6ff837542a51e9515367baad5062e6a22eee81f04\" already exists"}
{"level":"error","ts":"2026-11-02T22:00:25.086Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route#v1-model-routing"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"192e3562b7ee19e64d41cd2b1ee110bdaa9d5e15bce45548d64e1cea83654553","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["192e3562b7ee19e64d41cd2b1ee110bdaa9d5e15bce45548d64e1cea83654553"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"192e3562b7ee19e64d41cd2b1ee110bdaa9d5e15bce45548d64e1cea83654553\" already exists"}
{"level":"error","ts":"2026-11-02T22:00:25.149Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w3-97995b/auth-test-model-97995b-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w3-97995b/auth-test-model-97995b-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-02T21:57:35Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:57:35Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:57:35Z"}],"name":"7b3e638d702f81dbe5422c9319fdf7559c1f0306f12885108923c7ec63b7b6b8","namespace":"kuadrant-system","resourceVersion":"86990","uid":"23e80a40-771c-413c-a9e9-372b9d519062"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["7b3e638d702f81dbe5422c9319fdf7559c1f0306f12885108923c7ec63b7b6b8"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-97995b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-97995b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:57:35Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:57:35Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["7b3e638d702f81dbe5422c9319fdf7559c1f0306f12885108923c7ec63b7b6b8"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"7b3e638d702f81dbe5422c9319fdf7559c1f0306f12885108923c7ec63b7b6b8\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:00:25.217Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route#v1-chat-completions-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"e583136fa4e58c701ec7e6c48633505d9721ef080a15d621144f572174f6b87e","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["e583136fa4e58c701ec7e6c48633505d9721ef080a15d621144f572174f6b87e"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"e583136fa4e58c701ec7e6c48633505d9721ef080a15d621144f572174f6b87e\" already exists"}
{"level":"error","ts":"2026-11-02T22:00:25.279Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w3-97995b/auth-test-model-97995b-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w3-97995b/auth-test-model-97995b-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-02T21:57:34Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:57:34Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:57:34Z"}],"name":"10b8f42a16887a86e724b99ff08a76a9db7b707586689c2a132d00eed5cb792c","namespace":"kuadrant-system","resourceVersion":"86972","uid":"fa9cc1cb-0893-4462-b666-9bfe52a2fe6b"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["10b8f42a16887a86e724b99ff08a76a9db7b707586689c2a132d00eed5cb792c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-97995b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-97995b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:57:34Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:57:34Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["10b8f42a16887a86e724b99ff08a76a9db7b707586689c2a132d00eed5cb792c"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"10b8f42a16887a86e724b99ff08a76a9db7b707586689c2a132d00eed5cb792c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:00:25.344Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w3-97995b/auth-test-model-97995b-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w3-97995b/auth-test-model-97995b-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-02T21:57:34Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:57:34Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:57:35Z"}],"name":"c6837618504ea99c86d1aeac9197ce9683beb55d02369bdf4badae5904f9ddb5","namespace":"kuadrant-system","resourceVersion":"86981","uid":"a7ebbd46-ce90-4e9b-b65a-b0606ab11056"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["c6837618504ea99c86d1aeac9197ce9683beb55d02369bdf4badae5904f9ddb5"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-97995b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-97995b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:57:35Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:57:35Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["c6837618504ea99c86d1aeac9197ce9683beb55d02369bdf4badae5904f9ddb5"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"c6837618504ea99c86d1aeac9197ce9683beb55d02369bdf4badae5904f9ddb5\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:00:25.412Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-97995b","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-97995b#rule-5"},"creationTimestamp":"2026-11-02T21:54:07Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:54:07Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:54:07Z"}],"name":"7acb8a78dba64f5ca2cb229b1a6a6e5100dfd1fe0185742cdf2493f937286eba","namespace":"kuadrant-system","resourceVersion":"81556","uid":"5111a353-6a37-4a0a-bfc1-cede96724922"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["7acb8a78dba64f5ca2cb229b1a6a6e5100dfd1fe0185742cdf2493f937286eba"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-97995b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-97995b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:54:07Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:54:07Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["7acb8a78dba64f5ca2cb229b1a6a6e5100dfd1fe0185742cdf2493f937286eba"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"7acb8a78dba64f5ca2cb229b1a6a6e5100dfd1fe0185742cdf2493f937286eba\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:00:25.468Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/02ea4a3547f9129a4cfe19eacb191ca1d9042c59764100380204b3d09c94fc85","error":"authconfigs.authorino.kuadrant.io \"02ea4a3547f9129a4cfe19eacb191ca1d9042c59764100380204b3d09c94fc85\" not found"}
{"level":"error","ts":"2026-11-02T22:00:25.523Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/a3ea001da9639031131a5a9bd1b10eda8c688822a044f0c25036b5ac2cc326fd","error":"authconfigs.authorino.kuadrant.io \"a3ea001da9639031131a5a9bd1b10eda8c688822a044f0c25036b5ac2cc326fd\" not found"}
{"level":"error","ts":"2026-11-02T22:00:25.578Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/49159a1cc83e3a30953c821f05ca808fe97df31271645eccb91d46d24c861625","error":"authconfigs.authorino.kuadrant.io \"49159a1cc83e3a30953c821f05ca808fe97df31271645eccb91d46d24c861625\" not found"}
{"level":"error","ts":"2026-11-02T22:00:25.632Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/1cb287bd3233f5caa8e95dfc782175783311e062f0ec5fb34c9db0dda9a7f63b","error":"authconfigs.authorino.kuadrant.io \"1cb287bd3233f5caa8e95dfc782175783311e062f0ec5fb34c9db0dda9a7f63b\" not found"}
{"level":"error","ts":"2026-11-02T22:00:25.687Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/acb6d6f1414e759d129ae7e8fdc8edfd9a5147c24509ee3d5379aece99d65fa6","error":"authconfigs.authorino.kuadrant.io \"acb6d6f1414e759d129ae7e8fdc8edfd9a5147c24509ee3d5379aece99d65fa6\" not found"}
{"level":"error","ts":"2026-11-02T22:00:25.742Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/4aeee840b00ed820384d90c7c7e92d6be5eab7248798abfe03a669baced57cbe","error":"authconfigs.authorino.kuadrant.io \"4aeee840b00ed820384d90c7c7e92d6be5eab7248798abfe03a669baced57cbe\" not found"}
{"level":"error","ts":"2026-11-02T22:00:25.796Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/7347bdc2e3c3e485b8daa21501e3258045e43941c8543cc1da15c8ec1df1ec87","error":"authconfigs.authorino.kuadrant.io \"7347bdc2e3c3e485b8daa21501e3258045e43941c8543cc1da15c8ec1df1ec87\" not found"}
{"level":"error","ts":"2026-11-02T22:00:25.851Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/dd016bf49fd081c31dd02dc8ed2340ebfbe8050d673fa7c32cfd7fe46cbb081b","error":"authconfigs.authorino.kuadrant.io \"dd016bf49fd081c31dd02dc8ed2340ebfbe8050d673fa7c32cfd7fe46cbb081b\" not found"}
{"level":"error","ts":"2026-11-02T22:00:25.905Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/abbfa635a8433b22d2d4756625a9a78ee59591ebaa56acd0e444b0c6cec0705e","error":"authconfigs.authorino.kuadrant.io \"abbfa635a8433b22d2d4756625a9a78ee59591ebaa56acd0e444b0c6cec0705e\" not found"}
{"level":"error","ts":"2026-11-02T22:00:25.961Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/9306f6b9be5e98d41765f39a981557fcc96f0ea67ca7ff254afb5fcbfc588154","error":"authconfigs.authorino.kuadrant.io \"9306f6b9be5e98d41765f39a981557fcc96f0ea67ca7ff254afb5fcbfc588154\" not found"}
{"level":"error","ts":"2026-11-02T22:00:26.016Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/807cec5d83f5bad0abdf54f61fa6e81957bd0c953485e9fd0595253f6f43d150","error":"authconfigs.authorino.kuadrant.io \"807cec5d83f5bad0abdf54f61fa6e81957bd0c953485e9fd0595253f6f43d150\" not found"}
{"level":"error","ts":"2026-11-02T22:00:26.070Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/4e6b6bbcd7dfc95287e214ecfeb1ccd1e5aeb5284fd3c576f7b849b131cacd12","error":"authconfigs.authorino.kuadrant.io \"4e6b6bbcd7dfc95287e214ecfeb1ccd1e5aeb5284fd3c576f7b849b131cacd12\" not found"}
{"level":"error","ts":"2026-11-02T22:00:26.276Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-a-w3-97995b-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-a-w3-97995b-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:00:26.408Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-b-w3-a1d751-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-b-w3-a1d751-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:00:26.539Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-b-w2-c7e71f-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-b-w2-c7e71f-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:00:27.091Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-b-w0-0f0874-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-b-w0-0f0874-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:00:27.545Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"auth-test-model-0f0874-kserve-route","namespace":"ai-tenant-e2e-shared-b-w0-0f0874","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"auth-test-model-0f0874-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:00:27.703Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-explicit-4ca09f","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-explicit-4ca09f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:00:39.281Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","Kuadrant","Limitador","TokenRateLimitPolicy","ConfigMap","AuthPolicy","HTTPRoute","EnvoyFilter","Gateway"],"eventTypes":{"create":12,"delete":15,"update":30}}
{"level":"info","ts":"2026-11-02T22:00:39.694Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:00:39.714Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T22:00:43.466Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T22:00:43.625Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T22:00:43.763Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:00:43.763Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T22:00:43.923Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:00:48.082Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:00:48.123Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:00:48.123Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:00:48.135Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T22:00:48.141Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:00:48.141Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-02T22:00:48.245Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:00:48.245Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T22:00:51.134Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T22:00:51.134Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T22:00:52.729Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway","EnvoyFilter"],"eventTypes":{"create":1,"delete":4}}
{"level":"info","ts":"2026-11-02T22:00:59.496Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:00:59.503Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T22:00:59.512Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:00:59.512Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T22:00:59.496Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:00:59.523Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-11-02T22:00:59.623Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:00:59.623Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T22:00:59.623Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/8eed28edac5e9e0ffe26c0daed06a5a76f7f4885bc1a2ca304571764b624fa51","error":"authconfigs.authorino.kuadrant.io \"8eed28edac5e9e0ffe26c0daed06a5a76f7f4885bc1a2ca304571764b624fa51\" not found"}
{"level":"error","ts":"2026-11-02T22:00:59.677Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/12213b92601a7d4224ba3b0655eea9815bfecc753c20f322108f549ff4451969","error":"authconfigs.authorino.kuadrant.io \"12213b92601a7d4224ba3b0655eea9815bfecc753c20f322108f549ff4451969\" not found"}
{"level":"error","ts":"2026-11-02T22:00:59.742Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/6d7a15a804e8eb8e558fa87ad4ab2bf37f9a057314f08ea906f96d0d9dfdb484","error":"authconfigs.authorino.kuadrant.io \"6d7a15a804e8eb8e558fa87ad4ab2bf37f9a057314f08ea906f96d0d9dfdb484\" not found"}
{"level":"error","ts":"2026-11-02T22:00:59.824Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/d07ccad2a17a578a39e022cd8d6a3001d23bbfcb08350322c127878d53782e8b","error":"authconfigs.authorino.kuadrant.io \"d07ccad2a17a578a39e022cd8d6a3001d23bbfcb08350322c127878d53782e8b\" not found"}
{"level":"error","ts":"2026-11-02T22:00:59.878Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/0792ee00f157f0af02ff26dfdb4834622c27b422320860bd98a0199b940bdcc8","error":"authconfigs.authorino.kuadrant.io \"0792ee00f157f0af02ff26dfdb4834622c27b422320860bd98a0199b940bdcc8\" not found"}
{"level":"error","ts":"2026-11-02T22:00:59.933Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/9c8ab96cfd8b1f4eee5233a6cb80537be2f626801dfc93e078e2bfb1b92c08bc","error":"authconfigs.authorino.kuadrant.io \"9c8ab96cfd8b1f4eee5233a6cb80537be2f626801dfc93e078e2bfb1b92c08bc\" not found"}
{"level":"error","ts":"2026-11-02T22:01:01.272Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-a-w3-97995b-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-a-w3-97995b-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:01:01.770Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-b-w0-0f0874-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-b-w0-0f0874-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:01:02.657Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T22:01:02.657Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T22:01:03.613Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-b-w4-58ca7f","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-shared-b-w4-58ca7f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:01:11.006Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthPolicy","Gateway","ConfigMap","TokenRateLimitPolicy","HTTPRoute","Limitador","AuthConfig"],"eventTypes":{"create":3,"delete":6,"update":7}}
{"level":"info","ts":"2026-11-02T22:01:11.375Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T22:01:14.165Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T22:01:14.341Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:01:14.341Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T22:01:18.856Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:01:18.858Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:01:18.866Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T22:01:18.869Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:01:18.926Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:01:18.926Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T22:01:19.087Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T22:01:22.776Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T22:01:22.776Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T22:01:31.377Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","AuthPolicy","TokenRateLimitPolicy","Limitador","EnvoyFilter","ConfigMap","HTTPRoute"],"eventTypes":{"create":12,"update":29}}
{"level":"info","ts":"2026-11-02T22:01:31.782Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T22:01:34.028Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T22:01:34.171Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:01:34.171Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T22:01:38.784Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:01:38.792Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:01:38.798Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:01:38.798Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T22:01:38.799Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-02T22:01:38.799Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T22:01:38.800Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:01:41.930Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T22:01:41.930Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T22:01:53.929Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","TokenRateLimitPolicy","AuthPolicy","Limitador","ConfigMap"],"eventTypes":{"update":43}}
{"level":"info","ts":"2026-11-02T22:01:54.280Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T22:01:56.543Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T22:01:56.764Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:01:56.764Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T22:02:01.547Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:02:01.551Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:02:01.558Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T22:02:01.564Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:02:01.571Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:02:01.571Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T22:02:01.712Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T22:02:04.895Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T22:02:04.895Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T22:02:06.487Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","HTTPRoute","Gateway"],"eventTypes":{"create":2,"delete":1,"update":2}}
{"level":"info","ts":"2026-11-02T22:02:14.026Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:02:14.036Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:02:14.045Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T22:02:14.061Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:02:14.061Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T22:02:14.063Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-11-02T22:02:14.149Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:02:14.149Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T22:02:14.157Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-a-w2-06e461/auth-test-model-06e461-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w2-06e461/auth-test-model-06e461-kserve-route#v1-chat-completions-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"9b3326c40973f3bae861a4301f060e6309ac1149cb391b2ce57bd775c94f8c94","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["9b3326c40973f3bae861a4301f060e6309ac1149cb391b2ce57bd775c94f8c94"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w2-06e461.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w2-06e461.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"9b3326c40973f3bae861a4301f060e6309ac1149cb391b2ce57bd775c94f8c94\" already exists"}
{"level":"error","ts":"2026-11-02T22:02:14.226Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-a-w2-06e461/auth-test-model-06e461-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w2-06e461/auth-test-model-06e461-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"376a7c0b362126d2df7b7d580d5c3cd5027f25fb8b56a9dbbe9e48660857dc0a","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["376a7c0b362126d2df7b7d580d5c3cd5027f25fb8b56a9dbbe9e48660857dc0a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w2-06e461.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w2-06e461.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"376a7c0b362126d2df7b7d580d5c3cd5027f25fb8b56a9dbbe9e48660857dc0a\" already exists"}
{"level":"error","ts":"2026-11-02T22:02:14.293Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-a-w2-06e461/auth-test-model-06e461-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w2-06e461/auth-test-model-06e461-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"a39b5e3422070c9db5e6c6cc30ae4c9eb9786da116b4b414de7ad8c0af6593a1","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a39b5e3422070c9db5e6c6cc30ae4c9eb9786da116b4b414de7ad8c0af6593a1"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w2-06e461.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w2-06e461.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"a39b5e3422070c9db5e6c6cc30ae4c9eb9786da116b4b414de7ad8c0af6593a1\" already exists"}
{"level":"error","ts":"2026-11-02T22:02:14.366Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-a-w2-06e461/auth-test-model-06e461-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w2-06e461/auth-test-model-06e461-kserve-route#v1-messages-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"68a6b0e714f4c962fdd6f870e2ce0522e8a0dad7d749f4212b8ebc8a5669988e","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["68a6b0e714f4c962fdd6f870e2ce0522e8a0dad7d749f4212b8ebc8a5669988e"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w2-06e461.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w2-06e461.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"68a6b0e714f4c962fdd6f870e2ce0522e8a0dad7d749f4212b8ebc8a5669988e\" already exists"}
{"level":"error","ts":"2026-11-02T22:02:14.434Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-a-w2-06e461/auth-test-model-06e461-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w2-06e461/auth-test-model-06e461-kserve-route#v1-completions-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"60ec2d78d907b7757451410076aebf7c05311c64398a9859346016520fa4fdb5","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["60ec2d78d907b7757451410076aebf7c05311c64398a9859346016520fa4fdb5"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w2-06e461.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w2-06e461.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"60ec2d78d907b7757451410076aebf7c05311c64398a9859346016520fa4fdb5\" already exists"}
{"level":"error","ts":"2026-11-02T22:02:14.509Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-a-w2-06e461/auth-test-model-06e461-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w2-06e461/auth-test-model-06e461-kserve-route#v1-messages-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"c1f395fe657de9926a17e2585660efe2122126d80c128be98e3caadff48b0d8b","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["c1f395fe657de9926a17e2585660efe2122126d80c128be98e3caadff48b0d8b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w2-06e461.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w2-06e461.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"c1f395fe657de9926a17e2585660efe2122126d80c128be98e3caadff48b0d8b\" already exists"}
{"level":"error","ts":"2026-11-02T22:02:14.581Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-a-w2-06e461/auth-test-model-06e461-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w2-06e461/auth-test-model-06e461-kserve-route#v1-model-routing"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"1d0d881a9dc71c6fee94329409cd94f4924596799c71b4e23e5b04e1e5322ec3","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["1d0d881a9dc71c6fee94329409cd94f4924596799c71b4e23e5b04e1e5322ec3"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w2-06e461.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w2-06e461.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"1d0d881a9dc71c6fee94329409cd94f4924596799c71b4e23e5b04e1e5322ec3\" already exists"}
{"level":"error","ts":"2026-11-02T22:02:14.723Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-a-w2-06e461/auth-test-model-06e461-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w2-06e461/auth-test-model-06e461-kserve-route#v1-catch-all-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"15c6b1eefed27150a7b7bdd1240715075bbd750a05cffb4b27f0e2e620e3ced7","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["15c6b1eefed27150a7b7bdd1240715075bbd750a05cffb4b27f0e2e620e3ced7"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w2-06e461.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w2-06e461.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"15c6b1eefed27150a7b7bdd1240715075bbd750a05cffb4b27f0e2e620e3ced7\" already exists"}
{"level":"error","ts":"2026-11-02T22:02:14.791Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-a-w2-06e461/auth-test-model-06e461-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w2-06e461/auth-test-model-06e461-kserve-route#v1-responses-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"be41fa1d3323b7258317f58eba852b7b1df727d18fc3ee5a8bc5ad9352718c96","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["be41fa1d3323b7258317f58eba852b7b1df727d18fc3ee5a8bc5ad9352718c96"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w2-06e461.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w2-06e461.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"be41fa1d3323b7258317f58eba852b7b1df727d18fc3ee5a8bc5ad9352718c96\" already exists"}
{"level":"error","ts":"2026-11-02T22:02:14.860Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-a-w2-06e461/auth-test-model-06e461-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w2-06e461/auth-test-model-06e461-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"0bdd85d0c5d72530296ec80e18137c67533d79207dd839bc21f06973780ff0f7","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["0bdd85d0c5d72530296ec80e18137c67533d79207dd839bc21f06973780ff0f7"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w2-06e461.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w2-06e461.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"0bdd85d0c5d72530296ec80e18137c67533d79207dd839bc21f06973780ff0f7\" already exists"}
{"level":"error","ts":"2026-11-02T22:02:14.972Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-shared-a-w0-6e535d","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T21:54:30Z","generation":2,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"bb413150-c71f-467a-b73c-fc346914ff7a\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:58:43Z"}],"name":"kuadrant-e2e-shared-a-w0-6e535d","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-a-w0-6e535d","uid":"bb413150-c71f-467a-b73c-fc346914ff7a"}],"resourceVersion":"88506","uid":"79ec4380-cbc0-4c66-b610-cdb28384077b"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c88daf14f697a484e9c4281c2194076dd57e1afe0e40819b6ea26599cb703e8b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__c10129e9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"b076166e39340a6f\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w0-6e535d/maas-trlp-auth-test-model-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__c10129e9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"b076166e39340a6f\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w0-6e535d/maas-trlp-auth-test-model-6e535d\"]}],\"name\":\"5d0e9408d69754c488902bd340f6b0a6f1864fac10f1f8e367ff40e50ae5ce01\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w0-6e535d/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c88daf14f697a484e9c4281c2194076dd57e1afe0e40819b6ea26599cb703e8b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__c10129e9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"b076166e39340a6f\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w0-6e535d/maas-trlp-auth-test-model-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__c10129e9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"b076166e39340a6f\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w0-6e535d/maas-trlp-auth-test-model-6e535d\"]}],\"name\":\"b076dfbfd5d7663e530e8a29a4789267e6429f59d51ebac8a69ff33b93f91f45\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w0-6e535d/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c88daf14f697a484e9c4281c2194076dd57e1afe0e40819b6ea26599cb703e8b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__c10129e9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"b076166e39340a6f\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w0-6e535d/maas-trlp-auth-test-model-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__c10129e9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"b076166e39340a6f\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w0-6e535d/maas-trlp-auth-test-model-6e535d\"]}],\"name\":\"da00003130e20f19532bdecff616a160b89d1e063f591c906554b89d0bb4263e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w0-6e535d/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c88daf14f697a484e9c4281c2194076dd57e1afe0e40819b6ea26599cb703e8b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__c10129e9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"b076166e39340a6f\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w0-6e535d/maas-trlp-auth-test-model-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__c10129e9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"b076166e39340a6f\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w0-6e535d/maas-trlp-auth-test-model-6e535d\"]}],\"name\":\"5b3fe1c533d5d79dd6aded892a6fe0d9d623fa4b1fb990ab35d2d88eac062a4c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w0-6e535d/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c88daf14f697a484e9c4281c2194076dd57e1afe0e40819b6ea26599cb703e8b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__c10129e9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"b076166e39340a6f\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w0-6e535d/maas-trlp-auth-test-model-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__c10129e9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"b076166e39340a6f\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w0-6e535d/maas-trlp-auth-test-model-6e535d\"]}],\"name\":\"250bc93087c31cc5a282a19ab15f80ee1861f55d7415d75e3025836a8a2e8c51\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w0-6e535d/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c88daf14f697a484e9c4281c2194076dd57e1afe0e40819b6ea26599cb703e8b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__c10129e9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"b076166e39340a6f\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w0-6e535d/maas-trlp-auth-test-model-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__c10129e9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"b076166e39340a6f\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w0-6e535d/maas-trlp-auth-test-model-6e535d\"]}],\"name\":\"bac9dc1d9dd43ed5dcbd51a5ae508efe4045bfb79f818a7f155d8f1fbef8acde\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w0-6e535d/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c88daf14f697a484e9c4281c2194076dd57e1afe0e40819b6ea26599cb703e8b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__c10129e9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"b076166e39340a6f\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w0-6e535d/maas-trlp-auth-test-model-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__c10129e9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"b076166e39340a6f\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w0-6e535d/maas-trlp-auth-test-model-6e535d\"]}],\"name\":\"54727fdd6fe954678377cabf073d49155df15982b405dc503c28a1a1a9fb6462\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w0-6e535d/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c88daf14f697a484e9c4281c2194076dd57e1afe0e40819b6ea26599cb703e8b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__c10129e9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"b076166e39340a6f\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w0-6e535d/maas-trlp-auth-test-model-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__c10129e9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"b076166e39340a6f\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w0-6e535d/maas-trlp-auth-test-model-6e535d\"]}],\"name\":\"fc810dd26a41e3e710c7c25ab1324c0430624820a9bfe8f128113df2c8a8e150\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w0-6e535d/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"376d56a711fbb2b29d7c46a8a0998936174b738443f0db294a13f85fd8478a94\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"3aa9e48facd88e18a7acef348feeaf654a1d4310d58727df558a9c5543ced772\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"22782c8aa7f396a4922a49f49140671294f2d19b32614fd09a7f9d26e94f5aa9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__c10129e9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"b076166e39340a6f\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w0-6e535d/maas-trlp-auth-test-model-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__c10129e9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"b076166e39340a6f\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w0-6e535d/maas-trlp-auth-test-model-6e535d\"]}],\"name\":\"c082a06d8a8f9278e6c1f845fca54a717a0293281a68b2c7bc7449a2e599733c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-a-w0-6e535d/models/facebook/opt-125m/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d82605cc2995db10d6c22eaf50ce1b24ce92305a4b1b2cf9ef796dc4a0e019f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__c10129e9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"b076166e39340a6f\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w0-6e535d/maas-trlp-auth-test-model-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__c10129e9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"b076166e39340a6f\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w0-6e535d/maas-trlp-auth-test-model-6e535d\"]}],\"name\":\"118d368999575d560f991f40640a453764e7c0b6268ed87505baec55580bd619\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-a-w0-6e535d/models/facebook/opt-125m/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"404142835a3977e1a9c2c43dac43764640a7632eade56ba3651c850858555e55\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__c10129e9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"b076166e39340a6f\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w0-6e535d/maas-trlp-auth-test-model-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__c10129e9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"b076166e39340a6f\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w0-6e535d/maas-trlp-auth-test-model-6e535d\"]}],\"name\":\"160b7ea1c7e8177306ef3c92ab8011b36af7fe1d3a7699455acbefab2e870174\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-a-w0-6e535d/models/facebook/opt-125m/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a7a0dc3cdf8fe8f61255465b2a28cb24f80d6467505607084b4be4b883494ef6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__c10129e9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"b076166e39340a6f\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w0-6e535d/maas-trlp-auth-test-model-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__c10129e9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"b076166e39340a6f\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w0-6e535d/maas-trlp-auth-test-model-6e535d\"]}],\"name\":\"f6c097cc138c92b1b467164e77ec3a1f2f6e8e07441cdd0df65ae38065ae2698\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-a-w0-6e535d/models/facebook/opt-125m/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"17286683a6178785a8017d68de67b058e3a1963e7ba7f06b1101054db0cebfb1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__c10129e9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"b076166e39340a6f\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w0-6e535d/maas-trlp-auth-test-model-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__c10129e9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"b076166e39340a6f\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w0-6e535d/maas-trlp-auth-test-model-6e535d\"]}],\"name\":\"e72329ef02d0afc0ab8652712a5954a5037a4a5eb0b766375a86ff513eb92c07\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"570e5848a361e3c9dd1e04eedfa2b9e8bd67123ca48082b249c1e62ddac6aa45\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__c10129e9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"b076166e39340a6f\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w0-6e535d/maas-trlp-auth-test-model-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__c10129e9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"b076166e39340a6f\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w0-6e535d/maas-trlp-auth-test-model-6e535d\"]}],\"name\":\"639c799e4de16c75644b4448049c991d6072805f0202a39c30f55e37d08ab1f4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"488fa6498257bae79da02565203c68726b20b3ff1190dd0f76f1d15f3016b91c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__c10129e9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"b076166e39340a6f\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w0-6e535d/maas-trlp-auth-test-model-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__c10129e9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"b076166e39340a6f\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w0-6e535d/maas-trlp-auth-test-model-6e535d\"]}],\"name\":\"f7d599fbb9563d1af06dc7949981399a5ce6e0411dea789e86b236b300ec5a00\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e7b7d686afb3e980f4fa7e5e90b69836684133b1852ad79e11efb71a5156e402\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__c10129e9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"b076166e39340a6f\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w0-6e535d/maas-trlp-auth-test-model-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__c10129e9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"b076166e39340a6f\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w0-6e535d/maas-trlp-auth-test-model-6e535d\"]}],\"name\":\"a61a55c32a9a90b21b2be93f5deae56314af3c4c247f64ec034990e3224b05c2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-a-w0-6e535d/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"45c0e8af5bd103871f78f35176ade26570f4cd362b56658e846eb717266590b0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__c10129e9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"b076166e39340a6f\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w0-6e535d/maas-trlp-auth-test-model-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__c10129e9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"b076166e39340a6f\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w0-6e535d/maas-trlp-auth-test-model-6e535d\"]}],\"name\":\"46a2bba503f657cce3aaa7181591c9cf2a233ab3641309c5709bdfc1462466ac\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2ebd46ffb051e67477198ab6753e8d28c9a38e121382759fb2d52a04e59f9b60\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__c10129e9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"b076166e39340a6f\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w0-6e535d/maas-trlp-auth-test-model-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__c10129e9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"b076166e39340a6f\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w0-6e535d/maas-trlp-auth-test-model-6e535d\"]}],\"name\":\"58ceed85289173525de25d7f2a84abcfca5c0fecd2525ef3063338d7a23601a7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"65ad30c331bd08b64f99c2bfc9d23db3979d37b9d3b916cb76d08a0dfabf963a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"4593350858282f0ebeaf11b57850d5bccfa270a4b6088784a058e2d70b5cbe7c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"71e8c9bf81b77581f96b1cca4bb909b8434efbbb06bf9c9ec1aa5c8f412b9c76\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"01c09092684d0d3ed9db0ad6f53595f8d2c97286804d29e76075f2c30f05f44e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c3ead856f0c0807270869b6a467d9281b93eaaa8c65e788c4b6393073db2cbe8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"7d0e9eabd4ff8a0b65212f3d03a7b14a1e695503c8c41fb7cd6e844984ba7c69\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8b7e784474461510a9d9970d39fe03c297fc6f9a5f80873c40898bdfcb389e5f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"3cb722466e22fc9e58ad8f75bb3dbd6e1d2f9d75c3cfaafc5c6350857d59f964\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7482755e6f782100b8480fa82045aac768a6400e192241b0d0cf93403dad8edb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"af29fffcd438904723a318f8c7cd8dbe79f55578faf5560452874252825fdf46\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c8ebd64b293ad7c614b7021be06db91b0e0b0afb406d42f6c2500255bf064935\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__c10129e9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"b076166e39340a6f\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w0-6e535d/maas-trlp-auth-test-model-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__c10129e9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"b076166e39340a6f\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w0-6e535d/maas-trlp-auth-test-model-6e535d\"]}],\"name\":\"e00a02f312942a27da8eda94534fbd032cea948dcae834521b0d6ce91553a090\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w0-6e535d/models/facebook/opt-125m')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-shared-a-w0-6e535d"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-shared-a-w0-6e535d\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:02:14.978Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-a-w2-06e461/auth-test-model-06e461-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w2-06e461/auth-test-model-06e461-kserve-route#v1-completions-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"782fff9577e2fa4f490d8cd7dd45f05e73a58ab6d5932bb26b584692ad58aa58","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["782fff9577e2fa4f490d8cd7dd45f05e73a58ab6d5932bb26b584692ad58aa58"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w2-06e461.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w2-06e461.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"782fff9577e2fa4f490d8cd7dd45f05e73a58ab6d5932bb26b584692ad58aa58\" already exists"}
{"level":"error","ts":"2026-11-02T22:02:15.049Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-a-w2-06e461/auth-test-model-06e461-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w2-06e461/auth-test-model-06e461-kserve-route#v1-responses-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"1eaa4e55e51f69196534f42bdab14aeaa07561fd434ded5d363589ea3c382138","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["1eaa4e55e51f69196534f42bdab14aeaa07561fd434ded5d363589ea3c382138"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w2-06e461.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w2-06e461.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"1eaa4e55e51f69196534f42bdab14aeaa07561fd434ded5d363589ea3c382138\" already exists"}
{"level":"error","ts":"2026-11-02T22:02:15.452Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-shared-a-w2-06e461","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T21:57:02Z","generation":1,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"d2c5712f-dd0e-4053-9a1f-54cc2f9da146\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:57:02Z"}],"name":"kuadrant-e2e-shared-a-w2-06e461","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-a-w2-06e461","uid":"d2c5712f-dd0e-4053-9a1f-54cc2f9da146"}],"resourceVersion":"86285","uid":"1ac11796-f745-4493-904e-fe4a3aaa4896"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1d0d881a9dc71c6fee94329409cd94f4924596799c71b4e23e5b04e1e5322ec3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w2-06e461-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__19a73354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w2-06e461/auth-test-model-06e461-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-06e461\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__19a73354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w2-06e461/auth-test-model-06e461-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-06e461\"]}],\"name\":\"4b72a14384787ce42bbdb3397f0c8908ab157eb43a451890a52fd0e70ed9416d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w2-06e461/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1d0d881a9dc71c6fee94329409cd94f4924596799c71b4e23e5b04e1e5322ec3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w2-06e461-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__19a73354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w2-06e461/auth-test-model-06e461-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-06e461\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__19a73354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w2-06e461/auth-test-model-06e461-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-06e461\"]}],\"name\":\"0893c8c867206c9db60fb50d31d82a4ce8cf87cfa5c0713df9b4a0beb484b879\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w2-06e461/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1d0d881a9dc71c6fee94329409cd94f4924596799c71b4e23e5b04e1e5322ec3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w2-06e461-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__19a73354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w2-06e461/auth-test-model-06e461-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-06e461\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__19a73354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w2-06e461/auth-test-model-06e461-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-06e461\"]}],\"name\":\"4efdace80dd4245a60bcc520b7baa4c071d673ef2f17cb2cdaebf4d4145cb032\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w2-06e461/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1d0d881a9dc71c6fee94329409cd94f4924596799c71b4e23e5b04e1e5322ec3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w2-06e461-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__19a73354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w2-06e461/auth-test-model-06e461-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-06e461\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__19a73354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w2-06e461/auth-test-model-06e461-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-06e461\"]}],\"name\":\"2a654de5a28c46b2f0446f9c849f8046c15840338e553a94a7702dac16117e07\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w2-06e461/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1d0d881a9dc71c6fee94329409cd94f4924596799c71b4e23e5b04e1e5322ec3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w2-06e461-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__19a73354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w2-06e461/auth-test-model-06e461-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-06e461\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__19a73354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w2-06e461/auth-test-model-06e461-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-06e461\"]}],\"name\":\"148cb15e792a508de2f2c99861b4828b6ddbbc145c5dc7299ac2fa7e916f0c78\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w2-06e461/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1d0d881a9dc71c6fee94329409cd94f4924596799c71b4e23e5b04e1e5322ec3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w2-06e461-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__19a73354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w2-06e461/auth-test-model-06e461-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-06e461\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__19a73354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w2-06e461/auth-test-model-06e461-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-06e461\"]}],\"name\":\"a19a39e58ed6567a7c4c369e2a4c76d2a59182fd515e8154a0ceda0f7497587d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w2-06e461/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1d0d881a9dc71c6fee94329409cd94f4924596799c71b4e23e5b04e1e5322ec3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w2-06e461-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__19a73354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w2-06e461/auth-test-model-06e461-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-06e461\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__19a73354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w2-06e461/auth-test-model-06e461-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-06e461\"]}],\"name\":\"6e042ebed667f120a76a7bf6fed77b246a516678ca592f8ae9299f9511c1ed4d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w2-06e461/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1d0d881a9dc71c6fee94329409cd94f4924596799c71b4e23e5b04e1e5322ec3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w2-06e461-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__19a73354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w2-06e461/auth-test-model-06e461-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-06e461\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__19a73354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w2-06e461/auth-test-model-06e461-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-06e461\"]}],\"name\":\"067781d7da77618988ca2d3fa6f94d19448da30e1e2b3106de621bf50ce8971f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w2-06e461/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d385206b1115a96c9f0147bd3800677310b659b18edb542eabe78e9dcf3d5903\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w2-06e461-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__19a73354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-06e461\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-06e461\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__19a73354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-06e461\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-06e461\"]}],\"name\":\"b549b8e82700c4f9440c76e2e87986ec39a088e7107894713b59cde4495a76e2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a39b5e3422070c9db5e6c6cc30ae4c9eb9786da116b4b414de7ad8c0af6593a1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w2-06e461-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__19a73354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w2-06e461/auth-test-model-06e461-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-06e461\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__19a73354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w2-06e461/auth-test-model-06e461-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-06e461\"]}],\"name\":\"9e20069297cdba5c17af486644f4ec17b1af5192ade5320e55da53cc8bf2bbfc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-a-w2-06e461/models/facebook/opt-125m/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"782fff9577e2fa4f490d8cd7dd45f05e73a58ab6d5932bb26b584692ad58aa58\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w2-06e461-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__19a73354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w2-06e461/auth-test-model-06e461-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-06e461\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__19a73354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w2-06e461/auth-test-model-06e461-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-06e461\"]}],\"name\":\"2864b33458a8e795ef579c553fc05f5d78e230158d1cafb6a095b19b6f37319f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-a-w2-06e461/models/facebook/opt-125m/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"be41fa1d3323b7258317f58eba852b7b1df727d18fc3ee5a8bc5ad9352718c96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w2-06e461-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__19a73354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w2-06e461/auth-test-model-06e461-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-06e461\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__19a73354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w2-06e461/auth-test-model-06e461-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-06e461\"]}],\"name\":\"ad23deb2b16da790bc99a052b6ff39788638f13cc6eea05bd9c0d5c83806dbbe\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-a-w2-06e461/models/facebook/opt-125m/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"68a6b0e714f4c962fdd6f870e2ce0522e8a0dad7d749f4212b8ebc8a5669988e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w2-06e461-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__19a73354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w2-06e461/auth-test-model-06e461-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-06e461\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__19a73354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w2-06e461/auth-test-model-06e461-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-06e461\"]}],\"name\":\"cbb3c603c6a9268d1bb73b241aeb74c1bf085a825524d8db1365fc7ec7576dc3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-a-w2-06e461/models/facebook/opt-125m/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9b3326c40973f3bae861a4301f060e6309ac1149cb391b2ce57bd775c94f8c94\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w2-06e461-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__19a73354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w2-06e461/auth-test-model-06e461-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-06e461\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__19a73354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w2-06e461/auth-test-model-06e461-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-06e461\"]}],\"name\":\"d0dead90edad39261c151fd282c670cc9b32160c76355296022c8292b9036562\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-a-w2-06e461/auth-test-model-06e461/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"60ec2d78d907b7757451410076aebf7c05311c64398a9859346016520fa4fdb5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w2-06e461-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__19a73354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w2-06e461/auth-test-model-06e461-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-06e461\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__19a73354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w2-06e461/auth-test-model-06e461-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-06e461\"]}],\"name\":\"c6774caa22c02fcc35ad20ab466986d33da7b174bfe4877b6ff9190165483bd1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-a-w2-06e461/auth-test-model-06e461/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1eaa4e55e51f69196534f42bdab14aeaa07561fd434ded5d363589ea3c382138\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w2-06e461-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__19a73354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w2-06e461/auth-test-model-06e461-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-06e461\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__19a73354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w2-06e461/auth-test-model-06e461-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-06e461\"]}],\"name\":\"73136e8d77005a92c65c9462f3590c53159359206c674218c3fcfffb7f4c825e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-a-w2-06e461/auth-test-model-06e461/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0bdd85d0c5d72530296ec80e18137c67533d79207dd839bc21f06973780ff0f7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w2-06e461-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__19a73354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w2-06e461/auth-test-model-06e461-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-06e461\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__19a73354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w2-06e461/auth-test-model-06e461-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-06e461\"]}],\"name\":\"cf7de2a79c1e6787585fd8a3cc44ca6f8f06acd5a7f3d435433779f40351716c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-a-w2-06e461/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c1f395fe657de9926a17e2585660efe2122126d80c128be98e3caadff48b0d8b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w2-06e461-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__19a73354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w2-06e461/auth-test-model-06e461-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-06e461\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__19a73354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w2-06e461/auth-test-model-06e461-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-06e461\"]}],\"name\":\"e852a012e6b77b87b0a674e1fbfaf041dc3118cb02ac50c97bbe72f83d721ea2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-a-w2-06e461/auth-test-model-06e461/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"15c6b1eefed27150a7b7bdd1240715075bbd750a05cffb4b27f0e2e620e3ced7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w2-06e461-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__19a73354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w2-06e461/auth-test-model-06e461-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-06e461\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__19a73354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w2-06e461/auth-test-model-06e461-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-06e461\"]}],\"name\":\"b770d6f2065ef0b775a394d51db6cdfca865904c1e559fa096334dbb5430fcb9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-a-w2-06e461/auth-test-model-06e461')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3c9315326fe75b44d6f5e3c7cd9fac13abf4b1a9918698589b0faa0c42deeb08\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w2-06e461-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__19a73354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-06e461\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-06e461\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__19a73354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-06e461\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-06e461\"]}],\"name\":\"479365efca2e3b90f48cc446d43f713f2be6711d43c072384287f8744152c4ac\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5257a14d8fc9908d3b52cf96fc5c9a6cd32b6940ef72c0e96cba23b3ded3d1b4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w2-06e461-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__19a73354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-06e461\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-06e461\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__19a73354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-06e461\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-06e461\"]}],\"name\":\"5ab05e09b5086d58bc3ba357893103478807d6be035c97b1dfa823c5c9b6d62d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"33019b54557cbd49426d4158e18ab3a88d235b9f20f792586c271053788a54a8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w2-06e461-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__19a73354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-06e461\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-06e461\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__19a73354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-06e461\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-06e461\"]}],\"name\":\"71b4675439e02b53cfb6ef6df9336acea0a91b623222cb67411d492fdda99858\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2ed83c23a8290f3646a543920910524ccfc2baad0ca9fb2e965cb8bd4f0fbf83\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w2-06e461-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__19a73354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-06e461\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-06e461\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__19a73354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-06e461\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-06e461\"]}],\"name\":\"328152874d79d022e9a61088d93d937d2ebf6d33b715fdcdae40b206cc472cb5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f1500aad848242a78004ce946110822a45e41d3c4e8b411396c76761e740aa13\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w2-06e461-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__19a73354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-06e461\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-06e461\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__19a73354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-06e461\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-06e461\"]}],\"name\":\"bae0bb257f438d171a6a8fd83d7ffa1f9ec9c7b6dcd238460f21f5c9b5fe8942\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"376a7c0b362126d2df7b7d580d5c3cd5027f25fb8b56a9dbbe9e48660857dc0a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w2-06e461-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__19a73354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w2-06e461/auth-test-model-06e461-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-06e461\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__19a73354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w2-06e461/auth-test-model-06e461-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-06e461\"]}],\"name\":\"5aa7de7479605d3b0cc2c5f48336c095c28a8662caf3aef4145eb171a8749481\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w2-06e461/models/facebook/opt-125m')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-shared-a-w2-06e461"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-shared-a-w2-06e461\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:02:15.746Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w4-d6cb38","namespace":"e2e-models-e2e-worker-w4-d6cb38","uid":"486176e6-7786-40c4-9ce0-6f4a68b408b2","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w4-d6cb38\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:02:15.804Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-a-w2-06e461","namespace":"openshift-ingress","uid":"c459fc7a-4e41-4226-a9ad-15cf3c29611a","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-a-w2-06e461\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:02:15.871Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-b-w0-0f0874-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-b-w0-0f0874-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:02:15.924Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w1-5f765a","namespace":"e2e-models-e2e-worker-w1-5f765a","uid":"7188eadc-9748-4be8-a5e2-d904cf5b6130","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w1-5f765a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:02:15.936Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-a-w4-7cde84-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-a-w4-7cde84-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:02:15.984Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w4-d6cb38","namespace":"e2e-models-e2e-worker-w4-d6cb38","uid":"0d3ebd35-5005-4ee4-a055-ff95546e3673","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w4-d6cb38\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:02:16.043Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-b-w4-58ca7f","namespace":"openshift-ingress","uid":"5187151d-dfe9-40c2-b03b-5e9a20a0d12c","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-b-w4-58ca7f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:02:16.102Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-auth-test-model-6e535d","namespace":"ai-tenant-e2e-shared-a-w0-6e535d","uid":"f439f74c-b4cf-45c7-af58-08943001ea03","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-auth-test-model-6e535d\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:02:16.161Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w1-5f765a","namespace":"e2e-models-e2e-worker-w1-5f765a","uid":"9c852546-ee7c-4e72-855c-111315f7bf82","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w1-5f765a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:02:16.215Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-b-w3-a1d751-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-b-w3-a1d751-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:02:16.280Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-b-w2-c7e71f","namespace":"openshift-ingress","uid":"6decd2e5-6aa1-451b-97e5-5dd8911def76","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-b-w2-c7e71f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:02:16.339Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-b-w3-a1d751","namespace":"openshift-ingress","uid":"2c7a0593-2f35-427a-b6f0-958582546c18","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-b-w3-a1d751\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:02:16.350Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-a-w2-06e461-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-a-w2-06e461-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:02:16.397Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-simulated-simulated-premium","namespace":"llm","uid":"447993be-3c57-4e68-8ffa-6fc998a39c77","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-simulated-simulated-premium\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:02:16.459Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-auth-test-model-97995b","namespace":"ai-tenant-e2e-shared-a-w3-97995b","uid":"03decddc-dd10-43ac-812e-6a05afbab992","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-auth-test-model-97995b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:02:16.579Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w3-f51151","namespace":"e2e-models-e2e-worker-w3-f51151","uid":"e3340067-224a-43ad-8020-ca9e00ead152","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w3-f51151\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:02:16.637Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w2-6fa533","namespace":"e2e-models-e2e-worker-w2-6fa533","uid":"2ff73667-c2c3-4579-9503-b6ca098f1021","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w2-6fa533\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:02:16.696Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w0-0c9014","namespace":"e2e-models-e2e-worker-w0-0c9014","uid":"dcb5a0e4-7049-4ddc-91de-e14d55b09789","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w0-0c9014\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:02:16.814Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w2-6fa533","namespace":"e2e-models-e2e-worker-w2-6fa533","uid":"3a128bb2-de88-49aa-ab9e-c8626107a077","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w2-6fa533\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:02:16.933Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-b-w0-0f0874","namespace":"openshift-ingress","uid":"8b4ec7cb-daa9-467a-b2f6-528aa3d837fc","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-b-w0-0f0874\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:02:16.992Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w0-0c9014","namespace":"e2e-models-e2e-worker-w0-0c9014","uid":"4f647df6-1d5b-433b-b4fc-1279ff1755f7","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w0-0c9014\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:02:17.052Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-facebook-opt-125m-simulated","namespace":"llm","uid":"da8edb1a-ed61-454d-939f-fc7cd235d9fb","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-facebook-opt-125m-simulated\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:02:17.111Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-a-w4-7cde84","namespace":"openshift-ingress","uid":"83e46bfa-f121-4136-adc9-a9e6690edeab","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-a-w4-7cde84\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:02:17.289Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w3-f51151","namespace":"e2e-models-e2e-worker-w3-f51151","uid":"c78aa03a-e3ca-4797-8a09-ab0d9cd88148","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w3-f51151\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:02:17.347Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-a-w0-6e535d","namespace":"openshift-ingress","uid":"0eae774a-4032-4461-b2be-6f3edd911a80","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-a-w0-6e535d\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:02:17.347Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T22:02:17.347Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T22:02:17.731Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"auth-test-model-06e461-kserve-route","namespace":"ai-tenant-e2e-shared-a-w2-06e461","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"auth-test-model-06e461-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:02:17.841Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"auth-test-model-6e535d-kserve-route","namespace":"ai-tenant-e2e-shared-a-w0-6e535d","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"auth-test-model-6e535d-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:02:26.111Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","AuthConfig","AuthPolicy","HTTPRoute","EnvoyFilter","Limitador","ConfigMap"],"eventTypes":{"create":13,"delete":1,"update":31}}
{"level":"info","ts":"2026-11-02T22:02:26.452Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T22:02:29.063Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T22:02:29.239Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:02:29.239Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T22:02:33.656Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:02:33.658Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:02:33.672Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T22:02:33.738Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:02:33.752Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:02:33.752Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-02T22:02:33.877Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:02:33.877Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T22:02:38.231Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T22:02:38.232Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T22:02:43.219Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","TokenRateLimitPolicy","AuthPolicy","EnvoyFilter","Limitador","ConfigMap","HTTPRoute","Gateway"],"eventTypes":{"create":1,"update":45}}
{"level":"info","ts":"2026-11-02T22:02:43.469Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T22:02:46.347Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T22:02:46.524Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:02:46.524Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T22:02:51.271Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:02:51.345Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:02:51.345Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T22:02:51.280Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:02:51.371Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:02:51.464Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T22:02:51.638Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T22:02:54.229Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-auth-test-model-97995b","namespace":"ai-tenant-e2e-shared-a-w3-97995b","uid":"03decddc-dd10-43ac-812e-6a05afbab992","error":"tokenratelimitpolicies.kuadrant.io \"maas-trlp-auth-test-model-97995b\" not found"}
{"level":"info","ts":"2026-11-02T22:02:54.646Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T22:02:54.646Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T22:03:03.368Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Limitador","AuthPolicy","ConfigMap","TokenRateLimitPolicy"],"eventTypes":{"delete":1,"update":4}}
{"level":"info","ts":"2026-11-02T22:03:03.773Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T22:03:06.137Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T22:03:06.324Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:03:06.324Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T22:03:10.849Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:03:10.863Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:03:10.863Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T22:03:10.864Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:03:10.865Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:03:10.871Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"error","ts":"2026-11-02T22:03:11.045Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:03:11.045Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T22:03:13.676Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-auth-test-model-a1d751","namespace":"ai-tenant-e2e-shared-b-w3-a1d751","uid":"70e59f4f-bd0f-4f91-9f49-b3d000214930","error":"tokenratelimitpolicies.kuadrant.io \"maas-trlp-auth-test-model-a1d751\" not found"}
{"level":"error","ts":"2026-11-02T22:03:13.682Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-b-w3-a1d751-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-b-w3-a1d751-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:03:13.825Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-a-w3-97995b-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-a-w3-97995b-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:03:14.522Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T22:03:14.522Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T22:03:15.240Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-a-w3-97995b","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-shared-a-w3-97995b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:03:15.292Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"auth-test-model-97995b-kserve-route","namespace":"ai-tenant-e2e-shared-a-w3-97995b","error":"httproutes.gateway.networking.k8s.io \"auth-test-model-97995b-kserve-route\" not found"}
{"level":"info","ts":"2026-11-02T22:03:16.164Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy"],"eventTypes":{"create":1}}
{"level":"info","ts":"2026-11-02T22:03:22.892Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:03:22.900Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T22:03:22.908Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:03:22.908Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-02T22:03:23.042Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:03:23.042Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T22:03:24.058Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-shared-a-w3-97995b","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T21:54:08Z","generation":3,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"b9ce997b-e593-4e5a-96e1-266d4780e128\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:01:19Z"}],"name":"kuadrant-e2e-shared-a-w3-97995b","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-a-w3-97995b","uid":"b9ce997b-e593-4e5a-96e1-266d4780e128"}],"resourceVersion":"92757","uid":"657ba0c9-d22d-4183-a7c2-c392b8af6143"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2ff4aaca3e39fd0a84ca9db8e0eefa9d4367e60ed5bd4187e89ae045c89adfbb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-97995b-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/auth-test-model-97995b-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/auth-test-model-97995b-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]}],\"name\":\"3b4f641f313327e70c026d03a3538e77b043e80adf7a0b9f0d3fd765fb7dff05\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w3-97995b/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2ff4aaca3e39fd0a84ca9db8e0eefa9d4367e60ed5bd4187e89ae045c89adfbb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-97995b-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/auth-test-model-97995b-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/auth-test-model-97995b-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]}],\"name\":\"c472bbd689dd9906ff4a581554a7915755c620df2d4d77f70d1402dc4cf58533\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w3-97995b/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2ff4aaca3e39fd0a84ca9db8e0eefa9d4367e60ed5bd4187e89ae045c89adfbb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-97995b-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/auth-test-model-97995b-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/auth-test-model-97995b-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]}],\"name\":\"9493ae8c5899d2a482c557785dbcfdb83a3899cad7489af831262e13532e6f74\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w3-97995b/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2ff4aaca3e39fd0a84ca9db8e0eefa9d4367e60ed5bd4187e89ae045c89adfbb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-97995b-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/auth-test-model-97995b-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/auth-test-model-97995b-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]}],\"name\":\"e680f17c3f47e5dc1efeb46396fa1d39324f4f379bd5bdf5f30d235dd5d3fb81\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w3-97995b/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2ff4aaca3e39fd0a84ca9db8e0eefa9d4367e60ed5bd4187e89ae045c89adfbb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-97995b-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/auth-test-model-97995b-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/auth-test-model-97995b-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]}],\"name\":\"4f5904c60a146754809c5a1e08c8793b707ac403ee9aed9ef964b9fe67923086\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w3-97995b/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2ff4aaca3e39fd0a84ca9db8e0eefa9d4367e60ed5bd4187e89ae045c89adfbb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-97995b-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/auth-test-model-97995b-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/auth-test-model-97995b-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]}],\"name\":\"cf5c914c32dcd3dae3946fa2ea21eabacb05064cba35d302a9cfe6c896af4f83\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w3-97995b/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2ff4aaca3e39fd0a84ca9db8e0eefa9d4367e60ed5bd4187e89ae045c89adfbb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-97995b-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/auth-test-model-97995b-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/auth-test-model-97995b-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]}],\"name\":\"fe7436ebb3a1ddbb556fab6a62353ec293ad1506da0bdd60ca723dfcb74c8515\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w3-97995b/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2ff4aaca3e39fd0a84ca9db8e0eefa9d4367e60ed5bd4187e89ae045c89adfbb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-97995b-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/auth-test-model-97995b-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/auth-test-model-97995b-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]}],\"name\":\"75b57f1f75619fc25dff56e40a89c79e097e2c4e0b1a56dfe294e5a57d0348c5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w3-97995b/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"feca5257a3a136afa9ca4bb6226e83b9e72a014fd57c59db758c454f118180b2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-97995b-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-97995b\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-97995b\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]}],\"name\":\"697447b051af365a79e3fa7acf7f1f6f64b9bd844855783e0433ae28eb9de042\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"435c1572ef09e42cae0e34b4ee56603b1f6f5cc3dde7b532e7c0dab1aeca1299\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-97995b-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/auth-test-model-97995b-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/auth-test-model-97995b-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]}],\"name\":\"130e649f667f3e4fa9f1437b5edf2ab8e106b6cf5bf0cb28677999402de72215\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-a-w3-97995b/models/facebook/opt-125m/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"db5b542eac4f151cd78fef497800374a070c51f4872ca44557847c1be70dd14c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-97995b-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/auth-test-model-97995b-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/auth-test-model-97995b-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]}],\"name\":\"cc3da57c8323ff58dba03e35aa5b77b78a208c1749563ada994a236d0422cc88\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-a-w3-97995b/models/facebook/opt-125m/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3c4a94a653303d191934e4a5d5f546c8aec93cc70258197c790fd18796b337fb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-97995b-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/auth-test-model-97995b-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/auth-test-model-97995b-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]}],\"name\":\"4668921bf6920f36e4ea5cff34939c1f2a9eebe0ca8e897d0b206db6d0543687\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-a-w3-97995b/models/facebook/opt-125m/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"987d2d277080ec70256da8bc2596c9b4a6f0b1d33eecb2547c818f1fce464fd9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-97995b-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/auth-test-model-97995b-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/auth-test-model-97995b-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]}],\"name\":\"e33a9e80f8c0784bcff3997512ac7461f8d3b77a2cb6be3f08ac713b4a1f98e6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-a-w3-97995b/models/facebook/opt-125m/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cdb9e2097a960951089e8bf406b69027223f661835df0854c973f5c378796c27\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-97995b-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/auth-test-model-97995b-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/auth-test-model-97995b-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]}],\"name\":\"a547c51541e943da54b479f6fe2f4ca6b0938f0dc2233029865f0d5ca5f27088\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-a-w3-97995b/auth-test-model-97995b/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"79b917dbd65d1863778bb874d9ec325d6f65ebf5b0aaa7598aac106ed07a453d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-97995b-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/auth-test-model-97995b-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/auth-test-model-97995b-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]}],\"name\":\"158fc41bf635d9e6a14207bec9695b9a903a745ae4b7572b19b7803becaa9a05\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-a-w3-97995b/auth-test-model-97995b/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7b3e638d702f81dbe5422c9319fdf7559c1f0306f12885108923c7ec63b7b6b8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-97995b-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/auth-test-model-97995b-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/auth-test-model-97995b-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]}],\"name\":\"9a89589fec98fd0b082d19e475fad48dbc334e1d4b5907bd0c2f6adab3bdd4ae\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-a-w3-97995b/auth-test-model-97995b/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"45d944066c06db97baf90c68e80caad343e1a9bb057998700c80ee7af4d35061\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-97995b-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/auth-test-model-97995b-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/auth-test-model-97995b-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]}],\"name\":\"55b0e10bb9376c39bff338db84459875062922bc15a870891043322ab766fcd0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-a-w3-97995b/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ddce824d6c6ab28c0eb965153db4af0b62a2269e2617650031db73be6ccc595f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-97995b-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/auth-test-model-97995b-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/auth-test-model-97995b-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]}],\"name\":\"86499fd04b38087aa9858296e28ec67a032e68e6c28bc20c3efd3528ed463b0a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-a-w3-97995b/auth-test-model-97995b/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c6837618504ea99c86d1aeac9197ce9683beb55d02369bdf4badae5904f9ddb5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-97995b-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/auth-test-model-97995b-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/auth-test-model-97995b-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]}],\"name\":\"e600a8514ec1ab6b0c1a680867ef72325bec122658e7e9d5eade2586ed2be374\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-a-w3-97995b/auth-test-model-97995b')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"64610b2b1b14c01fb91d85773d211a6d8b173cb847914d22204a29dbf00c051b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-97995b-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-97995b\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-97995b\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]}],\"name\":\"ab3f8e403d48e2edf0d20cf1af9316112053ce238e3ab9db5309e4506ca81358\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7acb8a78dba64f5ca2cb229b1a6a6e5100dfd1fe0185742cdf2493f937286eba\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-97995b-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-97995b\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-97995b\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]}],\"name\":\"277f6eb1de4fbfe33e49087e7995e2fc70745c603dfb4e7bd0387ba87a05fa73\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"abffb2b80b2e83749e48ad9bc9e2b132b4526ff5c2ddee7e3c63dcaac739cb58\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-97995b-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-97995b\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-97995b\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]}],\"name\":\"9fc807dc86717cc414f321c16b0d44d999a6c047d0871e8e85085f494ab58344\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"861bd69371a3568d3786b56a91d3af9c85fd73ef3e549606a38eed24c8a99b89\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-97995b-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-97995b\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-97995b\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]}],\"name\":\"1abcc31fbef3280fc20850d49e96774344d45c72d9af2ad2be2a524b9041e48d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6de91d16ed05414ab83195af7a0e61dc3b464cde05b3f5b5c1cb41079af7d577\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-97995b-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-97995b\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-97995b\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]}],\"name\":\"4a5b0c3ba4d080fdf6969433dffaaa078a2cac0527e231c6975641dbc9a0fa7c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"10b8f42a16887a86e724b99ff08a76a9db7b707586689c2a132d00eed5cb792c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-97995b-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/auth-test-model-97995b-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/auth-test-model-97995b-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]}],\"name\":\"7428640088eab13480310075a3aa22448c04264519380b6cc8b4ec3373bb3c7e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w3-97995b/models/facebook/opt-125m')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-shared-a-w3-97995b"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-shared-a-w3-97995b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:03:24.985Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-auth-test-model-a1d751","namespace":"ai-tenant-e2e-shared-b-w3-a1d751","uid":"70e59f4f-bd0f-4f91-9f49-b3d000214930","error":"tokenratelimitpolicies.kuadrant.io \"maas-trlp-auth-test-model-a1d751\" not found"}
{"level":"error","ts":"2026-11-02T22:03:25.043Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-auth-test-model-7cde84","namespace":"ai-tenant-e2e-shared-a-w4-7cde84","uid":"8c4e73ed-2cb7-41d5-9113-672336a9f382","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-auth-test-model-7cde84\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:03:26.004Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-a-w3-97995b","namespace":"openshift-ingress","uid":"9405e4ea-22ff-4c46-bbc0-f492e0e403dc","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-a-w3-97995b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:03:26.827Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-a-w3-97995b","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-shared-a-w3-97995b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:03:27.108Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"auth-test-model-7cde84-kserve-route","namespace":"ai-tenant-e2e-shared-a-w4-7cde84","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"auth-test-model-7cde84-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:03:27.201Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"auth-test-model-97995b-kserve-route","namespace":"ai-tenant-e2e-shared-a-w3-97995b","error":"httproutes.gateway.networking.k8s.io \"auth-test-model-97995b-kserve-route\" not found"}
{"level":"error","ts":"2026-11-02T22:03:27.480Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-b-w2-c7e71f","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-shared-b-w2-c7e71f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:03:35.118Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthPolicy","TokenRateLimitPolicy","ConfigMap","HTTPRoute","Gateway","EnvoyFilter","Limitador"],"eventTypes":{"create":2,"delete":3,"update":15}}
{"level":"info","ts":"2026-11-02T22:03:35.523Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T22:03:38.473Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T22:03:38.638Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:03:38.638Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T22:03:43.082Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:03:43.082Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:03:43.131Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T22:03:43.132Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:03:43.163Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:03:43.163Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T22:03:43.351Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T22:03:49.615Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T22:03:49.615Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T22:03:57Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-shared-a-w1-6689da","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-a-w1-6689da","reconcileID":"24ed4f3b-bf6c-4186-85e0-098fe9965d99","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-shared-a-w1-6689da","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T22:03:57Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-a-w1-6689da","event":"CREATE"}
{"level":"info","ts":"2026-11-02T22:03:57Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T22:03:57Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-02T22:03:57Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-02T22:03:57Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T22:03:57Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-shared-a-w1-6689da","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-a-w1-6689da","reconcileID":"80e0b7b4-f318-4955-aabe-0e102763c481","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-shared-a-w1-6689da","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T22:03:57Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-a-w1-6689da","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T22:03:57Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T22:03:58Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-02T22:03:58Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-02T22:03:58Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-02T22:03:58Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T22:03:58Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-shared-a-w1-6689da","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-a-w1-6689da","reconcileID":"d25c34f1-2f01-422e-abbf-47112bf39f39","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-shared-a-w1-6689da","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T22:03:58Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-a-w1-6689da","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T22:03:58Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T22:03:58Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-02T22:03:58Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-02T22:03:58Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-02T22:03:58Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T22:04:01.445Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","AuthPolicy","TokenRateLimitPolicy","EnvoyFilter","Gateway","HTTPRoute","ConfigMap","Limitador"],"eventTypes":{"create":13,"delete":24,"update":46}}
{"level":"info","ts":"2026-11-02T22:04:01.795Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T22:04:04.737Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T22:04:04.875Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:04:04.875Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T22:04:09.468Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:04:09.523Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:04:09.531Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T22:04:09.546Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:04:09.547Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:04:09.547Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-02T22:04:09.642Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:04:09.642Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T22:04:12.508Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-auth-test-model-6e535d","namespace":"ai-tenant-e2e-shared-a-w0-6e535d","uid":"f439f74c-b4cf-45c7-af58-08943001ea03","error":"tokenratelimitpolicies.kuadrant.io \"maas-trlp-auth-test-model-6e535d\" not found"}
{"level":"info","ts":"2026-11-02T22:04:12.870Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T22:04:12.870Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T22:04:14.646Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","AuthPolicy","Gateway","HTTPRoute","Kuadrant"],"eventTypes":{"create":3,"update":2}}
{"level":"info","ts":"2026-11-02T22:04:14.903Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:04:14.923Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T22:04:18.854Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T22:04:18.868Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:04:19.035Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:04:19.035Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T22:04:19.056Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T22:04:23.682Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:04:23.735Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:04:23.735Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T22:04:23.736Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:04:23.736Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:04:23.744Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"error","ts":"2026-11-02T22:04:23.797Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-shared-a-w1-6689da","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"kuadrant-auth-e2e-shared-a-w1-6689da","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-a-w1-6689da","uid":"def49e9c-a5db-4c1d-9263-8f0b6e3fc6b6"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-auth-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local","port_value":50051}}}}]}]},"name":"kuadrant-auth-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-shared-a-w1-6689da"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-shared-a-w1-6689da\" already exists"}
{"level":"error","ts":"2026-11-02T22:04:23.823Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-shared-a-w1-6689da","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/ratelimit":"true"},"name":"kuadrant-ratelimiting-e2e-shared-a-w1-6689da","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-a-w1-6689da","uid":"def49e9c-a5db-4c1d-9263-8f0b6e3fc6b6"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"limitador-limitador.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-ratelimit-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"limitador-limitador.kuadrant-system.svc.cluster.local","port_value":8081}}}}]}]},"name":"kuadrant-ratelimit-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-shared-a-w1-6689da"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-shared-a-w1-6689da\" already exists"}
{"level":"error","ts":"2026-11-02T22:04:23.849Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:04:23.849Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T22:04:23.936Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w1-6689da","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w1-6689da#rule-5"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"b448f08c35cad10231a4caace1ef450ff8a77e5b20a28eee89d0c690d78dc63e","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["b448f08c35cad10231a4caace1ef450ff8a77e5b20a28eee89d0c690d78dc63e"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w1-6689da.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w1-6689da.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"b448f08c35cad10231a4caace1ef450ff8a77e5b20a28eee89d0c690d78dc63e\" already exists"}
{"level":"error","ts":"2026-11-02T22:04:24.024Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w1-6689da","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w1-6689da#rule-4"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"d8a51cee975cd9c0d9911ce8ea5ca2d06c5a66798ecb321ef52a246e99aba7bb","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d8a51cee975cd9c0d9911ce8ea5ca2d06c5a66798ecb321ef52a246e99aba7bb"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w1-6689da.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w1-6689da.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"d8a51cee975cd9c0d9911ce8ea5ca2d06c5a66798ecb321ef52a246e99aba7bb\" already exists"}
{"level":"error","ts":"2026-11-02T22:04:24.123Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w1-6689da","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w1-6689da#rule-3"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"67e5b24c3247b6535e48582dcd841c834bd22005b0954bf3ef3ec72658b5a352","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["67e5b24c3247b6535e48582dcd841c834bd22005b0954bf3ef3ec72658b5a352"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w1-6689da.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w1-6689da.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"67e5b24c3247b6535e48582dcd841c834bd22005b0954bf3ef3ec72658b5a352\" already exists"}
{"level":"error","ts":"2026-11-02T22:04:24.190Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w1-6689da","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w1-6689da#rule-1"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"9a8d103eb97e68d1cda1b42c44a3c03b0bb4d7aafa28f5f0d0f31ce70414e058","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["9a8d103eb97e68d1cda1b42c44a3c03b0bb4d7aafa28f5f0d0f31ce70414e058"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w1-6689da.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w1-6689da.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"9a8d103eb97e68d1cda1b42c44a3c03b0bb4d7aafa28f5f0d0f31ce70414e058\" already exists"}
{"level":"error","ts":"2026-11-02T22:04:24.256Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w1-6689da","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w1-6689da#rule-2"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"52f16f2579f0972b25c79646516d0b524ccd11f35bf97140e7a17004f04958a0","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["52f16f2579f0972b25c79646516d0b524ccd11f35bf97140e7a17004f04958a0"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w1-6689da.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w1-6689da.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"52f16f2579f0972b25c79646516d0b524ccd11f35bf97140e7a17004f04958a0\" already exists"}
{"level":"error","ts":"2026-11-02T22:04:24.336Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w1-6689da","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w1-6689da#rule-6"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"b006ad729b2188ace5faf61aa80663fc9bd84c64954016fcca1b3119504d80ef","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["b006ad729b2188ace5faf61aa80663fc9bd84c64954016fcca1b3119504d80ef"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w1-6689da.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w1-6689da.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"b006ad729b2188ace5faf61aa80663fc9bd84c64954016fcca1b3119504d80ef\" already exists"}
{"level":"error","ts":"2026-11-02T22:04:24.488Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-shared-a-w1-6689da","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"name":"kuadrant-e2e-shared-a-w1-6689da","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-a-w1-6689da","uid":"def49e9c-a5db-4c1d-9263-8f0b6e3fc6b6"}]},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b006ad729b2188ace5faf61aa80663fc9bd84c64954016fcca1b3119504d80ef\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w1-6689da-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ee5374ea\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w1-6689da\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w1-6689da\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ee5374ea\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w1-6689da\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w1-6689da\"]}],\"name\":\"d1efa3892d2930e0914fff25e45c26e9350dd5768f3e3570a92056a5386414b1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"52f16f2579f0972b25c79646516d0b524ccd11f35bf97140e7a17004f04958a0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w1-6689da-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ee5374ea\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w1-6689da\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w1-6689da\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ee5374ea\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w1-6689da\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w1-6689da\"]}],\"name\":\"b98c0ed9e221dc10d7f33c75550156549e86e03ed847a552bd6ac759f2d85acb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b448f08c35cad10231a4caace1ef450ff8a77e5b20a28eee89d0c690d78dc63e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w1-6689da-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ee5374ea\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w1-6689da\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w1-6689da\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ee5374ea\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w1-6689da\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w1-6689da\"]}],\"name\":\"50c5d15dc441c5afe0e4e0b7eba4f644de459b5c1800cbabc40a76b70ac396c5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"67e5b24c3247b6535e48582dcd841c834bd22005b0954bf3ef3ec72658b5a352\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w1-6689da-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ee5374ea\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w1-6689da\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w1-6689da\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ee5374ea\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w1-6689da\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w1-6689da\"]}],\"name\":\"e1312a603b424eb91bc2d725e46f969a6e4f8f82f72e5e7e38f47a2b042e5f54\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d8a51cee975cd9c0d9911ce8ea5ca2d06c5a66798ecb321ef52a246e99aba7bb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w1-6689da-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ee5374ea\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w1-6689da\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w1-6689da\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ee5374ea\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w1-6689da\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w1-6689da\"]}],\"name\":\"9929ec06e1f1ae29fb3111aa27ce6cbceeec300b407d06ba3014bf63246927ef\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9a8d103eb97e68d1cda1b42c44a3c03b0bb4d7aafa28f5f0d0f31ce70414e058\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w1-6689da-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ee5374ea\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w1-6689da\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w1-6689da\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ee5374ea\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w1-6689da\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w1-6689da\"]}],\"name\":\"6f48a8cd8781be155e12b4c5199cecf4c35bd08b7867a70f4de0802d5ca85537\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-shared-a-w1-6689da"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-e2e-shared-a-w1-6689da\" already exists"}
{"level":"error","ts":"2026-11-02T22:04:25.573Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-a-w0-6e535d-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-a-w0-6e535d-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:04:25.637Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-b-w4-58ca7f-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-b-w4-58ca7f-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:04:25.850Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-b-w2-c7e71f-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-b-w2-c7e71f-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:04:25.914Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-a-w1-6689da-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-a-w1-6689da-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:04:25.979Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-b-w3-a1d751-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-b-w3-a1d751-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:04:26.118Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-b-w0-0f0874-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-b-w0-0f0874-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:04:26.181Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-a-w3-97995b-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-a-w3-97995b-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:04:26.224Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-a-w1-6689da","namespace":"openshift-ingress","uid":"ef7c9ccc-2321-4db6-a8e9-5ce03089e75e","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-a-w1-6689da\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:04:26.639Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-auth-test-model-6e535d","namespace":"ai-tenant-e2e-shared-a-w0-6e535d","uid":"f439f74c-b4cf-45c7-af58-08943001ea03","error":"tokenratelimitpolicies.kuadrant.io \"maas-trlp-auth-test-model-6e535d\" not found"}
{"level":"error","ts":"2026-11-02T22:04:26.875Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-auth-test-model-0f0874","namespace":"ai-tenant-e2e-shared-b-w0-0f0874","uid":"36f2bd0f-089a-4e90-be35-cf68724e4586","error":"tokenratelimitpolicies.kuadrant.io \"maas-trlp-auth-test-model-0f0874\" not found"}
{"level":"info","ts":"2026-11-02T22:04:27.118Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T22:04:27.118Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T22:04:27.433Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-a-w1-6689da","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-shared-a-w1-6689da\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:04:27.662Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"maas-api-route-e2e-shared-a-w1-6689da","namespace":"odh-ai-gateway-infra","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"maas-api-route-e2e-shared-a-w1-6689da\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:04:35.832Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthPolicy","AuthConfig","EnvoyFilter","Gateway","TokenRateLimitPolicy","ConfigMap","HTTPRoute","Limitador"],"eventTypes":{"create":10,"delete":2,"update":12}}
{"level":"info","ts":"2026-11-02T22:04:36.193Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T22:04:39.336Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T22:04:39.523Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:04:39.523Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T22:04:43.890Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:04:43.896Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:04:43.923Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:04:43.939Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T22:04:43.939Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:04:43.939Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T22:04:44.128Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T22:04:49.736Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T22:04:49.736Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T22:04:50.349Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"auth-test-model-6e535d-kserve-route","namespace":"ai-tenant-e2e-shared-a-w0-6e535d","error":"httproutes.gateway.networking.k8s.io \"auth-test-model-6e535d-kserve-route\" not found"}
{"level":"error","ts":"2026-11-02T22:04:50.594Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-a-w0-6e535d","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-shared-a-w0-6e535d\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:04:51.414Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthPolicy"],"eventTypes":{"update":1}}
{"level":"info","ts":"2026-11-02T22:04:58.082Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:04:58.096Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:04:58.096Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-02T22:04:58.245Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w2-06e461/auth-test-model-06e461-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w2-06e461/auth-test-model-06e461-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-02T22:02:01Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:02:01Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:02:02Z"}],"name":"a39b5e3422070c9db5e6c6cc30ae4c9eb9786da116b4b414de7ad8c0af6593a1","namespace":"kuadrant-system","resourceVersion":"93565","uid":"66cad6ae-2e9a-497d-a47d-096724b56ae1"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a39b5e3422070c9db5e6c6cc30ae4c9eb9786da116b4b414de7ad8c0af6593a1"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w2-06e461.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w2-06e461.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:02:02Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:02:02Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["a39b5e3422070c9db5e6c6cc30ae4c9eb9786da116b4b414de7ad8c0af6593a1"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a39b5e3422070c9db5e6c6cc30ae4c9eb9786da116b4b414de7ad8c0af6593a1\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:04:58.308Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d#rule-5"},"creationTimestamp":"2026-11-02T21:54:29Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:01:20Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:01:20Z"}],"name":"71e8c9bf81b77581f96b1cca4bb909b8434efbbb06bf9c9ec1aa5c8f412b9c76","namespace":"kuadrant-system","resourceVersion":"92798","uid":"8e3bdfbd-1c5f-4bb7-8e05-2f58902e4b45"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["71e8c9bf81b77581f96b1cca4bb909b8434efbbb06bf9c9ec1aa5c8f412b9c76"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:54:30Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:54:30Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["71e8c9bf81b77581f96b1cca4bb909b8434efbbb06bf9c9ec1aa5c8f412b9c76"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"71e8c9bf81b77581f96b1cca4bb909b8434efbbb06bf9c9ec1aa5c8f412b9c76\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:04:58.374Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-02T21:58:43Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:01:19Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:01:19Z"}],"name":"2ebd46ffb051e67477198ab6753e8d28c9a38e121382759fb2d52a04e59f9b60","namespace":"kuadrant-system","resourceVersion":"92724","uid":"384cf288-8627-4eb3-bf27-00440148c6a0"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["2ebd46ffb051e67477198ab6753e8d28c9a38e121382759fb2d52a04e59f9b60"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:58:43Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:58:43Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["2ebd46ffb051e67477198ab6753e8d28c9a38e121382759fb2d52a04e59f9b60"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"2ebd46ffb051e67477198ab6753e8d28c9a38e121382759fb2d52a04e59f9b60\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:04:58.441Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d#rule-4"},"creationTimestamp":"2026-11-02T21:54:29Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:01:19Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:01:19Z"}],"name":"8b7e784474461510a9d9970d39fe03c297fc6f9a5f80873c40898bdfcb389e5f","namespace":"kuadrant-system","resourceVersion":"92760","uid":"f7425df0-2e92-4ae4-8201-ef2b895a8fa6"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["8b7e784474461510a9d9970d39fe03c297fc6f9a5f80873c40898bdfcb389e5f"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:01:19Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:01:19Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["8b7e784474461510a9d9970d39fe03c297fc6f9a5f80873c40898bdfcb389e5f"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"8b7e784474461510a9d9970d39fe03c297fc6f9a5f80873c40898bdfcb389e5f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:04:58.556Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-02T22:00:10Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:02:34Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:02:34Z"}],"name":"bbf734a8f7cb8f7a4d8f6abc6cee8a1e0f3a91a1d6f325d722ffa80ed8951fdf","namespace":"kuadrant-system","resourceVersion":"94199","uid":"77604539-c6a2-48fc-a281-746749844c6d"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["bbf734a8f7cb8f7a4d8f6abc6cee8a1e0f3a91a1d6f325d722ffa80ed8951fdf"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:00:10Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:00:10Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["bbf734a8f7cb8f7a4d8f6abc6cee8a1e0f3a91a1d6f325d722ffa80ed8951fdf"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"bbf734a8f7cb8f7a4d8f6abc6cee8a1e0f3a91a1d6f325d722ffa80ed8951fdf\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:04:58.625Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d#rule-1"},"creationTimestamp":"2026-11-02T21:54:29Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:01:19Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:01:19Z"}],"name":"7482755e6f782100b8480fa82045aac768a6400e192241b0d0cf93403dad8edb","namespace":"kuadrant-system","resourceVersion":"92744","uid":"8f03f824-a6f8-42fb-be62-97bedf901cac"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["7482755e6f782100b8480fa82045aac768a6400e192241b0d0cf93403dad8edb"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:54:30Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:54:30Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["7482755e6f782100b8480fa82045aac768a6400e192241b0d0cf93403dad8edb"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"7482755e6f782100b8480fa82045aac768a6400e192241b0d0cf93403dad8edb\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:04:58.683Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-shared-b-w0-0f0874","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T21:56:34Z","generation":3,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"31926cb6-a222-454e-b0b0-713de52d3591\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:03:44Z"}],"name":"kuadrant-e2e-shared-b-w0-0f0874","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-b-w0-0f0874","uid":"31926cb6-a222-454e-b0b0-713de52d3591"}],"resourceVersion":"95877","uid":"1ec69299-baab-478d-87f9-565d3c2b35f2"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"192e3562b7ee19e64d41cd2b1ee110bdaa9d5e15bce45548d64e1cea83654553\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w0-0f0874-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]}],\"name\":\"96d612820c735a5c7f49aca0c5e3210a65bd84c7bb74aa59c6f11c388432988c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w0-0f0874/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"192e3562b7ee19e64d41cd2b1ee110bdaa9d5e15bce45548d64e1cea83654553\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w0-0f0874-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]}],\"name\":\"594ceea023dc6fd2036a4f6bc0ef534a12446fba2a3d3f58954345c8b77602fc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w0-0f0874/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"192e3562b7ee19e64d41cd2b1ee110bdaa9d5e15bce45548d64e1cea83654553\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w0-0f0874-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]}],\"name\":\"c51e02e9856e386dc171e8734da540cbc49b7b0a238f138ef22e444882e1613e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w0-0f0874/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"192e3562b7ee19e64d41cd2b1ee110bdaa9d5e15bce45548d64e1cea83654553\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w0-0f0874-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]}],\"name\":\"0888f39ff7d886257585cb922ded42c24041e07dc083ec596213dc7fcacccaea\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w0-0f0874/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"192e3562b7ee19e64d41cd2b1ee110bdaa9d5e15bce45548d64e1cea83654553\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w0-0f0874-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]}],\"name\":\"3c5fc1537f41b6f3804e88f6ec215ae6ef9524f53e1717c0cdec4029128cef05\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w0-0f0874/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"192e3562b7ee19e64d41cd2b1ee110bdaa9d5e15bce45548d64e1cea83654553\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w0-0f0874-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]}],\"name\":\"63aeeda6478ed352b03fb88743f4aedf116245422cae0681ee45af616c2000d5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w0-0f0874/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"192e3562b7ee19e64d41cd2b1ee110bdaa9d5e15bce45548d64e1cea83654553\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w0-0f0874-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]}],\"name\":\"b11f193dcf2be073ad3e9e40f3ad858efbf2de4d12c8bc1773a982144d661807\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w0-0f0874/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"192e3562b7ee19e64d41cd2b1ee110bdaa9d5e15bce45548d64e1cea83654553\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w0-0f0874-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]}],\"name\":\"be4b695e04605c0ca74f7b8190b972d0117c076eed01c4f0844ed25b0c3be637\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w0-0f0874/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4676855aaad0efd1f263930f7407a2242dda7211d0408fa3820678f475f20874\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w0-0f0874-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w0-0f0874\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w0-0f0874\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]}],\"name\":\"3d902dff08fca5c2bb562975c1b916ca54e6236ecd9cc50b17e3b37999d911ec\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6cb6688d420ac5b2b570d91ccae4187381d55d206452803585e3aab02552fbe9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w0-0f0874-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]}],\"name\":\"50fad7c8f3f0705a071ee5516dae4e63f442232e0a8eb11002d4c8b2f7b9039b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w0-0f0874/models/facebook/opt-125m/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4623541d4c172040d64c605b4e3945edb2d59ccdd3ec6ed31cc6feffeeae1ab4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w0-0f0874-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]}],\"name\":\"c812882d08c914362c20379f96d7022ad56d171d701c3c7ca4ff1757d4e109b2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w0-0f0874/models/facebook/opt-125m/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4fa2f2c1a3c0df3206f544f6ff837542a51e9515367baad5062e6a22eee81f04\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w0-0f0874-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]}],\"name\":\"ce8e43804485dd1338d30ad454b30041ac6b29b1b0c0e85e0085cd9abbc9e1e2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w0-0f0874/models/facebook/opt-125m/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"85163453d99bec350a3cce90e62f08f7ca26ab8a22960123c6d310178b1a50a8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w0-0f0874-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]}],\"name\":\"0379ad91c1f93b81155b541997ae37102c499869790fbd1483d631d2bcf4f79a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w0-0f0874/models/facebook/opt-125m/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e583136fa4e58c701ec7e6c48633505d9721ef080a15d621144f572174f6b87e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w0-0f0874-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]}],\"name\":\"b3cb87978351bfd72bc463105cba3b004e1586be0f3569c173fb637e093d5b0c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d7ae6cb43b0fd921cbdca5537d3e42177a4e37ae3027e062325ff19c6b954181\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w0-0f0874-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]}],\"name\":\"ba88551c983b0ba140904b68c7c7ef9857734f0019c63b85dbe43e7cbcb9307f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ca46caeca16a2930e3e73b5d3e2f07945518abac4c9b3519cdc1f8068f758273\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w0-0f0874-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]}],\"name\":\"6f0e56cfa964fd7af7b380781cd35bbd8a191aceba6852fff53d1efc008f0b81\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e9438ab25aed0d4ff0ae6ae8d98bf3aafec82cbf8347ba6b7c99e884f66303ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w0-0f0874-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]}],\"name\":\"23cdb90fab9cf66008bfaf0a6dd2b32a1294366bf64c4959293feda0ab809577\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w0-0f0874/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bbf734a8f7cb8f7a4d8f6abc6cee8a1e0f3a91a1d6f325d722ffa80ed8951fdf\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w0-0f0874-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]}],\"name\":\"ee38902643d390e24ee40e376a99f15504d5a6e8fb05035cedea3731206e4979\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2eec8b123e2f232f097c8135f01e126de58c05e263e638ca62d7eefdb47f0999\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w0-0f0874-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]}],\"name\":\"b7f33fdc0477b101212634363f5ff89b4f8bf42c996b487e6c9e78ff9bfa7ac8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8ccf868b0c716a18e90e502ebb2284ce90d5ee3fcd5779be4d996fb8a3d03b43\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w0-0f0874-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w0-0f0874\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w0-0f0874\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]}],\"name\":\"e51fac9c5a01bb319b1deb20eaa60eeb3cb0f05fa44b2dfb2cac5ec6b7cbd8fd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"848b20842f79c8cc02bec7966c894853251e29e5c14c8a4cff729041c180e15c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w0-0f0874-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w0-0f0874\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w0-0f0874\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]}],\"name\":\"a73356366d107cd5992220a58c6f2b0f6bf70196a187bc3534c68088f7abd636\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b0dda7ce592fb57a979446129e21c491a217f4c5c9a704c19a519ee42c367e92\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w0-0f0874-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w0-0f0874\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w0-0f0874\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]}],\"name\":\"098f7ba551981a4029ff8c66c0d0234e632f325a01b723001668c0e56481bd87\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6e2c4c40ad28f1eeda9eca533706722536247311f5ede5be2cbe544e374719a6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w0-0f0874-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w0-0f0874\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w0-0f0874\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]}],\"name\":\"fd25786cbc9657425a1956e65052da9d0b96f50c6eca843a1c5af4671e05425e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ffaef4e77ab77e038e2181351f7ed710141739ce5f70351bf42c0606b9215e72\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w0-0f0874-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w0-0f0874\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w0-0f0874\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]}],\"name\":\"d6fb22990981f2cd0325455675dc804fada0a031b35d72d782173400f3a24d44\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"91970f7ac4ae9dc8cc6500e528bc955ad2f35aa953cbdaa553658695f4221e2b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w0-0f0874-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]}],\"name\":\"ad56e4a3a6243f2b466c3c5486e30cb51678182b9e5b825b1c9dbb8915635a46\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w0-0f0874/models/facebook/opt-125m')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-shared-b-w0-0f0874"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-shared-b-w0-0f0874\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:04:58.738Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-02T21:58:43Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:01:19Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:01:19Z"}],"name":"d82605cc2995db10d6c22eaf50ce1b24ce92305a4b1b2cf9ef796dc4a0e019f0","namespace":"kuadrant-system","resourceVersion":"92728","uid":"c720fed7-dc57-4c15-ba07-04191d5761c9"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d82605cc2995db10d6c22eaf50ce1b24ce92305a4b1b2cf9ef796dc4a0e019f0"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:58:43Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:58:43Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["d82605cc2995db10d6c22eaf50ce1b24ce92305a4b1b2cf9ef796dc4a0e019f0"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"d82605cc2995db10d6c22eaf50ce1b24ce92305a4b1b2cf9ef796dc4a0e019f0\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:04:58.800Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w2-06e461/auth-test-model-06e461-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w2-06e461/auth-test-model-06e461-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-02T22:02:02Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:02:02Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:02:02Z"}],"name":"1d0d881a9dc71c6fee94329409cd94f4924596799c71b4e23e5b04e1e5322ec3","namespace":"kuadrant-system","resourceVersion":"93573","uid":"56303436-40cc-45e1-8061-a1bf6710c183"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["1d0d881a9dc71c6fee94329409cd94f4924596799c71b4e23e5b04e1e5322ec3"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w2-06e461.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w2-06e461.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:02:02Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:02:02Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["1d0d881a9dc71c6fee94329409cd94f4924596799c71b4e23e5b04e1e5322ec3"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"1d0d881a9dc71c6fee94329409cd94f4924596799c71b4e23e5b04e1e5322ec3\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:04:58.862Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w0-0f0874","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w0-0f0874#rule-4"},"creationTimestamp":"2026-11-02T21:56:34Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:02:34Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:02:34Z"}],"name":"6e2c4c40ad28f1eeda9eca533706722536247311f5ede5be2cbe544e374719a6","namespace":"kuadrant-system","resourceVersion":"94190","uid":"0f063dfd-17bc-49a3-923a-24c33cc81a1b"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["6e2c4c40ad28f1eeda9eca533706722536247311f5ede5be2cbe544e374719a6"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:56:34Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:56:34Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["6e2c4c40ad28f1eeda9eca533706722536247311f5ede5be2cbe544e374719a6"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"6e2c4c40ad28f1eeda9eca533706722536247311f5ede5be2cbe544e374719a6\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:04:58.923Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-06e461","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-06e461#rule-4"},"creationTimestamp":"2026-11-02T21:57:01Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:57:01Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:57:01Z"}],"name":"2ed83c23a8290f3646a543920910524ccfc2baad0ca9fb2e965cb8bd4f0fbf83","namespace":"kuadrant-system","resourceVersion":"86280","uid":"d5fca4de-9e7e-481e-afb2-e1753985d971"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["2ed83c23a8290f3646a543920910524ccfc2baad0ca9fb2e965cb8bd4f0fbf83"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w2-06e461.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w2-06e461.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:57:01Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:57:01Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["2ed83c23a8290f3646a543920910524ccfc2baad0ca9fb2e965cb8bd4f0fbf83"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"2ed83c23a8290f3646a543920910524ccfc2baad0ca9fb2e965cb8bd4f0fbf83\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:04:58.987Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w2-06e461/auth-test-model-06e461-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w2-06e461/auth-test-model-06e461-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-02T22:02:01Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:02:01Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:02:01Z"}],"name":"68a6b0e714f4c962fdd6f870e2ce0522e8a0dad7d749f4212b8ebc8a5669988e","namespace":"kuadrant-system","resourceVersion":"93554","uid":"44c9fb2e-cc09-41a7-8caf-3e8e94922afc"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["68a6b0e714f4c962fdd6f870e2ce0522e8a0dad7d749f4212b8ebc8a5669988e"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w2-06e461.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w2-06e461.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:02:01Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:02:01Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["68a6b0e714f4c962fdd6f870e2ce0522e8a0dad7d749f4212b8ebc8a5669988e"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"68a6b0e714f4c962fdd6f870e2ce0522e8a0dad7d749f4212b8ebc8a5669988e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:04:59.051Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w2-06e461/auth-test-model-06e461-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w2-06e461/auth-test-model-06e461-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-02T22:02:01Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:02:01Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:02:01Z"}],"name":"c1f395fe657de9926a17e2585660efe2122126d80c128be98e3caadff48b0d8b","namespace":"kuadrant-system","resourceVersion":"93556","uid":"602567bf-12a2-4978-b16c-7905f0484800"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["c1f395fe657de9926a17e2585660efe2122126d80c128be98e3caadff48b0d8b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w2-06e461.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w2-06e461.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:02:01Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:02:01Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["c1f395fe657de9926a17e2585660efe2122126d80c128be98e3caadff48b0d8b"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"c1f395fe657de9926a17e2585660efe2122126d80c128be98e3caadff48b0d8b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:04:59.112Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-02T22:00:10Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:02:36Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:02:36Z"}],"name":"4fa2f2c1a3c0df3206f544f6ff837542a51e9515367baad5062e6a22eee81f04","namespace":"kuadrant-system","resourceVersion":"94279","uid":"55e09045-381a-4665-b726-65f69373c5cc"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["4fa2f2c1a3c0df3206f544f6ff837542a51e9515367baad5062e6a22eee81f04"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:00:10Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:00:10Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["4fa2f2c1a3c0df3206f544f6ff837542a51e9515367baad5062e6a22eee81f04"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"4fa2f2c1a3c0df3206f544f6ff837542a51e9515367baad5062e6a22eee81f04\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:04:59.175Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-02T21:58:42Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:01:19Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:01:20Z"}],"name":"404142835a3977e1a9c2c43dac43764640a7632eade56ba3651c850858555e55","namespace":"kuadrant-system","resourceVersion":"92762","uid":"17bef789-8e35-470d-a767-3f1ce0c602c1"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["404142835a3977e1a9c2c43dac43764640a7632eade56ba3651c850858555e55"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:58:42Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:58:42Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["404142835a3977e1a9c2c43dac43764640a7632eade56ba3651c850858555e55"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"404142835a3977e1a9c2c43dac43764640a7632eade56ba3651c850858555e55\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:04:59.240Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-02T21:58:42Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:01:20Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:01:20Z"}],"name":"17286683a6178785a8017d68de67b058e3a1963e7ba7f06b1101054db0cebfb1","namespace":"kuadrant-system","resourceVersion":"92784","uid":"d8a81ac2-18d7-45d8-a6c3-495025305d0a"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["17286683a6178785a8017d68de67b058e3a1963e7ba7f06b1101054db0cebfb1"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:58:42Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:58:42Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["17286683a6178785a8017d68de67b058e3a1963e7ba7f06b1101054db0cebfb1"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"17286683a6178785a8017d68de67b058e3a1963e7ba7f06b1101054db0cebfb1\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:04:59.303Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-02T21:58:43Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:01:20Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:01:20Z"}],"name":"488fa6498257bae79da02565203c68726b20b3ff1190dd0f76f1d15f3016b91c","namespace":"kuadrant-system","resourceVersion":"92789","uid":"cb59de03-a12d-42e0-9ae6-280ccd402ab8"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["488fa6498257bae79da02565203c68726b20b3ff1190dd0f76f1d15f3016b91c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:58:44Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:58:44Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["488fa6498257bae79da02565203c68726b20b3ff1190dd0f76f1d15f3016b91c"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"488fa6498257bae79da02565203c68726b20b3ff1190dd0f76f1d15f3016b91c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:04:59.338Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-shared-a-w0-6e535d","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T21:54:30Z","generation":3,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"bb413150-c71f-467a-b73c-fc346914ff7a\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:02:02Z"}],"name":"kuadrant-e2e-shared-a-w0-6e535d","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-a-w0-6e535d","uid":"bb413150-c71f-467a-b73c-fc346914ff7a"}],"resourceVersion":"93581","uid":"79ec4380-cbc0-4c66-b610-cdb28384077b"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c88daf14f697a484e9c4281c2194076dd57e1afe0e40819b6ea26599cb703e8b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"5d0e9408d69754c488902bd340f6b0a6f1864fac10f1f8e367ff40e50ae5ce01\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w0-6e535d/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c88daf14f697a484e9c4281c2194076dd57e1afe0e40819b6ea26599cb703e8b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"b076dfbfd5d7663e530e8a29a4789267e6429f59d51ebac8a69ff33b93f91f45\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w0-6e535d/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c88daf14f697a484e9c4281c2194076dd57e1afe0e40819b6ea26599cb703e8b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"da00003130e20f19532bdecff616a160b89d1e063f591c906554b89d0bb4263e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w0-6e535d/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c88daf14f697a484e9c4281c2194076dd57e1afe0e40819b6ea26599cb703e8b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"5b3fe1c533d5d79dd6aded892a6fe0d9d623fa4b1fb990ab35d2d88eac062a4c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w0-6e535d/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c88daf14f697a484e9c4281c2194076dd57e1afe0e40819b6ea26599cb703e8b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"250bc93087c31cc5a282a19ab15f80ee1861f55d7415d75e3025836a8a2e8c51\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w0-6e535d/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c88daf14f697a484e9c4281c2194076dd57e1afe0e40819b6ea26599cb703e8b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"bac9dc1d9dd43ed5dcbd51a5ae508efe4045bfb79f818a7f155d8f1fbef8acde\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w0-6e535d/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c88daf14f697a484e9c4281c2194076dd57e1afe0e40819b6ea26599cb703e8b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"54727fdd6fe954678377cabf073d49155df15982b405dc503c28a1a1a9fb6462\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w0-6e535d/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c88daf14f697a484e9c4281c2194076dd57e1afe0e40819b6ea26599cb703e8b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"fc810dd26a41e3e710c7c25ab1324c0430624820a9bfe8f128113df2c8a8e150\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w0-6e535d/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"376d56a711fbb2b29d7c46a8a0998936174b738443f0db294a13f85fd8478a94\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"3aa9e48facd88e18a7acef348feeaf654a1d4310d58727df558a9c5543ced772\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"22782c8aa7f396a4922a49f49140671294f2d19b32614fd09a7f9d26e94f5aa9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"c082a06d8a8f9278e6c1f845fca54a717a0293281a68b2c7bc7449a2e599733c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-a-w0-6e535d/models/facebook/opt-125m/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d82605cc2995db10d6c22eaf50ce1b24ce92305a4b1b2cf9ef796dc4a0e019f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"118d368999575d560f991f40640a453764e7c0b6268ed87505baec55580bd619\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-a-w0-6e535d/models/facebook/opt-125m/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"404142835a3977e1a9c2c43dac43764640a7632eade56ba3651c850858555e55\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"160b7ea1c7e8177306ef3c92ab8011b36af7fe1d3a7699455acbefab2e870174\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-a-w0-6e535d/models/facebook/opt-125m/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a7a0dc3cdf8fe8f61255465b2a28cb24f80d6467505607084b4be4b883494ef6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"f6c097cc138c92b1b467164e77ec3a1f2f6e8e07441cdd0df65ae38065ae2698\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-a-w0-6e535d/models/facebook/opt-125m/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"17286683a6178785a8017d68de67b058e3a1963e7ba7f06b1101054db0cebfb1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"e72329ef02d0afc0ab8652712a5954a5037a4a5eb0b766375a86ff513eb92c07\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"570e5848a361e3c9dd1e04eedfa2b9e8bd67123ca48082b249c1e62ddac6aa45\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"639c799e4de16c75644b4448049c991d6072805f0202a39c30f55e37d08ab1f4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"488fa6498257bae79da02565203c68726b20b3ff1190dd0f76f1d15f3016b91c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"f7d599fbb9563d1af06dc7949981399a5ce6e0411dea789e86b236b300ec5a00\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e7b7d686afb3e980f4fa7e5e90b69836684133b1852ad79e11efb71a5156e402\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"a61a55c32a9a90b21b2be93f5deae56314af3c4c247f64ec034990e3224b05c2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-a-w0-6e535d/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"45c0e8af5bd103871f78f35176ade26570f4cd362b56658e846eb717266590b0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"46a2bba503f657cce3aaa7181591c9cf2a233ab3641309c5709bdfc1462466ac\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2ebd46ffb051e67477198ab6753e8d28c9a38e121382759fb2d52a04e59f9b60\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"58ceed85289173525de25d7f2a84abcfca5c0fecd2525ef3063338d7a23601a7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"65ad30c331bd08b64f99c2bfc9d23db3979d37b9d3b916cb76d08a0dfabf963a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"4593350858282f0ebeaf11b57850d5bccfa270a4b6088784a058e2d70b5cbe7c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"71e8c9bf81b77581f96b1cca4bb909b8434efbbb06bf9c9ec1aa5c8f412b9c76\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"01c09092684d0d3ed9db0ad6f53595f8d2c97286804d29e76075f2c30f05f44e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c3ead856f0c0807270869b6a467d9281b93eaaa8c65e788c4b6393073db2cbe8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"7d0e9eabd4ff8a0b65212f3d03a7b14a1e695503c8c41fb7cd6e844984ba7c69\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8b7e784474461510a9d9970d39fe03c297fc6f9a5f80873c40898bdfcb389e5f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"3cb722466e22fc9e58ad8f75bb3dbd6e1d2f9d75c3cfaafc5c6350857d59f964\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7482755e6f782100b8480fa82045aac768a6400e192241b0d0cf93403dad8edb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"af29fffcd438904723a318f8c7cd8dbe79f55578faf5560452874252825fdf46\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c8ebd64b293ad7c614b7021be06db91b0e0b0afb406d42f6c2500255bf064935\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"e00a02f312942a27da8eda94534fbd032cea948dcae834521b0d6ce91553a090\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w0-6e535d/models/facebook/opt-125m')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-shared-a-w0-6e535d"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-shared-a-w0-6e535d\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:04:59.365Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-02T21:58:43Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:01:20Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:01:20Z"}],"name":"a7a0dc3cdf8fe8f61255465b2a28cb24f80d6467505607084b4be4b883494ef6","namespace":"kuadrant-system","resourceVersion":"92802","uid":"988466d0-7c44-4b06-9d7d-2e4e1c0e3b13"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a7a0dc3cdf8fe8f61255465b2a28cb24f80d6467505607084b4be4b883494ef6"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:58:44Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:58:44Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["a7a0dc3cdf8fe8f61255465b2a28cb24f80d6467505607084b4be4b883494ef6"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a7a0dc3cdf8fe8f61255465b2a28cb24f80d6467505607084b4be4b883494ef6\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:04:59.426Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-06e461","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-06e461#rule-2"},"creationTimestamp":"2026-11-02T21:57:01Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:57:01Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:57:01Z"}],"name":"3c9315326fe75b44d6f5e3c7cd9fac13abf4b1a9918698589b0faa0c42deeb08","namespace":"kuadrant-system","resourceVersion":"86264","uid":"a86d170d-3e6d-4646-944f-4706551689a8"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["3c9315326fe75b44d6f5e3c7cd9fac13abf4b1a9918698589b0faa0c42deeb08"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w2-06e461.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w2-06e461.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:57:01Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:57:01Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["3c9315326fe75b44d6f5e3c7cd9fac13abf4b1a9918698589b0faa0c42deeb08"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"3c9315326fe75b44d6f5e3c7cd9fac13abf4b1a9918698589b0faa0c42deeb08\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:04:59.490Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-02T22:00:11Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:02:35Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:02:36Z"}],"name":"6cb6688d420ac5b2b570d91ccae4187381d55d206452803585e3aab02552fbe9","namespace":"kuadrant-system","resourceVersion":"94270","uid":"4b66b495-f5c8-4676-aa6c-f9cc957632bc"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["6cb6688d420ac5b2b570d91ccae4187381d55d206452803585e3aab02552fbe9"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:00:11Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:00:11Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["6cb6688d420ac5b2b570d91ccae4187381d55d206452803585e3aab02552fbe9"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"6cb6688d420ac5b2b570d91ccae4187381d55d206452803585e3aab02552fbe9\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:04:59.551Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-02T21:58:43Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:01:20Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:01:20Z"}],"name":"570e5848a361e3c9dd1e04eedfa2b9e8bd67123ca48082b249c1e62ddac6aa45","namespace":"kuadrant-system","resourceVersion":"92793","uid":"2230c65e-506d-48d4-b786-c1a4effebd2c"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["570e5848a361e3c9dd1e04eedfa2b9e8bd67123ca48082b249c1e62ddac6aa45"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:58:43Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:58:43Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["570e5848a361e3c9dd1e04eedfa2b9e8bd67123ca48082b249c1e62ddac6aa45"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"570e5848a361e3c9dd1e04eedfa2b9e8bd67123ca48082b249c1e62ddac6aa45\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:04:59.615Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w0-0f0874","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w0-0f0874#rule-2"},"creationTimestamp":"2026-11-02T21:56:34Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:02:33Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:02:34Z"}],"name":"8ccf868b0c716a18e90e502ebb2284ce90d5ee3fcd5779be4d996fb8a3d03b43","namespace":"kuadrant-system","resourceVersion":"94178","uid":"0a0ee5ce-0c48-4c2d-85b6-4991d695d43a"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["8ccf868b0c716a18e90e502ebb2284ce90d5ee3fcd5779be4d996fb8a3d03b43"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:56:34Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:56:34Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["8ccf868b0c716a18e90e502ebb2284ce90d5ee3fcd5779be4d996fb8a3d03b43"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"8ccf868b0c716a18e90e502ebb2284ce90d5ee3fcd5779be4d996fb8a3d03b43\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:04:59.677Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w2-06e461/auth-test-model-06e461-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w2-06e461/auth-test-model-06e461-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-02T22:02:02Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:02:02Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:02:02Z"}],"name":"be41fa1d3323b7258317f58eba852b7b1df727d18fc3ee5a8bc5ad9352718c96","namespace":"kuadrant-system","resourceVersion":"93582","uid":"dd282314-4e56-4a85-846d-c864d44a77e5"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["be41fa1d3323b7258317f58eba852b7b1df727d18fc3ee5a8bc5ad9352718c96"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w2-06e461.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w2-06e461.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:02:02Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:02:02Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["be41fa1d3323b7258317f58eba852b7b1df727d18fc3ee5a8bc5ad9352718c96"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"be41fa1d3323b7258317f58eba852b7b1df727d18fc3ee5a8bc5ad9352718c96\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:04:59.739Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w2-06e461/auth-test-model-06e461-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w2-06e461/auth-test-model-06e461-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-02T22:02:02Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:02:02Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:02:02Z"}],"name":"1eaa4e55e51f69196534f42bdab14aeaa07561fd434ded5d363589ea3c382138","namespace":"kuadrant-system","resourceVersion":"93589","uid":"5cbc8bae-2049-46cf-b5f8-c2c35f27676f"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["1eaa4e55e51f69196534f42bdab14aeaa07561fd434ded5d363589ea3c382138"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w2-06e461.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w2-06e461.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:02:02Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:02:02Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["1eaa4e55e51f69196534f42bdab14aeaa07561fd434ded5d363589ea3c382138"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"1eaa4e55e51f69196534f42bdab14aeaa07561fd434ded5d363589ea3c382138\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:04:59.801Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-06e461","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-06e461#rule-1"},"creationTimestamp":"2026-11-02T21:57:00Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:57:00Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:57:01Z"}],"name":"f1500aad848242a78004ce946110822a45e41d3c4e8b411396c76761e740aa13","namespace":"kuadrant-system","resourceVersion":"86253","uid":"ab4ff536-92a4-4c0b-a97f-42c61dcbf287"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f1500aad848242a78004ce946110822a45e41d3c4e8b411396c76761e740aa13"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w2-06e461.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w2-06e461.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:57:01Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:57:01Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["f1500aad848242a78004ce946110822a45e41d3c4e8b411396c76761e740aa13"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"f1500aad848242a78004ce946110822a45e41d3c4e8b411396c76761e740aa13\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:04:59.864Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-02T21:58:43Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:01:19Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:01:19Z"}],"name":"e7b7d686afb3e980f4fa7e5e90b69836684133b1852ad79e11efb71a5156e402","namespace":"kuadrant-system","resourceVersion":"92735","uid":"abd4649a-f220-4ad8-8938-b64ac91a873e"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["e7b7d686afb3e980f4fa7e5e90b69836684133b1852ad79e11efb71a5156e402"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:58:43Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:58:43Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["e7b7d686afb3e980f4fa7e5e90b69836684133b1852ad79e11efb71a5156e402"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"e7b7d686afb3e980f4fa7e5e90b69836684133b1852ad79e11efb71a5156e402\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:04:59.926Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w2-06e461/auth-test-model-06e461-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w2-06e461/auth-test-model-06e461-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-02T22:02:01Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:02:01Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:02:02Z"}],"name":"376a7c0b362126d2df7b7d580d5c3cd5027f25fb8b56a9dbbe9e48660857dc0a","namespace":"kuadrant-system","resourceVersion":"93569","uid":"f56f0844-6cf0-4bbe-8131-b5469bc6cee2"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["376a7c0b362126d2df7b7d580d5c3cd5027f25fb8b56a9dbbe9e48660857dc0a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w2-06e461.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w2-06e461.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:02:02Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:02:02Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["376a7c0b362126d2df7b7d580d5c3cd5027f25fb8b56a9dbbe9e48660857dc0a"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"376a7c0b362126d2df7b7d580d5c3cd5027f25fb8b56a9dbbe9e48660857dc0a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:04:59.991Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w0-0f0874","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w0-0f0874#rule-3"},"creationTimestamp":"2026-11-02T21:56:34Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:02:36Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:02:36Z"}],"name":"b0dda7ce592fb57a979446129e21c491a217f4c5c9a704c19a519ee42c367e92","namespace":"kuadrant-system","resourceVersion":"94283","uid":"d48b3d18-33ed-4660-af27-b3404ed9ef2e"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["b0dda7ce592fb57a979446129e21c491a217f4c5c9a704c19a519ee42c367e92"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:56:35Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:56:35Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["b0dda7ce592fb57a979446129e21c491a217f4c5c9a704c19a519ee42c367e92"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"b0dda7ce592fb57a979446129e21c491a217f4c5c9a704c19a519ee42c367e92\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:05:00.051Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-02T21:58:43Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:01:20Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:01:20Z"}],"name":"c88daf14f697a484e9c4281c2194076dd57e1afe0e40819b6ea26599cb703e8b","namespace":"kuadrant-system","resourceVersion":"92783","uid":"e0121c8b-7f5b-40e3-b1ee-b44b0942468c"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["c88daf14f697a484e9c4281c2194076dd57e1afe0e40819b6ea26599cb703e8b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:58:44Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:58:44Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["c88daf14f697a484e9c4281c2194076dd57e1afe0e40819b6ea26599cb703e8b"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"c88daf14f697a484e9c4281c2194076dd57e1afe0e40819b6ea26599cb703e8b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:05:00.113Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-06e461","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-06e461#rule-3"},"creationTimestamp":"2026-11-02T21:57:01Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:57:01Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:57:01Z"}],"name":"33019b54557cbd49426d4158e18ab3a88d235b9f20f792586c271053788a54a8","namespace":"kuadrant-system","resourceVersion":"86275","uid":"989ba998-40a2-4253-9e47-4e6d37326ca9"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["33019b54557cbd49426d4158e18ab3a88d235b9f20f792586c271053788a54a8"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w2-06e461.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w2-06e461.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:57:01Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:57:01Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["33019b54557cbd49426d4158e18ab3a88d235b9f20f792586c271053788a54a8"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"33019b54557cbd49426d4158e18ab3a88d235b9f20f792586c271053788a54a8\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:05:00.176Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w0-0f0874","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w0-0f0874#rule-5"},"creationTimestamp":"2026-11-02T21:56:33Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:02:34Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:02:34Z"}],"name":"848b20842f79c8cc02bec7966c894853251e29e5c14c8a4cff729041c180e15c","namespace":"kuadrant-system","resourceVersion":"94184","uid":"6384ebbc-a9ea-4bb7-a3b1-750a047b299f"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["848b20842f79c8cc02bec7966c894853251e29e5c14c8a4cff729041c180e15c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:56:34Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:56:34Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["848b20842f79c8cc02bec7966c894853251e29e5c14c8a4cff729041c180e15c"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"848b20842f79c8cc02bec7966c894853251e29e5c14c8a4cff729041c180e15c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:05:00.238Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-02T22:00:12Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:02:35Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:02:35Z"}],"name":"85163453d99bec350a3cce90e62f08f7ca26ab8a22960123c6d310178b1a50a8","namespace":"kuadrant-system","resourceVersion":"94241","uid":"59a30407-d5fe-4503-8bf7-808ddd5e5a06"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["85163453d99bec350a3cce90e62f08f7ca26ab8a22960123c6d310178b1a50a8"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:02:35Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:02:35Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["85163453d99bec350a3cce90e62f08f7ca26ab8a22960123c6d310178b1a50a8"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"85163453d99bec350a3cce90e62f08f7ca26ab8a22960123c6d310178b1a50a8\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:05:00.302Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-02T22:00:11Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:02:35Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:02:35Z"}],"name":"2eec8b123e2f232f097c8135f01e126de58c05e263e638ca62d7eefdb47f0999","namespace":"kuadrant-system","resourceVersion":"94246","uid":"57b2d6c9-cf62-4246-92ff-60da325f460e"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["2eec8b123e2f232f097c8135f01e126de58c05e263e638ca62d7eefdb47f0999"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:02:35Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:02:35Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["2eec8b123e2f232f097c8135f01e126de58c05e263e638ca62d7eefdb47f0999"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"2eec8b123e2f232f097c8135f01e126de58c05e263e638ca62d7eefdb47f0999\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:05:00.365Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-02T22:00:11Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:02:35Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:02:35Z"}],"name":"192e3562b7ee19e64d41cd2b1ee110bdaa9d5e15bce45548d64e1cea83654553","namespace":"kuadrant-system","resourceVersion":"94225","uid":"9cbd4bf0-1573-4b24-a319-1b54765bed98"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["192e3562b7ee19e64d41cd2b1ee110bdaa9d5e15bce45548d64e1cea83654553"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:00:12Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:00:12Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["192e3562b7ee19e64d41cd2b1ee110bdaa9d5e15bce45548d64e1cea83654553"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"192e3562b7ee19e64d41cd2b1ee110bdaa9d5e15bce45548d64e1cea83654553\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:05:00.427Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w2-06e461/auth-test-model-06e461-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w2-06e461/auth-test-model-06e461-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-02T22:02:02Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:02:02Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:02:02Z"}],"name":"60ec2d78d907b7757451410076aebf7c05311c64398a9859346016520fa4fdb5","namespace":"kuadrant-system","resourceVersion":"93591","uid":"852957b8-7d21-4eb8-b739-81f6dfb9d85d"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["60ec2d78d907b7757451410076aebf7c05311c64398a9859346016520fa4fdb5"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w2-06e461.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w2-06e461.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:02:02Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:02:02Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["60ec2d78d907b7757451410076aebf7c05311c64398a9859346016520fa4fdb5"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"60ec2d78d907b7757451410076aebf7c05311c64398a9859346016520fa4fdb5\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:05:00.491Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-02T22:00:11Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:02:35Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:02:35Z"}],"name":"ca46caeca16a2930e3e73b5d3e2f07945518abac4c9b3519cdc1f8068f758273","namespace":"kuadrant-system","resourceVersion":"94244","uid":"28da751f-a256-464b-8195-0f2526763860"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["ca46caeca16a2930e3e73b5d3e2f07945518abac4c9b3519cdc1f8068f758273"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:00:12Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:00:12Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["ca46caeca16a2930e3e73b5d3e2f07945518abac4c9b3519cdc1f8068f758273"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"ca46caeca16a2930e3e73b5d3e2f07945518abac4c9b3519cdc1f8068f758273\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:05:00.555Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w2-06e461/auth-test-model-06e461-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w2-06e461/auth-test-model-06e461-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-02T22:02:02Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:02:02Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:02:02Z"}],"name":"0bdd85d0c5d72530296ec80e18137c67533d79207dd839bc21f06973780ff0f7","namespace":"kuadrant-system","resourceVersion":"93579","uid":"1abc8e44-201e-4ad8-ab60-f94afd630137"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["0bdd85d0c5d72530296ec80e18137c67533d79207dd839bc21f06973780ff0f7"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w2-06e461.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w2-06e461.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:02:02Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:02:02Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["0bdd85d0c5d72530296ec80e18137c67533d79207dd839bc21f06973780ff0f7"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"0bdd85d0c5d72530296ec80e18137c67533d79207dd839bc21f06973780ff0f7\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:05:00.619Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-02T22:00:12Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:02:34Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:02:35Z"}],"name":"e583136fa4e58c701ec7e6c48633505d9721ef080a15d621144f572174f6b87e","namespace":"kuadrant-system","resourceVersion":"94223","uid":"b03a2983-bd54-468c-b9e7-62a0873bd755"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["e583136fa4e58c701ec7e6c48633505d9721ef080a15d621144f572174f6b87e"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:00:12Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:00:12Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["e583136fa4e58c701ec7e6c48633505d9721ef080a15d621144f572174f6b87e"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"e583136fa4e58c701ec7e6c48633505d9721ef080a15d621144f572174f6b87e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:05:00.685Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-02T21:58:44Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:01:20Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:01:21Z"}],"name":"c8ebd64b293ad7c614b7021be06db91b0e0b0afb406d42f6c2500255bf064935","namespace":"kuadrant-system","resourceVersion":"92806","uid":"912073b0-9ab7-4b8d-9830-ea175606f323"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["c8ebd64b293ad7c614b7021be06db91b0e0b0afb406d42f6c2500255bf064935"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:58:44Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:58:44Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["c8ebd64b293ad7c614b7021be06db91b0e0b0afb406d42f6c2500255bf064935"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"c8ebd64b293ad7c614b7021be06db91b0e0b0afb406d42f6c2500255bf064935\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:05:00.747Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-02T22:00:12Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:02:35Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:02:36Z"}],"name":"e9438ab25aed0d4ff0ae6ae8d98bf3aafec82cbf8347ba6b7c99e884f66303ec","namespace":"kuadrant-system","resourceVersion":"94265","uid":"a2735e95-9d78-4a5e-9079-32047e9d7693"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["e9438ab25aed0d4ff0ae6ae8d98bf3aafec82cbf8347ba6b7c99e884f66303ec"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:00:12Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:00:12Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["e9438ab25aed0d4ff0ae6ae8d98bf3aafec82cbf8347ba6b7c99e884f66303ec"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"e9438ab25aed0d4ff0ae6ae8d98bf3aafec82cbf8347ba6b7c99e884f66303ec\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:05:00.811Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w2-06e461/auth-test-model-06e461-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w2-06e461/auth-test-model-06e461-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-02T22:02:02Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:02:02Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:02:02Z"}],"name":"9b3326c40973f3bae861a4301f060e6309ac1149cb391b2ce57bd775c94f8c94","namespace":"kuadrant-system","resourceVersion":"93577","uid":"c51c7cab-b638-455c-9e3c-c1f451a4e74d"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["9b3326c40973f3bae861a4301f060e6309ac1149cb391b2ce57bd775c94f8c94"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w2-06e461.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w2-06e461.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:02:02Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:02:02Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["9b3326c40973f3bae861a4301f060e6309ac1149cb391b2ce57bd775c94f8c94"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"9b3326c40973f3bae861a4301f060e6309ac1149cb391b2ce57bd775c94f8c94\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:05:00.874Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d#rule-6"},"creationTimestamp":"2026-11-02T21:54:29Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:01:19Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:01:19Z"}],"name":"376d56a711fbb2b29d7c46a8a0998936174b738443f0db294a13f85fd8478a94","namespace":"kuadrant-system","resourceVersion":"92739","uid":"87249339-368d-4d8c-8467-fde5ee5d92d7"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["376d56a711fbb2b29d7c46a8a0998936174b738443f0db294a13f85fd8478a94"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:54:30Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:54:30Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["376d56a711fbb2b29d7c46a8a0998936174b738443f0db294a13f85fd8478a94"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"376d56a711fbb2b29d7c46a8a0998936174b738443f0db294a13f85fd8478a94\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:05:00.936Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-02T22:00:11Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:02:36Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:02:36Z"}],"name":"4623541d4c172040d64c605b4e3945edb2d59ccdd3ec6ed31cc6feffeeae1ab4","namespace":"kuadrant-system","resourceVersion":"94287","uid":"990c8478-b712-4db2-8c1e-a705a5dadddb"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["4623541d4c172040d64c605b4e3945edb2d59ccdd3ec6ed31cc6feffeeae1ab4"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:00:12Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:00:12Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["4623541d4c172040d64c605b4e3945edb2d59ccdd3ec6ed31cc6feffeeae1ab4"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"4623541d4c172040d64c605b4e3945edb2d59ccdd3ec6ed31cc6feffeeae1ab4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:05:00.999Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w2-06e461/auth-test-model-06e461-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w2-06e461/auth-test-model-06e461-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-02T22:02:02Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:02:02Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:02:02Z"}],"name":"782fff9577e2fa4f490d8cd7dd45f05e73a58ab6d5932bb26b584692ad58aa58","namespace":"kuadrant-system","resourceVersion":"93599","uid":"287d1ec6-55a6-4a6b-be89-63344bfb0586"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["782fff9577e2fa4f490d8cd7dd45f05e73a58ab6d5932bb26b584692ad58aa58"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w2-06e461.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w2-06e461.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:02:02Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:02:02Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["782fff9577e2fa4f490d8cd7dd45f05e73a58ab6d5932bb26b584692ad58aa58"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"782fff9577e2fa4f490d8cd7dd45f05e73a58ab6d5932bb26b584692ad58aa58\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:05:01.061Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-06e461","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-06e461#rule-5"},"creationTimestamp":"2026-11-02T21:57:01Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:57:01Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:57:01Z"}],"name":"5257a14d8fc9908d3b52cf96fc5c9a6cd32b6940ef72c0e96cba23b3ded3d1b4","namespace":"kuadrant-system","resourceVersion":"86272","uid":"e7756686-cd59-4df4-8a32-787b41c0b843"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["5257a14d8fc9908d3b52cf96fc5c9a6cd32b6940ef72c0e96cba23b3ded3d1b4"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w2-06e461.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w2-06e461.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:57:01Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:57:01Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["5257a14d8fc9908d3b52cf96fc5c9a6cd32b6940ef72c0e96cba23b3ded3d1b4"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"5257a14d8fc9908d3b52cf96fc5c9a6cd32b6940ef72c0e96cba23b3ded3d1b4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:05:01.124Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-02T22:00:10Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:02:33Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:02:34Z"}],"name":"91970f7ac4ae9dc8cc6500e528bc955ad2f35aa953cbdaa553658695f4221e2b","namespace":"kuadrant-system","resourceVersion":"94180","uid":"1891a855-8f30-4928-a271-c8c5ed78c71d"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["91970f7ac4ae9dc8cc6500e528bc955ad2f35aa953cbdaa553658695f4221e2b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:02:34Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:02:34Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["91970f7ac4ae9dc8cc6500e528bc955ad2f35aa953cbdaa553658695f4221e2b"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"91970f7ac4ae9dc8cc6500e528bc955ad2f35aa953cbdaa553658695f4221e2b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:05:01.188Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d#rule-2"},"creationTimestamp":"2026-11-02T21:54:29Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:01:20Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:01:20Z"}],"name":"65ad30c331bd08b64f99c2bfc9d23db3979d37b9d3b916cb76d08a0dfabf963a","namespace":"kuadrant-system","resourceVersion":"92786","uid":"6ff8c85b-eced-417f-a7cc-ef673cbc30f6"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["65ad30c331bd08b64f99c2bfc9d23db3979d37b9d3b916cb76d08a0dfabf963a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:54:30Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:54:30Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["65ad30c331bd08b64f99c2bfc9d23db3979d37b9d3b916cb76d08a0dfabf963a"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"65ad30c331bd08b64f99c2bfc9d23db3979d37b9d3b916cb76d08a0dfabf963a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:05:01.250Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-02T21:58:43Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:01:20Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:01:20Z"}],"name":"45c0e8af5bd103871f78f35176ade26570f4cd362b56658e846eb717266590b0","namespace":"kuadrant-system","resourceVersion":"92781","uid":"659c7f53-3eec-417b-9847-d21313b78119"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["45c0e8af5bd103871f78f35176ade26570f4cd362b56658e846eb717266590b0"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:58:43Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:58:43Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["45c0e8af5bd103871f78f35176ade26570f4cd362b56658e846eb717266590b0"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"45c0e8af5bd103871f78f35176ade26570f4cd362b56658e846eb717266590b0\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:05:01.314Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-06e461","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-06e461#rule-6"},"creationTimestamp":"2026-11-02T21:57:01Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:57:01Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:57:01Z"}],"name":"d385206b1115a96c9f0147bd3800677310b659b18edb542eabe78e9dcf3d5903","namespace":"kuadrant-system","resourceVersion":"86267","uid":"b43d6ebf-9aa0-440e-973d-639d520fc1a0"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d385206b1115a96c9f0147bd3800677310b659b18edb542eabe78e9dcf3d5903"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w2-06e461.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w2-06e461.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:57:01Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:57:01Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["d385206b1115a96c9f0147bd3800677310b659b18edb542eabe78e9dcf3d5903"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"d385206b1115a96c9f0147bd3800677310b659b18edb542eabe78e9dcf3d5903\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:05:01.375Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w0-0f0874","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w0-0f0874#rule-1"},"creationTimestamp":"2026-11-02T21:56:34Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:02:33Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:02:34Z"}],"name":"ffaef4e77ab77e038e2181351f7ed710141739ce5f70351bf42c0606b9215e72","namespace":"kuadrant-system","resourceVersion":"94176","uid":"0ae00e90-2d9e-4cd3-9880-e48b0f30deaa"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["ffaef4e77ab77e038e2181351f7ed710141739ce5f70351bf42c0606b9215e72"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:56:34Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:56:34Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["ffaef4e77ab77e038e2181351f7ed710141739ce5f70351bf42c0606b9215e72"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"ffaef4e77ab77e038e2181351f7ed710141739ce5f70351bf42c0606b9215e72\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:05:01.436Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d#rule-3"},"creationTimestamp":"2026-11-02T21:54:30Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:01:18Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:01:19Z"}],"name":"c3ead856f0c0807270869b6a467d9281b93eaaa8c65e788c4b6393073db2cbe8","namespace":"kuadrant-system","resourceVersion":"92722","uid":"f849a86d-55d5-4304-af00-b79e8250f69e"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["c3ead856f0c0807270869b6a467d9281b93eaaa8c65e788c4b6393073db2cbe8"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:54:31Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:54:31Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["c3ead856f0c0807270869b6a467d9281b93eaaa8c65e788c4b6393073db2cbe8"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"c3ead856f0c0807270869b6a467d9281b93eaaa8c65e788c4b6393073db2cbe8\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:05:01.498Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w0-0f0874","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w0-0f0874#rule-6"},"creationTimestamp":"2026-11-02T21:56:34Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:02:35Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:02:36Z"}],"name":"4676855aaad0efd1f263930f7407a2242dda7211d0408fa3820678f475f20874","namespace":"kuadrant-system","resourceVersion":"94273","uid":"e3d62d4f-d4b7-4603-a0dd-991806014450"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["4676855aaad0efd1f263930f7407a2242dda7211d0408fa3820678f475f20874"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:56:34Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:56:34Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["4676855aaad0efd1f263930f7407a2242dda7211d0408fa3820678f475f20874"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"4676855aaad0efd1f263930f7407a2242dda7211d0408fa3820678f475f20874\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:05:01.560Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w2-06e461/auth-test-model-06e461-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w2-06e461/auth-test-model-06e461-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-02T22:02:02Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:02:02Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:02:02Z"}],"name":"15c6b1eefed27150a7b7bdd1240715075bbd750a05cffb4b27f0e2e620e3ced7","namespace":"kuadrant-system","resourceVersion":"93594","uid":"b51fba3c-5c34-40c8-8c1f-52d338808c31"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["15c6b1eefed27150a7b7bdd1240715075bbd750a05cffb4b27f0e2e620e3ced7"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w2-06e461.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w2-06e461.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:02:02Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:02:02Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["15c6b1eefed27150a7b7bdd1240715075bbd750a05cffb4b27f0e2e620e3ced7"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"15c6b1eefed27150a7b7bdd1240715075bbd750a05cffb4b27f0e2e620e3ced7\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:05:01.631Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w0-6e535d/auth-test-model-6e535d-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-02T21:58:42Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:01:19Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:01:19Z"}],"name":"22782c8aa7f396a4922a49f49140671294f2d19b32614fd09a7f9d26e94f5aa9","namespace":"kuadrant-system","resourceVersion":"92732","uid":"937e8b3f-1de4-423d-b815-411839d38ba7"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["22782c8aa7f396a4922a49f49140671294f2d19b32614fd09a7f9d26e94f5aa9"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:01:19Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:01:19Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["22782c8aa7f396a4922a49f49140671294f2d19b32614fd09a7f9d26e94f5aa9"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"22782c8aa7f396a4922a49f49140671294f2d19b32614fd09a7f9d26e94f5aa9\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:05:01.706Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w0-0f0874/auth-test-model-0f0874-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-02T22:00:11Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:02:35Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:02:35Z"}],"name":"d7ae6cb43b0fd921cbdca5537d3e42177a4e37ae3027e062325ff19c6b954181","namespace":"kuadrant-system","resourceVersion":"94260","uid":"adfbbdc9-fd57-40d0-a305-0a35811b3af5"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d7ae6cb43b0fd921cbdca5537d3e42177a4e37ae3027e062325ff19c6b954181"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:00:11Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:00:11Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["d7ae6cb43b0fd921cbdca5537d3e42177a4e37ae3027e062325ff19c6b954181"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"d7ae6cb43b0fd921cbdca5537d3e42177a4e37ae3027e062325ff19c6b954181\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:05:01.914Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-a-w2-06e461-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-a-w2-06e461-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:05:02.122Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-b-w0-0f0874-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-b-w0-0f0874-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:05:02Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-extmod-a-8702a9","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-a-8702a9","reconcileID":"f2fce703-f84f-4759-a64b-127dd95a875d","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-extmod-a-8702a9","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T22:05:02Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-a-8702a9","event":"CREATE"}
{"level":"info","ts":"2026-11-02T22:05:02Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-02T22:05:02.465Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-a-w0-6e535d-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-a-w0-6e535d-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:05:02.529Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-a-w1-6689da-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-a-w1-6689da-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:05:02Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-02T22:05:02Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-02T22:05:02Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T22:05:02Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-extmod-a-8702a9","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-a-8702a9","reconcileID":"f5d89e6a-4c79-4ad4-9752-a06132d77105","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-extmod-a-8702a9","namespace":"openshift-ingress"}
{"level":"error","ts":"2026-11-02T22:05:03.015Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"auth-test-model-6e535d-kserve-route","namespace":"ai-tenant-e2e-shared-a-w0-6e535d","error":"httproutes.gateway.networking.k8s.io \"auth-test-model-6e535d-kserve-route\" not found"}
{"level":"info","ts":"2026-11-02T22:05:03Z","logger":"telemetry-policy-extension-controller","msg":"Warning: Reconciler returned both a non-zero result and a non-nil error. The result will always be ignored if the error is non-nil and the non-nil error causes requeuing with exponential backoff. For more details, see: https://pkg.go.dev/sigs.k8s.io/controller-runtime/pkg/reconcile#Reconciler","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-extmod-a-8702a9","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-a-8702a9","reconcileID":"f5d89e6a-4c79-4ad4-9752-a06132d77105"}
{"level":"error","ts":"2026-11-02T22:05:03Z","logger":"telemetry-policy-extension-controller","msg":"Reconciler error","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-extmod-a-8702a9","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-a-8702a9","reconcileID":"f5d89e6a-4c79-4ad4-9752-a06132d77105","error":"Operation cannot be fulfilled on telemetrypolicies.extensions.kuadrant.io \"maas-telemetry-e2e-extmod-a-8702a9\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:353\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-02T22:05:03Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-extmod-a-8702a9","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-a-8702a9","reconcileID":"a2ab7fb2-d8a3-4309-9abf-f50f1c94a6e3","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-extmod-a-8702a9","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T22:05:03Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-a-8702a9","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T22:05:03Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-02T22:05:03.154Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-a-w0-6e535d","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-shared-a-w0-6e535d\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:05:03.303Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"auth-test-model-0f0874-kserve-route","namespace":"ai-tenant-e2e-shared-b-w0-0f0874","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"auth-test-model-0f0874-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:05:03Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-02T22:05:03Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-02T22:05:03Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-02T22:05:03Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T22:05:03Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-a-8702a9","event":"UNKNOWN"}
{"level":"info","ts":"2026-11-02T22:05:03Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-02T22:05:03.680Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-extmod-a-8702a9","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-extmod-a-8702a9\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:05:04Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-02T22:05:04Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-02T22:05:04Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-02T22:05:04Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T22:05:15.346Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","AuthConfig","AuthPolicy","Limitador","Kuadrant","EnvoyFilter","HTTPRoute","Gateway","ConfigMap"],"eventTypes":{"create":3,"delete":2,"update":73}}
{"level":"info","ts":"2026-11-02T22:05:15.657Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:05:15.697Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T22:05:19.657Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T22:05:19.940Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:05:20.147Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T22:05:20.365Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:05:20.365Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T22:05:24.837Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:05:24.837Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:05:24.845Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T22:05:24.846Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:05:24.856Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:05:24.856Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-02T22:05:24.998Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:05:24.998Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T22:05:26.800Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-a-w4-7cde84-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-a-w4-7cde84-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:05:27.789Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-b-w4-58ca7f-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-b-w4-58ca7f-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:05:28.171Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-auth-test-model-58ca7f","namespace":"ai-tenant-e2e-shared-b-w4-58ca7f","uid":"39cdbcbc-a3d6-4748-b376-725e3a7176e5","error":"tokenratelimitpolicies.kuadrant.io \"maas-trlp-auth-test-model-58ca7f\" not found"}
{"level":"info","ts":"2026-11-02T22:05:28.410Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T22:05:28.410Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T22:05:30.175Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway"],"eventTypes":{"create":1}}
{"level":"info","ts":"2026-11-02T22:05:37.575Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:05:37.623Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:05:37.623Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:05:37.626Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:05:37.626Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T22:05:37.631Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"error","ts":"2026-11-02T22:05:37.635Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-extmod-a-8702a9","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/ratelimit":"true"},"name":"kuadrant-ratelimiting-e2e-extmod-a-8702a9","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-extmod-a-8702a9","uid":"87df46ef-eebd-404f-9838-79c6e9a89da0"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"limitador-limitador.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-ratelimit-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"limitador-limitador.kuadrant-system.svc.cluster.local","port_value":8081}}}}]}]},"name":"kuadrant-ratelimit-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-extmod-a-8702a9"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-extmod-a-8702a9\" already exists"}
{"level":"error","ts":"2026-11-02T22:05:37.744Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-extmod-a-8702a9","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"kuadrant-auth-e2e-extmod-a-8702a9","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-extmod-a-8702a9","uid":"87df46ef-eebd-404f-9838-79c6e9a89da0"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-auth-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local","port_value":50051}}}}]}]},"name":"kuadrant-auth-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-extmod-a-8702a9"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-extmod-a-8702a9\" already exists"}
{"level":"error","ts":"2026-11-02T22:05:37.746Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:05:37.746Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T22:05:37.791Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-8702a9","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-8702a9#rule-1"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"dcc003360f6371bfd59fb51dbe24d440140b656ade1906af00f891f8f3712ea6","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["dcc003360f6371bfd59fb51dbe24d440140b656ade1906af00f891f8f3712ea6"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-extmod-a-8702a9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-extmod-a-8702a9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"dcc003360f6371bfd59fb51dbe24d440140b656ade1906af00f891f8f3712ea6\" already exists"}
{"level":"error","ts":"2026-11-02T22:05:37.889Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-8702a9","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-8702a9#rule-3"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"4c1f793a8045d4e482f8695521e648924a4efb4beddcdb340057d2239cea08ce","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["4c1f793a8045d4e482f8695521e648924a4efb4beddcdb340057d2239cea08ce"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-extmod-a-8702a9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-extmod-a-8702a9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"4c1f793a8045d4e482f8695521e648924a4efb4beddcdb340057d2239cea08ce\" already exists"}
{"level":"error","ts":"2026-11-02T22:05:37.957Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-8702a9","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-8702a9#rule-4"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"952a70f76ce9bb4e633ebbd8a7937503120bb526cc40a11d97c2120eaf7d5cb2","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["952a70f76ce9bb4e633ebbd8a7937503120bb526cc40a11d97c2120eaf7d5cb2"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-extmod-a-8702a9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-extmod-a-8702a9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"952a70f76ce9bb4e633ebbd8a7937503120bb526cc40a11d97c2120eaf7d5cb2\" already exists"}
{"level":"error","ts":"2026-11-02T22:05:38.028Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-8702a9","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-8702a9#rule-5"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"b8041a514e8491778a83cb48d7dbe37a6744b17717fecbe9fa2ef12ea3d3704b","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["b8041a514e8491778a83cb48d7dbe37a6744b17717fecbe9fa2ef12ea3d3704b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-extmod-a-8702a9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-extmod-a-8702a9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"b8041a514e8491778a83cb48d7dbe37a6744b17717fecbe9fa2ef12ea3d3704b\" already exists"}
{"level":"error","ts":"2026-11-02T22:05:38.052Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-shared-a-w0-6e535d","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T21:54:30Z","generation":4,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"bb413150-c71f-467a-b73c-fc346914ff7a\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:04:44Z"}],"name":"kuadrant-e2e-shared-a-w0-6e535d","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-a-w0-6e535d","uid":"bb413150-c71f-467a-b73c-fc346914ff7a"}],"resourceVersion":"97208","uid":"79ec4380-cbc0-4c66-b610-cdb28384077b"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"376d56a711fbb2b29d7c46a8a0998936174b738443f0db294a13f85fd8478a94\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"3aa9e48facd88e18a7acef348feeaf654a1d4310d58727df558a9c5543ced772\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"65ad30c331bd08b64f99c2bfc9d23db3979d37b9d3b916cb76d08a0dfabf963a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"4593350858282f0ebeaf11b57850d5bccfa270a4b6088784a058e2d70b5cbe7c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"71e8c9bf81b77581f96b1cca4bb909b8434efbbb06bf9c9ec1aa5c8f412b9c76\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"01c09092684d0d3ed9db0ad6f53595f8d2c97286804d29e76075f2c30f05f44e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c3ead856f0c0807270869b6a467d9281b93eaaa8c65e788c4b6393073db2cbe8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"7d0e9eabd4ff8a0b65212f3d03a7b14a1e695503c8c41fb7cd6e844984ba7c69\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8b7e784474461510a9d9970d39fe03c297fc6f9a5f80873c40898bdfcb389e5f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"3cb722466e22fc9e58ad8f75bb3dbd6e1d2f9d75c3cfaafc5c6350857d59f964\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7482755e6f782100b8480fa82045aac768a6400e192241b0d0cf93403dad8edb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"af29fffcd438904723a318f8c7cd8dbe79f55578faf5560452874252825fdf46\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-shared-a-w0-6e535d"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-shared-a-w0-6e535d\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:05:38.101Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-8702a9","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-8702a9#rule-6"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"43fe43cf600a938cfdf3d1f28c8091519261999cc304be62b4bcd6090899abfd","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["43fe43cf600a938cfdf3d1f28c8091519261999cc304be62b4bcd6090899abfd"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-extmod-a-8702a9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-extmod-a-8702a9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"43fe43cf600a938cfdf3d1f28c8091519261999cc304be62b4bcd6090899abfd\" already exists"}
{"level":"error","ts":"2026-11-02T22:05:38.243Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-8702a9","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-8702a9#rule-2"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"ee5045507453ce2b860eb25ed20510343e9145d7ef328cddc7247dbc9a38aee2","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["ee5045507453ce2b860eb25ed20510343e9145d7ef328cddc7247dbc9a38aee2"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-extmod-a-8702a9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-extmod-a-8702a9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"ee5045507453ce2b860eb25ed20510343e9145d7ef328cddc7247dbc9a38aee2\" already exists"}
{"level":"error","ts":"2026-11-02T22:05:38.304Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/c8ebd64b293ad7c614b7021be06db91b0e0b0afb406d42f6c2500255bf064935","error":"authconfigs.authorino.kuadrant.io \"c8ebd64b293ad7c614b7021be06db91b0e0b0afb406d42f6c2500255bf064935\" not found"}
{"level":"error","ts":"2026-11-02T22:05:38.360Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/570e5848a361e3c9dd1e04eedfa2b9e8bd67123ca48082b249c1e62ddac6aa45","error":"authconfigs.authorino.kuadrant.io \"570e5848a361e3c9dd1e04eedfa2b9e8bd67123ca48082b249c1e62ddac6aa45\" not found"}
{"level":"error","ts":"2026-11-02T22:05:38.383Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-extmod-a-8702a9","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"name":"kuadrant-e2e-extmod-a-8702a9","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-extmod-a-8702a9","uid":"87df46ef-eebd-404f-9838-79c6e9a89da0"}]},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"43fe43cf600a938cfdf3d1f28c8091519261999cc304be62b4bcd6090899abfd\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-extmod-a-8702a9-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a9c41155\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-8702a9\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-extmod-a-8702a9\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a9c41155\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-8702a9\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-extmod-a-8702a9\"]}],\"name\":\"c85aeba75f89159ad9beb73d0be57509786abb729600c74c458bdd28b834fca4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ee5045507453ce2b860eb25ed20510343e9145d7ef328cddc7247dbc9a38aee2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-extmod-a-8702a9-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a9c41155\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-8702a9\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-extmod-a-8702a9\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a9c41155\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-8702a9\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-extmod-a-8702a9\"]}],\"name\":\"fcce412e42665dfd8b830d9e25d2b715def1dc3637b85ec03ab0815a4f157771\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b8041a514e8491778a83cb48d7dbe37a6744b17717fecbe9fa2ef12ea3d3704b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-extmod-a-8702a9-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a9c41155\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-8702a9\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-extmod-a-8702a9\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a9c41155\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-8702a9\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-extmod-a-8702a9\"]}],\"name\":\"1b3eeab41ad5ce7d3b174388c06d54c82ccd83a2869b009c35ac54f916693ce7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4c1f793a8045d4e482f8695521e648924a4efb4beddcdb340057d2239cea08ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-extmod-a-8702a9-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a9c41155\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-8702a9\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-extmod-a-8702a9\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a9c41155\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-8702a9\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-extmod-a-8702a9\"]}],\"name\":\"4af9b3718eca53f287b5985615433ab0d14b1bea75b93a3c00bcf99ed7503d81\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"952a70f76ce9bb4e633ebbd8a7937503120bb526cc40a11d97c2120eaf7d5cb2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-extmod-a-8702a9-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a9c41155\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-8702a9\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-extmod-a-8702a9\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a9c41155\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-8702a9\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-extmod-a-8702a9\"]}],\"name\":\"ceb238bf032776d99ea0ce9550761357e2987639b9e947646f6afc9eb4626cf8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"dcc003360f6371bfd59fb51dbe24d440140b656ade1906af00f891f8f3712ea6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-extmod-a-8702a9-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a9c41155\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-8702a9\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-extmod-a-8702a9\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__a9c41155\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-8702a9\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-extmod-a-8702a9\"]}],\"name\":\"12667dea8738b0eeef14b4fcd71fda7246859b9504bd463c757aa5e6d16f6668\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-extmod-a-8702a9"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-e2e-extmod-a-8702a9\" already exists"}
{"level":"error","ts":"2026-11-02T22:05:38.414Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/404142835a3977e1a9c2c43dac43764640a7632eade56ba3651c850858555e55","error":"authconfigs.authorino.kuadrant.io \"404142835a3977e1a9c2c43dac43764640a7632eade56ba3651c850858555e55\" not found"}
{"level":"error","ts":"2026-11-02T22:05:38.469Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/c88daf14f697a484e9c4281c2194076dd57e1afe0e40819b6ea26599cb703e8b","error":"authconfigs.authorino.kuadrant.io \"c88daf14f697a484e9c4281c2194076dd57e1afe0e40819b6ea26599cb703e8b\" not found"}
{"level":"error","ts":"2026-11-02T22:05:38.509Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-shared-a-w4-7cde84","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T21:54:29Z","generation":3,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"30a49997-f3b8-4b9e-a63d-efe4d247c707\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:03:23Z"}],"name":"kuadrant-e2e-shared-a-w4-7cde84","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-a-w4-7cde84","uid":"30a49997-f3b8-4b9e-a63d-efe4d247c707"}],"resourceVersion":"95331","uid":"a9161c5c-8421-407e-b216-c0f311a76a78"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f094d0f2e223afe06fc7ed6aadc41776a6cc59dda5ac644c150533c875567d8d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-7cde84-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/auth-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/auth-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]}],\"name\":\"e0111cf534990c5ef0dd56e75e3c4d91d51c85b44c04d545e22d35e167bab05f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w4-7cde84/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f094d0f2e223afe06fc7ed6aadc41776a6cc59dda5ac644c150533c875567d8d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-7cde84-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/auth-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/auth-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]}],\"name\":\"a9a815bfc98d80d4106ffec1c7de097591d1c24a1e6581d90e650a196e451ff9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w4-7cde84/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f094d0f2e223afe06fc7ed6aadc41776a6cc59dda5ac644c150533c875567d8d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-7cde84-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/auth-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/auth-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]}],\"name\":\"13f1606b5fdc71d5c366fb8c684ef968cc32b700b944276668894f80eaf4e924\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w4-7cde84/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f094d0f2e223afe06fc7ed6aadc41776a6cc59dda5ac644c150533c875567d8d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-7cde84-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/auth-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/auth-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]}],\"name\":\"4e932ba956790dd7e7e73270796e7f0aebf3a2a5f3919c8fdfced9b3d92d98e6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w4-7cde84/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f094d0f2e223afe06fc7ed6aadc41776a6cc59dda5ac644c150533c875567d8d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-7cde84-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/auth-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/auth-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]}],\"name\":\"6da19ffe2b311d9a78389a447244effb024ac2ffb6e6916d5117acefe4a19b06\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w4-7cde84/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f094d0f2e223afe06fc7ed6aadc41776a6cc59dda5ac644c150533c875567d8d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-7cde84-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/auth-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/auth-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]}],\"name\":\"f6f6019cb96125ca49299956536423ff9825e821d35cc0e26ab86b7d395a8eac\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w4-7cde84/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f094d0f2e223afe06fc7ed6aadc41776a6cc59dda5ac644c150533c875567d8d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-7cde84-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/auth-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/auth-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]}],\"name\":\"cfae647dee73dc9cb5e8b46832f70d4b4dbcab4da08405e06d5f78fc40f4d1ef\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w4-7cde84/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f094d0f2e223afe06fc7ed6aadc41776a6cc59dda5ac644c150533c875567d8d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-7cde84-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/auth-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/auth-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]}],\"name\":\"9e38481563d9b7be54c217c600558e868968f073d604ee1cbc866e211e76a366\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w4-7cde84/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0f923fa7f17446f382fb056bef7c9cc2146361c32cb89e19da4e6397505de43c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-7cde84-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-7cde84\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-7cde84\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]}],\"name\":\"6fb04747cbba17c2d2edd73660c4e50eec6f0ee924099f26ff442586021553ed\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"dd010c172c72fd48c51e28a4460597e56fdbfdd446ca72b922184a35932738ed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-7cde84-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/auth-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/auth-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]}],\"name\":\"5642800b42cb5a776cfe56c859382bfd5addf8d879d35f942035aaf884ec0208\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-a-w4-7cde84/models/facebook/opt-125m/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"45f9d7d09f974f5d9052f9533c8f3080f9da3799b3cc3a935a234851c01d48a6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-7cde84-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/auth-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/auth-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]}],\"name\":\"4db1ae2d126f7ec1580f836c0a9bd66e99fe08587046bb6f00c9e2ea0bbd868b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-a-w4-7cde84/models/facebook/opt-125m/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"94f9a5561f450c328575596e31e002775cbaced6edccf16a3a845fc83e5c6674\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-7cde84-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/auth-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/auth-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]}],\"name\":\"585b0eb85ecf584f1cf508c333365b20a24b3e122b2b49844e8b9eb963c396b5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-a-w4-7cde84/models/facebook/opt-125m/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d8de5232c6cb8746e6aa4c7f7b0b3a4dded70343ecbd9902be4a0ed74410c67d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-7cde84-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/auth-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/auth-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]}],\"name\":\"a506ac7642a9e6741e52f79704b5298288b12d72c049a3f883c5c73fac266556\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-a-w4-7cde84/models/facebook/opt-125m/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5b93fc9c5e970990ffcb287b0d50656f12bc0e49af91a8d2ec4b5eeb13bf1605\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-7cde84-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/auth-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/auth-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]}],\"name\":\"92f96c124ee5c65254cfe96e606beace7db0804dca8226c01c6aae1aa4068ac8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-a-w4-7cde84/auth-test-model-7cde84/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"601c281199237b14b77723b8a3a2ef6b8c0cbc3d025cea3c982fb1f47fa4e0f1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-7cde84-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/auth-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/auth-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]}],\"name\":\"3966d73f2d97816a10f933e903c26455289ee82b8d1fcd6d2070e5923338f84c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-a-w4-7cde84/auth-test-model-7cde84/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ca7eaca12054f736e1a75bbf6bd1ae5564a0b1bf6a98bf677f639993d7694776\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-7cde84-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/auth-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/auth-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]}],\"name\":\"84beaa70a791549b9ef855190b6a63b7f7aaf4694f7074d66cf8fb8caf81ce36\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-a-w4-7cde84/auth-test-model-7cde84/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ce915460df65410db1fd4ff8dd446cf14e70be86a1abdc1b3ee163aeb0f06056\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-7cde84-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/auth-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/auth-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]}],\"name\":\"d1bb09cb51511b0962b21431afb769f7cca26e319870b349235ddcc563f9b9ac\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-a-w4-7cde84/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"306fe676dfc4eeb84a7c1f3a78b631a24fea353e25b6003715990d4436533a42\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-7cde84-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/auth-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/auth-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]}],\"name\":\"ee5163881ece110e7bc3230bebb042887545dea3b775aaa705629def059541db\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-a-w4-7cde84/auth-test-model-7cde84/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7d3a19ba3d0056b14ca28c38813af8fa97210159c5ccca4047769f3e771355d0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-7cde84-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/auth-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/auth-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]}],\"name\":\"ec2847e2093c689d2f10e64dfe26e773250301cd0cea12afb4fc8382a429b313\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-a-w4-7cde84/auth-test-model-7cde84')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"150da2804d58820302b448e24151b1f189b717cd68a8c1e110fba61141165eb0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-7cde84-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-7cde84\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-7cde84\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]}],\"name\":\"e314acde8746b9db89412919be5da708b16f912df85d7b1e19c5983d2065f729\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"45531229ceac4cfcba16f0f8d809077fb7e19e248278c544ac9fd018c419ef18\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-7cde84-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-7cde84\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-7cde84\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]}],\"name\":\"5d1e4a29bea3f2db952d9e19481c737e780a5cc72dc0934c1c2012a39bc18efd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f6229ee2157250d6d160cdc978e612aa3a7c43bb558942020078c3f42c450c79\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-7cde84-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-7cde84\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-7cde84\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]}],\"name\":\"228840b91d117fcc6420f8e81c02a72767236079f030e5ad6e1f7df8d2bfef2f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"96cad25fbcf27b7341cae948477117cfaf58cb098cf23b68e9b61e9380b5dbab\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-7cde84-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-7cde84\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-7cde84\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]}],\"name\":\"7f37843572934e12cedf2d78614afd5eacc9ed1f0ea54fe933bb17625146accc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"75661500a5114b056fb7b7fa79b052930433ec107cb332756c581a2f0de24173\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-7cde84-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-7cde84\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-7cde84\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]}],\"name\":\"f6e55ef63865313913827adc1faf8eb8ccb447468294af4335a4df4ebb61a404\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"09131f977263f1238410e0a8c5d46f7d7f662ec9e1cc5421b4e618f4a8b3901a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-7cde84-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/auth-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/auth-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]}],\"name\":\"18353c58ccefd2011a7687649649d4f00ee770c2a6b4900ae2a74fbf2d541cf6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w4-7cde84/models/facebook/opt-125m')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-shared-a-w4-7cde84"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-shared-a-w4-7cde84\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:05:38.524Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/488fa6498257bae79da02565203c68726b20b3ff1190dd0f76f1d15f3016b91c","error":"authconfigs.authorino.kuadrant.io \"488fa6498257bae79da02565203c68726b20b3ff1190dd0f76f1d15f3016b91c\" not found"}
{"level":"error","ts":"2026-11-02T22:05:38.578Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/e7b7d686afb3e980f4fa7e5e90b69836684133b1852ad79e11efb71a5156e402","error":"authconfigs.authorino.kuadrant.io \"e7b7d686afb3e980f4fa7e5e90b69836684133b1852ad79e11efb71a5156e402\" not found"}
{"level":"error","ts":"2026-11-02T22:05:38.636Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/a7a0dc3cdf8fe8f61255465b2a28cb24f80d6467505607084b4be4b883494ef6","error":"authconfigs.authorino.kuadrant.io \"a7a0dc3cdf8fe8f61255465b2a28cb24f80d6467505607084b4be4b883494ef6\" not found"}
{"level":"error","ts":"2026-11-02T22:05:38.691Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/d82605cc2995db10d6c22eaf50ce1b24ce92305a4b1b2cf9ef796dc4a0e019f0","error":"authconfigs.authorino.kuadrant.io \"d82605cc2995db10d6c22eaf50ce1b24ce92305a4b1b2cf9ef796dc4a0e019f0\" not found"}
{"level":"error","ts":"2026-11-02T22:05:38.746Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/2ebd46ffb051e67477198ab6753e8d28c9a38e121382759fb2d52a04e59f9b60","error":"authconfigs.authorino.kuadrant.io \"2ebd46ffb051e67477198ab6753e8d28c9a38e121382759fb2d52a04e59f9b60\" not found"}
{"level":"error","ts":"2026-11-02T22:05:38.801Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/22782c8aa7f396a4922a49f49140671294f2d19b32614fd09a7f9d26e94f5aa9","error":"authconfigs.authorino.kuadrant.io \"22782c8aa7f396a4922a49f49140671294f2d19b32614fd09a7f9d26e94f5aa9\" not found"}
{"level":"error","ts":"2026-11-02T22:05:38.858Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/17286683a6178785a8017d68de67b058e3a1963e7ba7f06b1101054db0cebfb1","error":"authconfigs.authorino.kuadrant.io \"17286683a6178785a8017d68de67b058e3a1963e7ba7f06b1101054db0cebfb1\" not found"}
{"level":"error","ts":"2026-11-02T22:05:38.913Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/45c0e8af5bd103871f78f35176ade26570f4cd362b56658e846eb717266590b0","error":"authconfigs.authorino.kuadrant.io \"45c0e8af5bd103871f78f35176ade26570f4cd362b56658e846eb717266590b0\" not found"}
{"level":"error","ts":"2026-11-02T22:05:39.423Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-a-w2-06e461-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-a-w2-06e461-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:05:39.486Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-b-w4-58ca7f-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-b-w4-58ca7f-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:05:39.525Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-extmod-a-8702a9","namespace":"openshift-ingress","uid":"d98e42ee-9b9a-44cd-84f9-b0f38964c5d9","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-extmod-a-8702a9\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:05:39.549Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-a-w0-6e535d-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-a-w0-6e535d-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:05:39.815Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-b-w0-0f0874-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-b-w0-0f0874-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:05:39.879Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-extmod-a-8702a9-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-extmod-a-8702a9-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:05:39.939Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-auth-test-model-58ca7f","namespace":"ai-tenant-e2e-shared-b-w4-58ca7f","uid":"39cdbcbc-a3d6-4748-b376-725e3a7176e5","error":"tokenratelimitpolicies.kuadrant.io \"maas-trlp-auth-test-model-58ca7f\" not found"}
{"level":"error","ts":"2026-11-02T22:05:40.116Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-a-w4-7cde84","namespace":"openshift-ingress","uid":"83e46bfa-f121-4136-adc9-a9e6690edeab","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-a-w4-7cde84\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:05:40.221Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-a-w4-7cde84-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-a-w4-7cde84-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:05:41.029Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T22:05:41.029Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T22:05:41.433Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"maas-api-route-e2e-extmod-a-8702a9","namespace":"odh-ai-gateway-infra","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"maas-api-route-e2e-extmod-a-8702a9\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:05:41.602Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-b-w4-58ca7f","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-shared-b-w4-58ca7f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:05:41.661Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-b-w0-0f0874","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-shared-b-w0-0f0874\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:05:41.744Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"auth-test-model-7cde84-kserve-route","namespace":"ai-tenant-e2e-shared-a-w4-7cde84","error":"httproutes.gateway.networking.k8s.io \"auth-test-model-7cde84-kserve-route\" not found"}
{"level":"error","ts":"2026-11-02T22:05:41.971Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-extmod-a-8702a9","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-extmod-a-8702a9\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:05:42.029Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-a-w4-7cde84","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-shared-a-w4-7cde84\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:05:49.534Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","EnvoyFilter","AuthPolicy","Gateway","TokenRateLimitPolicy","Limitador","HTTPRoute","ConfigMap"],"eventTypes":{"create":12,"delete":16,"update":17}}
{"level":"info","ts":"2026-11-02T22:05:49.781Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T22:05:52.568Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T22:05:52.763Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:05:52.763Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T22:05:56.538Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:05:56.543Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:05:56.550Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T22:05:56.551Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:05:56.551Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T22:05:56.554Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:05:56.704Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T22:06:01.705Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T22:06:01.705Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T22:06:10.034Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthPolicy","AuthConfig","TokenRateLimitPolicy","EnvoyFilter","ConfigMap","HTTPRoute","Limitador"],"eventTypes":{"delete":36,"update":27}}
{"level":"info","ts":"2026-11-02T22:06:10.331Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T22:06:12.434Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T22:06:12.660Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:06:12.660Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T22:06:16.333Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:06:16.335Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:06:16.346Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-02T22:06:16.346Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T22:06:16.356Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:06:16.365Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:06:16.365Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T22:06:19.649Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T22:06:19.649Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T22:06:27.988Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","AuthConfig","AuthPolicy","ConfigMap","Limitador"],"eventTypes":{"update":45}}
{"level":"info","ts":"2026-11-02T22:06:28.337Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T22:06:30.551Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T22:06:30.669Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:06:30.669Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T22:06:34.450Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:06:34.462Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:06:34.472Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-02T22:06:34.472Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T22:06:34.544Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:06:34.559Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:06:34.559Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T22:06:37.884Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T22:06:37.884Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T22:06:41Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-extmod-a-9981d2","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-a-9981d2","reconcileID":"e96bc34f-2f2c-42be-b7de-f97481602ab5","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-extmod-a-9981d2","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T22:06:41Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-a-9981d2","event":"CREATE"}
{"level":"info","ts":"2026-11-02T22:06:41Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T22:06:41Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-02T22:06:41Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-02T22:06:41Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T22:06:41Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-extmod-a-9981d2","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-a-9981d2","reconcileID":"e9e84c4c-da56-4a67-9fe9-b89c3b9b0a54","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-extmod-a-9981d2","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T22:06:42Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-a-9981d2","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T22:06:42Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T22:06:42Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-02T22:06:42Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-02T22:06:42Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-02T22:06:42Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T22:06:46.560Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Kuadrant","Gateway","ConfigMap","AuthPolicy","HTTPRoute"],"eventTypes":{"create":2,"update":4}}
{"level":"info","ts":"2026-11-02T22:06:46.866Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:06:46.886Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T22:06:50.263Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:06:50.540Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T22:06:50.552Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T22:06:50.723Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:06:50.723Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T22:06:54.550Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:06:54.552Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:06:54.569Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:06:54.627Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T22:06:54.637Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:06:54.637Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T22:06:54.766Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T22:06:56Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-shared-b-w1-5ddbd0","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-b-w1-5ddbd0","reconcileID":"5bf90322-1266-48a7-b88b-49bb5859bdc1","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-shared-b-w1-5ddbd0","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T22:06:56Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-b-w1-5ddbd0","event":"CREATE"}
{"level":"info","ts":"2026-11-02T22:06:56Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T22:06:57Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-02T22:06:57Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-02T22:06:57Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T22:06:57Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-shared-b-w1-5ddbd0","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-b-w1-5ddbd0","reconcileID":"cb8c4ee5-f1f3-49b2-b292-2a320942d59f","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-shared-b-w1-5ddbd0","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T22:06:57Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-b-w1-5ddbd0","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T22:06:57Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T22:06:57Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-02T22:06:57Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-02T22:06:57Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-02T22:06:57Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T22:06:58.127Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T22:06:58.127Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T22:06:58.402Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-b-w1-5ddbd0","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-shared-b-w1-5ddbd0\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:07:00.040Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthPolicy","Kuadrant","TokenRateLimitPolicy"],"eventTypes":{"create":2,"update":1}}
{"level":"info","ts":"2026-11-02T22:07:00.363Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:07:00.423Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T22:07:03.261Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T22:07:03.838Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:07:04.153Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T22:07:04.344Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:07:04.344Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T22:07:08.140Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:07:08.151Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:07:08.154Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:07:08.154Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T22:07:08.158Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T22:07:08.158Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-11-02T22:07:08.202Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-extmod-a-9981d2","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/ratelimit":"true"},"name":"kuadrant-ratelimiting-e2e-extmod-a-9981d2","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-extmod-a-9981d2","uid":"711d9b03-2eaf-4618-a1ee-f54d0fd91c96"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"limitador-limitador.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-ratelimit-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"limitador-limitador.kuadrant-system.svc.cluster.local","port_value":8081}}}}]}]},"name":"kuadrant-ratelimit-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-extmod-a-9981d2"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-extmod-a-9981d2\" already exists"}
{"level":"error","ts":"2026-11-02T22:07:08.261Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:07:08.261Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T22:07:08.268Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-9981d2","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-9981d2#rule-3"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"dd1b88707253ad02344e5cf8519b15dc472dad64394067bc8528905a15edfe3b","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["dd1b88707253ad02344e5cf8519b15dc472dad64394067bc8528905a15edfe3b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-extmod-a-9981d2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-extmod-a-9981d2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"dd1b88707253ad02344e5cf8519b15dc472dad64394067bc8528905a15edfe3b\" already exists"}
{"level":"error","ts":"2026-11-02T22:07:08.311Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-extmod-a-9981d2","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"kuadrant-auth-e2e-extmod-a-9981d2","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-extmod-a-9981d2","uid":"711d9b03-2eaf-4618-a1ee-f54d0fd91c96"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-auth-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local","port_value":50051}}}}]}]},"name":"kuadrant-auth-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-extmod-a-9981d2"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-extmod-a-9981d2\" already exists"}
{"level":"error","ts":"2026-11-02T22:07:08.334Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-9981d2","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-9981d2#rule-1"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"e2db3539288b8fded9c21f86b104d6cb027d08994877a52655731082c7f13aab","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["e2db3539288b8fded9c21f86b104d6cb027d08994877a52655731082c7f13aab"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-extmod-a-9981d2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-extmod-a-9981d2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"e2db3539288b8fded9c21f86b104d6cb027d08994877a52655731082c7f13aab\" already exists"}
{"level":"error","ts":"2026-11-02T22:07:08.401Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-9981d2","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-9981d2#rule-5"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"2b3df20e8b38156488201f24bd07403597a3ee9a299eb1765c6a2364fd9d5a19","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["2b3df20e8b38156488201f24bd07403597a3ee9a299eb1765c6a2364fd9d5a19"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-extmod-a-9981d2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-extmod-a-9981d2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"2b3df20e8b38156488201f24bd07403597a3ee9a299eb1765c6a2364fd9d5a19\" already exists"}
{"level":"error","ts":"2026-11-02T22:07:08.630Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-9981d2","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-9981d2#rule-2"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"9519ccab5d12fc7287d943fc71f19110d90ef6c19edab74a228d71ebb29531ba","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["9519ccab5d12fc7287d943fc71f19110d90ef6c19edab74a228d71ebb29531ba"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-extmod-a-9981d2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-extmod-a-9981d2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"9519ccab5d12fc7287d943fc71f19110d90ef6c19edab74a228d71ebb29531ba\" already exists"}
{"level":"error","ts":"2026-11-02T22:07:08.697Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-9981d2","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-9981d2#rule-6"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"3742d5f4ac1e4aeae03c8674f111ed22224ae7c3afb891ed750abdb47e8d30e3","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["3742d5f4ac1e4aeae03c8674f111ed22224ae7c3afb891ed750abdb47e8d30e3"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-extmod-a-9981d2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-extmod-a-9981d2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"3742d5f4ac1e4aeae03c8674f111ed22224ae7c3afb891ed750abdb47e8d30e3\" already exists"}
{"level":"error","ts":"2026-11-02T22:07:08.768Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-extmod-a-9981d2","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"name":"kuadrant-e2e-extmod-a-9981d2","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-extmod-a-9981d2","uid":"711d9b03-2eaf-4618-a1ee-f54d0fd91c96"}]},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3742d5f4ac1e4aeae03c8674f111ed22224ae7c3afb891ed750abdb47e8d30e3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-extmod-a-9981d2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__29fbd049\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-9981d2\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-extmod-a-9981d2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__29fbd049\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-9981d2\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-extmod-a-9981d2\"]}],\"name\":\"58a6889c2376a6382e5af6bc64a32c1d8b96ebdd7e4c1e60bfb3ad1db857ccc8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9519ccab5d12fc7287d943fc71f19110d90ef6c19edab74a228d71ebb29531ba\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-extmod-a-9981d2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__29fbd049\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-9981d2\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-extmod-a-9981d2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__29fbd049\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-9981d2\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-extmod-a-9981d2\"]}],\"name\":\"e2e01242be4ecd4cf8a2ced5b75574850d08d339583f9f63dd7eec1d8755dae7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2b3df20e8b38156488201f24bd07403597a3ee9a299eb1765c6a2364fd9d5a19\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-extmod-a-9981d2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__29fbd049\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-9981d2\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-extmod-a-9981d2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__29fbd049\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-9981d2\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-extmod-a-9981d2\"]}],\"name\":\"f0d1bb9d1a47ed566f841bf9fd1954300ed80b31862476d20415737462680b6b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"dd1b88707253ad02344e5cf8519b15dc472dad64394067bc8528905a15edfe3b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-extmod-a-9981d2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__29fbd049\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-9981d2\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-extmod-a-9981d2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__29fbd049\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-9981d2\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-extmod-a-9981d2\"]}],\"name\":\"4db6995b26e79e82407e81b0980cd18a193684ae79dd293556b6a07d8cb79028\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"76357ed717983f505f26065c47c15517d662b4818a3f40e88b6e17bacee0a5ca\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-extmod-a-9981d2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__29fbd049\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-9981d2\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-extmod-a-9981d2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__29fbd049\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-9981d2\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-extmod-a-9981d2\"]}],\"name\":\"66ea23710a0ee4981e64358458c7627ad119a132ef203da5757e396ca754d786\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e2db3539288b8fded9c21f86b104d6cb027d08994877a52655731082c7f13aab\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-extmod-a-9981d2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__29fbd049\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-9981d2\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-extmod-a-9981d2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__29fbd049\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-9981d2\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-extmod-a-9981d2\"]}],\"name\":\"716ea26072e32a07828cd67e71adc60fd1f666cd6c7e460e9a38d4e5541f73ca\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-extmod-a-9981d2"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-e2e-extmod-a-9981d2\" already exists"}
{"level":"error","ts":"2026-11-02T22:07:08.768Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-9981d2","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-9981d2#rule-4"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"76357ed717983f505f26065c47c15517d662b4818a3f40e88b6e17bacee0a5ca","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["76357ed717983f505f26065c47c15517d662b4818a3f40e88b6e17bacee0a5ca"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-extmod-a-9981d2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-extmod-a-9981d2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"76357ed717983f505f26065c47c15517d662b4818a3f40e88b6e17bacee0a5ca\" already exists"}
{"level":"error","ts":"2026-11-02T22:07:09.929Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w0-0c9014","namespace":"e2e-models-e2e-worker-w0-0c9014","uid":"dcb5a0e4-7049-4ddc-91de-e14d55b09789","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w0-0c9014\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:07:09.988Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-b-w4-58ca7f","namespace":"openshift-ingress","uid":"5187151d-dfe9-40c2-b03b-5e9a20a0d12c","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-b-w4-58ca7f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:07:10.046Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w3-f51151","namespace":"e2e-models-e2e-worker-w3-f51151","uid":"c78aa03a-e3ca-4797-8a09-ab0d9cd88148","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w3-f51151\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:07:10.104Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-facebook-opt-125m-simulated","namespace":"llm","uid":"da8edb1a-ed61-454d-939f-fc7cd235d9fb","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-facebook-opt-125m-simulated\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:07:10.221Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-extmod-a-8702a9","namespace":"openshift-ingress","uid":"d98e42ee-9b9a-44cd-84f9-b0f38964c5d9","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-extmod-a-8702a9\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:07:10.334Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-extmod-a-9981d2-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-extmod-a-9981d2-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:07:10.397Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-b-w0-0f0874","namespace":"openshift-ingress","uid":"8b4ec7cb-daa9-467a-b2f6-528aa3d837fc","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-b-w0-0f0874\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:07:10.455Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w0-0c9014","namespace":"e2e-models-e2e-worker-w0-0c9014","uid":"4f647df6-1d5b-433b-b4fc-1279ff1755f7","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w0-0c9014\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:07:10.513Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-auth-test-model-06e461","namespace":"ai-tenant-e2e-shared-a-w2-06e461","uid":"110981c5-d068-44b6-9a0e-d102cfd9433c","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-auth-test-model-06e461\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:07:10.631Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w2-6fa533","namespace":"e2e-models-e2e-worker-w2-6fa533","uid":"2ff73667-c2c3-4579-9503-b6ca098f1021","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w2-6fa533\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:07:10.689Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w4-d6cb38","namespace":"e2e-models-e2e-worker-w4-d6cb38","uid":"0d3ebd35-5005-4ee4-a055-ff95546e3673","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w4-d6cb38\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:07:10.747Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-a-w3-97995b","namespace":"openshift-ingress","uid":"9405e4ea-22ff-4c46-bbc0-f492e0e403dc","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-a-w3-97995b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:07:10.807Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w1-5f765a","namespace":"e2e-models-e2e-worker-w1-5f765a","uid":"7188eadc-9748-4be8-a5e2-d904cf5b6130","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w1-5f765a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:07:10.865Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-a-w0-6e535d","namespace":"openshift-ingress","uid":"0eae774a-4032-4461-b2be-6f3edd911a80","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-a-w0-6e535d\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:07:10.923Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w2-6fa533","namespace":"e2e-models-e2e-worker-w2-6fa533","uid":"3a128bb2-de88-49aa-ab9e-c8626107a077","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w2-6fa533\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:07:10.981Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w4-d6cb38","namespace":"e2e-models-e2e-worker-w4-d6cb38","uid":"486176e6-7786-40c4-9ce0-6f4a68b408b2","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w4-d6cb38\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:07:11.099Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-a-w1-6689da","namespace":"openshift-ingress","uid":"ef7c9ccc-2321-4db6-a8e9-5ce03089e75e","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-a-w1-6689da\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:07:11.157Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-b-w3-a1d751","namespace":"openshift-ingress","uid":"2c7a0593-2f35-427a-b6f0-958582546c18","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-b-w3-a1d751\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:07:11.216Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-simulated-simulated-premium","namespace":"llm","uid":"447993be-3c57-4e68-8ffa-6fc998a39c77","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-simulated-simulated-premium\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:07:11.334Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w1-5f765a","namespace":"e2e-models-e2e-worker-w1-5f765a","uid":"9c852546-ee7c-4e72-855c-111315f7bf82","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w1-5f765a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:07:11.393Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-a-w4-7cde84","namespace":"openshift-ingress","uid":"83e46bfa-f121-4136-adc9-a9e6690edeab","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-a-w4-7cde84\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:07:11.451Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-b-w2-c7e71f","namespace":"openshift-ingress","uid":"6decd2e5-6aa1-451b-97e5-5dd8911def76","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-b-w2-c7e71f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:07:11.510Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-extmod-a-9981d2","namespace":"openshift-ingress","uid":"8ecf93b7-604b-456a-b6fb-921118f5a9f0","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-extmod-a-9981d2\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:07:11.568Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w3-f51151","namespace":"e2e-models-e2e-worker-w3-f51151","uid":"e3340067-224a-43ad-8020-ca9e00ead152","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w3-f51151\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:07:11.568Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T22:07:11.568Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T22:07:11.740Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-extmod-a-9981d2","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-extmod-a-9981d2\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:07:11.798Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-b-w1-5ddbd0","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-shared-b-w1-5ddbd0\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:07:11.822Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"maas-api-route-e2e-extmod-a-9981d2","namespace":"odh-ai-gateway-infra","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"maas-api-route-e2e-extmod-a-9981d2\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:07:20.139Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","EnvoyFilter","Gateway","AuthConfig","ConfigMap","HTTPRoute","Limitador","Kuadrant","AuthPolicy"],"eventTypes":{"create":13,"update":30}}
{"level":"info","ts":"2026-11-02T22:07:20.381Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:07:20.401Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T22:07:21Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-extmod-a-1538c4","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-a-1538c4","reconcileID":"250ad63b-9c36-4c82-b673-918b8557d666","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-extmod-a-1538c4","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T22:07:21Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-a-1538c4","event":"CREATE"}
{"level":"info","ts":"2026-11-02T22:07:21Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T22:07:23.665Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T22:07:24.047Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T22:07:24.123Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:07:24.240Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:07:24.240Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T22:07:24Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-02T22:07:24Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-02T22:07:24Z","logger":"telemetry-policy-extension-controller","msg":"Failed to update status: resource might just be outdated"}
{"level":"info","ts":"2026-11-02T22:07:24Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T22:07:24Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-extmod-a-1538c4","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-a-1538c4","reconcileID":"989a3608-50e1-47bc-997a-001d89b3b667","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-extmod-a-1538c4","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T22:07:24Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-a-1538c4","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T22:07:24Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T22:07:25Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-02T22:07:25Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-02T22:07:25Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T22:07:25Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-extmod-a-1538c4","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-a-1538c4","reconcileID":"e5e025e2-83d3-4c6c-bd7b-d5fe613c9209","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-extmod-a-1538c4","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T22:07:25Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-a-1538c4","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T22:07:25Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T22:07:27Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-02T22:07:27Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-02T22:07:27Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-02T22:07:27Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T22:07:28.477Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:07:28.477Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T22:07:28.478Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:07:28.478Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:07:28.485Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T22:07:28.461Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:07:28.625Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T22:07:32.167Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T22:07:32.167Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T22:07:33.634Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-extmod-a-1538c4","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-extmod-a-1538c4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:07:41.563Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthPolicy","TokenRateLimitPolicy","HTTPRoute","AuthConfig","EnvoyFilter","Gateway","Kuadrant","Limitador","ConfigMap"],"eventTypes":{"create":12,"update":14}}
{"level":"info","ts":"2026-11-02T22:07:41.901Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:07:41.908Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T22:07:46.853Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T22:07:46.932Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T22:07:47.171Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:07:47.171Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T22:07:47.260Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:07:51.068Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:07:51.074Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:07:51.082Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T22:07:51.082Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:07:51.082Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T22:07:51.085Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-11-02T22:07:51.257Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:07:51.257Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T22:07:52.979Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-auth-test-model-06e461","namespace":"ai-tenant-e2e-shared-a-w2-06e461","uid":"110981c5-d068-44b6-9a0e-d102cfd9433c","error":"tokenratelimitpolicies.kuadrant.io \"maas-trlp-auth-test-model-06e461\" not found"}
{"level":"info","ts":"2026-11-02T22:07:54.892Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T22:07:54.892Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T22:08:07.041Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway","HTTPRoute","TokenRateLimitPolicy","AuthConfig","AuthPolicy","EnvoyFilter","Limitador","ConfigMap"],"eventTypes":{"create":9,"delete":1,"update":8}}
{"level":"info","ts":"2026-11-02T22:08:07.390Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T22:08:09.950Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T22:08:10.144Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:08:10.144Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T22:08:14.252Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:08:14.265Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:08:14.285Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:08:14.326Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T22:08:14.339Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:08:14.339Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T22:08:14.534Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T22:08:17Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-extmod-b-6ba06f","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-b-6ba06f","reconcileID":"54379cd6-ee4c-4ba6-a978-5d4941fa2ada","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-extmod-b-6ba06f","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T22:08:17Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-b-6ba06f","event":"CREATE"}
{"level":"info","ts":"2026-11-02T22:08:17Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T22:08:17Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-02T22:08:17Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-02T22:08:17Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T22:08:17Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-extmod-b-6ba06f","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-b-6ba06f","reconcileID":"d7b42b0f-c34e-4d68-a75c-3e0a1908568e","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-extmod-b-6ba06f","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T22:08:17Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-b-6ba06f","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T22:08:17Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T22:08:18Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-02T22:08:18Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-02T22:08:18Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-02T22:08:18Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T22:08:18Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-extmod-b-6ba06f","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-b-6ba06f","reconcileID":"902ac6e9-ecb2-4f54-9bc5-473dbbefa536","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-extmod-b-6ba06f","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T22:08:18Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-b-6ba06f","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T22:08:18Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T22:08:18.746Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T22:08:18.746Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T22:08:18Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-02T22:08:18Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-02T22:08:18Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-02T22:08:18Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"error","ts":"2026-11-02T22:08:20.105Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-extmod-b-6ba06f","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-extmod-b-6ba06f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:08:20.626Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthPolicy","Gateway","TokenRateLimitPolicy","HTTPRoute"],"eventTypes":{"delete":2,"update":3}}
{"level":"info","ts":"2026-11-02T22:08:27.450Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:08:27.457Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:08:27.464Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T22:08:27.465Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:08:27.468Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:08:27.469Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-02T22:08:27.567Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:08:27.567Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T22:08:27.569Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-c7e71f","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-c7e71f#rule-2"},"creationTimestamp":"2026-11-02T21:59:34Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:06:16Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:06:17Z"}],"name":"7ed2ba1aeffbfe14d596981ced332ed955f46afacea1925e585ea9fdc0e6c4fc","namespace":"kuadrant-system","resourceVersion":"99695","uid":"aec44eb1-6f7e-4fb3-8a5c-85004d05c97e"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["7ed2ba1aeffbfe14d596981ced332ed955f46afacea1925e585ea9fdc0e6c4fc"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-c7e71f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-c7e71f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:06:17Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:06:17Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["7ed2ba1aeffbfe14d596981ced332ed955f46afacea1925e585ea9fdc0e6c4fc"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"7ed2ba1aeffbfe14d596981ced332ed955f46afacea1925e585ea9fdc0e6c4fc\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:08:27.632Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-c7e71f","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-c7e71f#rule-1"},"creationTimestamp":"2026-11-02T21:59:35Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:06:17Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:06:17Z"}],"name":"17c8e0f32f1474abdd1596736289f0ee22b2ff3b2707aefff8f6535c03b8536a","namespace":"kuadrant-system","resourceVersion":"99720","uid":"73dd1f65-65e4-4fed-845f-4296260b54b7"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["17c8e0f32f1474abdd1596736289f0ee22b2ff3b2707aefff8f6535c03b8536a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-c7e71f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-c7e71f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:59:35Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:59:35Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["17c8e0f32f1474abdd1596736289f0ee22b2ff3b2707aefff8f6535c03b8536a"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"17c8e0f32f1474abdd1596736289f0ee22b2ff3b2707aefff8f6535c03b8536a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:08:27.738Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w2-c7e71f/auth-test-model-c7e71f-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w2-c7e71f/auth-test-model-c7e71f-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-02T22:03:44Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:06:17Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:06:17Z"}],"name":"4d88bf66d5ceafc38266bf37c7db4dfef8e1ab5251b1d07519b741bfcd782682","namespace":"kuadrant-system","resourceVersion":"99718","uid":"e48e90d8-2081-43d0-9228-ff653e53b141"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["4d88bf66d5ceafc38266bf37c7db4dfef8e1ab5251b1d07519b741bfcd782682"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-c7e71f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-c7e71f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:03:44Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:03:44Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["4d88bf66d5ceafc38266bf37c7db4dfef8e1ab5251b1d07519b741bfcd782682"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"4d88bf66d5ceafc38266bf37c7db4dfef8e1ab5251b1d07519b741bfcd782682\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:08:27.827Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w2-c7e71f/auth-test-model-c7e71f-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w2-c7e71f/auth-test-model-c7e71f-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-02T22:03:43Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:06:16Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:06:17Z"}],"name":"57a9096ab0405732537038fb211b629c90e694fbb492bebc958aed02f510ef7f","namespace":"kuadrant-system","resourceVersion":"99698","uid":"43874cca-f8f2-44df-8b16-9fdcb5777a62"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["57a9096ab0405732537038fb211b629c90e694fbb492bebc958aed02f510ef7f"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-c7e71f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-c7e71f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:03:43Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:03:43Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["57a9096ab0405732537038fb211b629c90e694fbb492bebc958aed02f510ef7f"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"57a9096ab0405732537038fb211b629c90e694fbb492bebc958aed02f510ef7f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:08:27.905Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w2-c7e71f/auth-test-model-c7e71f-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w2-c7e71f/auth-test-model-c7e71f-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-02T22:03:45Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:06:17Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:06:17Z"}],"name":"be0c2dec494f93e5def6c0e153c741dd90cb42ce2d01105ce31915372ce14c76","namespace":"kuadrant-system","resourceVersion":"99705","uid":"51cf7333-7e24-416b-8bb2-b697a8509084"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["be0c2dec494f93e5def6c0e153c741dd90cb42ce2d01105ce31915372ce14c76"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-c7e71f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-c7e71f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:03:45Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:03:45Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["be0c2dec494f93e5def6c0e153c741dd90cb42ce2d01105ce31915372ce14c76"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"be0c2dec494f93e5def6c0e153c741dd90cb42ce2d01105ce31915372ce14c76\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:08:27.985Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w2-c7e71f/auth-test-model-c7e71f-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w2-c7e71f/auth-test-model-c7e71f-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-02T22:03:43Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:06:16Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:06:16Z"}],"name":"12a9a00eb5747449264860422ed6dd24b90178af3f25ef20f99758779a292d80","namespace":"kuadrant-system","resourceVersion":"99676","uid":"8c464dc2-2651-4abb-b47c-1630f7aa1969"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["12a9a00eb5747449264860422ed6dd24b90178af3f25ef20f99758779a292d80"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-c7e71f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-c7e71f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:03:43Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:03:43Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["12a9a00eb5747449264860422ed6dd24b90178af3f25ef20f99758779a292d80"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"12a9a00eb5747449264860422ed6dd24b90178af3f25ef20f99758779a292d80\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:08:28.050Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-c7e71f","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-c7e71f#rule-4"},"creationTimestamp":"2026-11-02T21:59:34Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:06:17Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:06:17Z"}],"name":"5384f5c4ddc9ccb72784e0e07297d2dd640458e7b7a22716374ed0b8930f3320","namespace":"kuadrant-system","resourceVersion":"99725","uid":"249a7b95-ebf4-4c03-b4d0-56f1e6ce0dfe"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["5384f5c4ddc9ccb72784e0e07297d2dd640458e7b7a22716374ed0b8930f3320"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-c7e71f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-c7e71f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:59:34Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:59:34Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["5384f5c4ddc9ccb72784e0e07297d2dd640458e7b7a22716374ed0b8930f3320"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"5384f5c4ddc9ccb72784e0e07297d2dd640458e7b7a22716374ed0b8930f3320\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:08:28.114Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-06e461","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-06e461#rule-6"},"creationTimestamp":"2026-11-02T21:57:01Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:04:45Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:04:45Z"}],"name":"d385206b1115a96c9f0147bd3800677310b659b18edb542eabe78e9dcf3d5903","namespace":"kuadrant-system","resourceVersion":"97259","uid":"b43d6ebf-9aa0-440e-973d-639d520fc1a0"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d385206b1115a96c9f0147bd3800677310b659b18edb542eabe78e9dcf3d5903"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w2-06e461.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w2-06e461.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:57:01Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:57:01Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["d385206b1115a96c9f0147bd3800677310b659b18edb542eabe78e9dcf3d5903"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"d385206b1115a96c9f0147bd3800677310b659b18edb542eabe78e9dcf3d5903\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:08:28.177Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-06e461","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-06e461#rule-3"},"creationTimestamp":"2026-11-02T21:57:01Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:04:47Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:04:47Z"}],"name":"33019b54557cbd49426d4158e18ab3a88d235b9f20f792586c271053788a54a8","namespace":"kuadrant-system","resourceVersion":"97342","uid":"989ba998-40a2-4253-9e47-4e6d37326ca9"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["33019b54557cbd49426d4158e18ab3a88d235b9f20f792586c271053788a54a8"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w2-06e461.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w2-06e461.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:57:01Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:57:01Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["33019b54557cbd49426d4158e18ab3a88d235b9f20f792586c271053788a54a8"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"33019b54557cbd49426d4158e18ab3a88d235b9f20f792586c271053788a54a8\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:08:28.229Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-shared-b-w2-c7e71f","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T21:59:35Z","generation":3,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"ebcff346-2b0d-4f9a-a3f4-224ad73d2413\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:07:29Z"}],"name":"kuadrant-e2e-shared-b-w2-c7e71f","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-b-w2-c7e71f","uid":"ebcff346-2b0d-4f9a-a3f4-224ad73d2413"}],"resourceVersion":"101247","uid":"cd4beb76-ddfd-4478-b89f-26e4821ddc54"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"201f3cf7fa468a2f3604c79c393cf0df72de31d956d35d026a7e06aa7607a326\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-c7e71f-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__33bcb143\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-c7e71f/auth-test-model-c7e71f-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-c7e71f\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__33bcb143\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-c7e71f/auth-test-model-c7e71f-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-c7e71f\"]}],\"name\":\"f8c15c3ac59189f4b1913d750bf189b8bc8f56ca1a98c2dca750ee97362d8607\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w2-c7e71f/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"201f3cf7fa468a2f3604c79c393cf0df72de31d956d35d026a7e06aa7607a326\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-c7e71f-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__33bcb143\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-c7e71f/auth-test-model-c7e71f-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-c7e71f\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__33bcb143\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-c7e71f/auth-test-model-c7e71f-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-c7e71f\"]}],\"name\":\"3da70fb3e9a1ccb835bc70229d12cc8d579806d1f15b64fb4e3c58e580c1d629\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w2-c7e71f/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"201f3cf7fa468a2f3604c79c393cf0df72de31d956d35d026a7e06aa7607a326\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-c7e71f-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__33bcb143\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-c7e71f/auth-test-model-c7e71f-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-c7e71f\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__33bcb143\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-c7e71f/auth-test-model-c7e71f-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-c7e71f\"]}],\"name\":\"f14e1c2fec57a159969d295cb122449667becd050617f6121d73dcdb12288d4e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w2-c7e71f/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"201f3cf7fa468a2f3604c79c393cf0df72de31d956d35d026a7e06aa7607a326\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-c7e71f-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__33bcb143\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-c7e71f/auth-test-model-c7e71f-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-c7e71f\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__33bcb143\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-c7e71f/auth-test-model-c7e71f-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-c7e71f\"]}],\"name\":\"2838e35133fd08d3ee9bc52a2ebf26f9dd6938437abf7c086279ab95fd21c59e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w2-c7e71f/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"201f3cf7fa468a2f3604c79c393cf0df72de31d956d35d026a7e06aa7607a326\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-c7e71f-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__33bcb143\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-c7e71f/auth-test-model-c7e71f-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-c7e71f\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__33bcb143\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-c7e71f/auth-test-model-c7e71f-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-c7e71f\"]}],\"name\":\"7087b46a3671b8c57e3a8fe2e8e1b4f4980709eac5648ea922e96b998cc0cd8a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w2-c7e71f/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"201f3cf7fa468a2f3604c79c393cf0df72de31d956d35d026a7e06aa7607a326\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-c7e71f-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__33bcb143\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-c7e71f/auth-test-model-c7e71f-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-c7e71f\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__33bcb143\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-c7e71f/auth-test-model-c7e71f-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-c7e71f\"]}],\"name\":\"1972ec82c68302358e1bd54455bb40d360afbede08e3b1112b107bbe52434222\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w2-c7e71f/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"201f3cf7fa468a2f3604c79c393cf0df72de31d956d35d026a7e06aa7607a326\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-c7e71f-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__33bcb143\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-c7e71f/auth-test-model-c7e71f-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-c7e71f\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__33bcb143\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-c7e71f/auth-test-model-c7e71f-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-c7e71f\"]}],\"name\":\"c0b452854a9bf0dedae594bb2aa10f0f80871ba803f1181cc13a378952f430e0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w2-c7e71f/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"201f3cf7fa468a2f3604c79c393cf0df72de31d956d35d026a7e06aa7607a326\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-c7e71f-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__33bcb143\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-c7e71f/auth-test-model-c7e71f-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-c7e71f\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__33bcb143\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-c7e71f/auth-test-model-c7e71f-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-c7e71f\"]}],\"name\":\"a3126ae99bfa89e4322cc187187c29f74cef44ebd50888826f9d0d4f640efbb7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w2-c7e71f/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"12167602fd6f0121f28300ae64a13003d4a0fa7f5ff7d0cb33d38b9e60b0d728\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-c7e71f-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__33bcb143\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-c7e71f\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-c7e71f\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__33bcb143\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-c7e71f\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-c7e71f\"]}],\"name\":\"d6fd397a77e8ba7bd2b80982953233d4c16560b8b52f01f81a3012b140803648\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"41b5741ddfb758034607d1d2ea9d1c356c87dcb7b23e43e966b5365c10380b7e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-c7e71f-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__33bcb143\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-c7e71f/auth-test-model-c7e71f-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-c7e71f\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__33bcb143\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-c7e71f/auth-test-model-c7e71f-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-c7e71f\"]}],\"name\":\"5d54328f33c06469985479b928fdf324502c867bfa837560bf8092ef99d0ec84\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w2-c7e71f/models/facebook/opt-125m/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4d88bf66d5ceafc38266bf37c7db4dfef8e1ab5251b1d07519b741bfcd782682\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-c7e71f-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__33bcb143\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-c7e71f/auth-test-model-c7e71f-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-c7e71f\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__33bcb143\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-c7e71f/auth-test-model-c7e71f-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-c7e71f\"]}],\"name\":\"7e1030087d35bba36d92a6af02d456676544b14918688c808fa72fc3cf764052\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w2-c7e71f/models/facebook/opt-125m/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e3b3f700f2eeafe2be400c762bd03fcf0022b0c061ec0ac7f08a7b2bc5faba48\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-c7e71f-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__33bcb143\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-c7e71f/auth-test-model-c7e71f-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-c7e71f\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__33bcb143\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-c7e71f/auth-test-model-c7e71f-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-c7e71f\"]}],\"name\":\"457d6ba3f452b18d3ff8b1eddc49f918b9b45b08aa29e0f79adb8f350d6c34df\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w2-c7e71f/models/facebook/opt-125m/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"12a9a00eb5747449264860422ed6dd24b90178af3f25ef20f99758779a292d80\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-c7e71f-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__33bcb143\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-c7e71f/auth-test-model-c7e71f-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-c7e71f\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__33bcb143\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-c7e71f/auth-test-model-c7e71f-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-c7e71f\"]}],\"name\":\"6db5ff06a16394d050903ac78123282affd00a78f9a0981b49295102dcfecd7e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w2-c7e71f/models/facebook/opt-125m/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9cc8fb3324c01518520bae1e0e4d676e946cb335d1b0795c5375e5a1e60a1181\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-c7e71f-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__33bcb143\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-c7e71f/auth-test-model-c7e71f-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-c7e71f\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__33bcb143\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-c7e71f/auth-test-model-c7e71f-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-c7e71f\"]}],\"name\":\"c21b87d750e1ae78100db69331d53fa482bff53763ec2d22af366d18f9f24a12\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w2-c7e71f/auth-test-model-c7e71f/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"be0c2dec494f93e5def6c0e153c741dd90cb42ce2d01105ce31915372ce14c76\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-c7e71f-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__33bcb143\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-c7e71f/auth-test-model-c7e71f-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-c7e71f\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__33bcb143\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-c7e71f/auth-test-model-c7e71f-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-c7e71f\"]}],\"name\":\"6284daa3d95a6a30c47322548bd367d56209fd5b8c814d84b651f88eff356080\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w2-c7e71f/auth-test-model-c7e71f/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"56efd71ee9003bd393c9ed8963fe14e1f8b6e4a757a89e23c403722689091c08\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-c7e71f-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__33bcb143\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-c7e71f/auth-test-model-c7e71f-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-c7e71f\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__33bcb143\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-c7e71f/auth-test-model-c7e71f-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-c7e71f\"]}],\"name\":\"6c079a72a3a01aba6d881930bf7269722a2e2b13995abbb8ef0a965928f2412c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w2-c7e71f/auth-test-model-c7e71f/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"57a9096ab0405732537038fb211b629c90e694fbb492bebc958aed02f510ef7f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-c7e71f-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__33bcb143\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-c7e71f/auth-test-model-c7e71f-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-c7e71f\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__33bcb143\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-c7e71f/auth-test-model-c7e71f-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-c7e71f\"]}],\"name\":\"876ef0815f9631873eda0b46d53dcc24b24ea6b89b459586d9bf394ef2b80373\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w2-c7e71f/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d5e81d30c7859ec349ea8e38f2e4c6fedbcf5e357545918afba2acaa78098503\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-c7e71f-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__33bcb143\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-c7e71f/auth-test-model-c7e71f-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-c7e71f\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__33bcb143\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-c7e71f/auth-test-model-c7e71f-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-c7e71f\"]}],\"name\":\"a37413d17201756fd645581a86bee3b899dccc66909210b529cee88eeeffaaa9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w2-c7e71f/auth-test-model-c7e71f/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b12ef3edb08880a461b22912fd9492960ca7d75dce45594fb545bca1cbc97404\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-c7e71f-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__33bcb143\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-c7e71f/auth-test-model-c7e71f-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-c7e71f\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__33bcb143\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-c7e71f/auth-test-model-c7e71f-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-c7e71f\"]}],\"name\":\"77c663da18d591409e111d57ae76f9609d44c63fd791a281676d02fbddb32614\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w2-c7e71f/auth-test-model-c7e71f')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7ed2ba1aeffbfe14d596981ced332ed955f46afacea1925e585ea9fdc0e6c4fc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-c7e71f-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__33bcb143\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-c7e71f\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-c7e71f\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__33bcb143\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-c7e71f\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-c7e71f\"]}],\"name\":\"1259a3c59f69156cefd87eb3fe06722a4ecdbf218855b5a7c71a7377f9548f3b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1c842f011243ad9a03724d6985fbcc2786da0a851d4830084a6dd6535b142162\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-c7e71f-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__33bcb143\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-c7e71f\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-c7e71f\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__33bcb143\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-c7e71f\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-c7e71f\"]}],\"name\":\"af900efc7a2e3b9f60be113185d106a0451a229cf9370f0929a4d72c529cb925\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4a53308e71fbbb856396e651af44b1538dffa452616a580a700fb2b56d6332f1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-c7e71f-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__33bcb143\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-c7e71f\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-c7e71f\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__33bcb143\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-c7e71f\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-c7e71f\"]}],\"name\":\"492d64afae2da60bbcf76896d263ddb4805c85282b2bcbb4bc8e8b1db4911994\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5384f5c4ddc9ccb72784e0e07297d2dd640458e7b7a22716374ed0b8930f3320\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-c7e71f-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__33bcb143\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-c7e71f\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-c7e71f\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__33bcb143\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-c7e71f\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-c7e71f\"]}],\"name\":\"8e5687b6a8c279faab35816724c8db684cc4abc2316eccc4624fe39e3db0597e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"17c8e0f32f1474abdd1596736289f0ee22b2ff3b2707aefff8f6535c03b8536a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-c7e71f-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__33bcb143\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-c7e71f\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-c7e71f\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__33bcb143\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-c7e71f\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-c7e71f\"]}],\"name\":\"a6d20ccac542be62116e052eda23f0e7a87a985220b8de577336362a77406dd5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c6781155b69f56d432b80873e9fb2bc01e118e1688cd7f70c221e787d3bf74af\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-c7e71f-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__33bcb143\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-c7e71f/auth-test-model-c7e71f-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-c7e71f\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__33bcb143\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w2-c7e71f/auth-test-model-c7e71f-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-c7e71f\"]}],\"name\":\"b0f33218e16497849257da0097217972043ef1f286f5b6cb24ca2ecd291bcac0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w2-c7e71f/models/facebook/opt-125m')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-shared-b-w2-c7e71f"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-shared-b-w2-c7e71f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:08:28.238Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-06e461","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-06e461#rule-2"},"creationTimestamp":"2026-11-02T21:57:01Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:04:46Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:04:46Z"}],"name":"3c9315326fe75b44d6f5e3c7cd9fac13abf4b1a9918698589b0faa0c42deeb08","namespace":"kuadrant-system","resourceVersion":"97300","uid":"a86d170d-3e6d-4646-944f-4706551689a8"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["3c9315326fe75b44d6f5e3c7cd9fac13abf4b1a9918698589b0faa0c42deeb08"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w2-06e461.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w2-06e461.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:57:01Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:57:01Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["3c9315326fe75b44d6f5e3c7cd9fac13abf4b1a9918698589b0faa0c42deeb08"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"3c9315326fe75b44d6f5e3c7cd9fac13abf4b1a9918698589b0faa0c42deeb08\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:08:28.300Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w2-c7e71f/auth-test-model-c7e71f-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w2-c7e71f/auth-test-model-c7e71f-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-02T22:03:44Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:06:17Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:06:17Z"}],"name":"d5e81d30c7859ec349ea8e38f2e4c6fedbcf5e357545918afba2acaa78098503","namespace":"kuadrant-system","resourceVersion":"99731","uid":"c847eb7b-f170-4b68-b387-358f9f70675e"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d5e81d30c7859ec349ea8e38f2e4c6fedbcf5e357545918afba2acaa78098503"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-c7e71f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-c7e71f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:06:17Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:06:17Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["d5e81d30c7859ec349ea8e38f2e4c6fedbcf5e357545918afba2acaa78098503"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"d5e81d30c7859ec349ea8e38f2e4c6fedbcf5e357545918afba2acaa78098503\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:08:28.344Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-shared-a-w2-06e461","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T21:57:02Z","generation":3,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"d2c5712f-dd0e-4053-9a1f-54cc2f9da146\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:05:58Z"}],"name":"kuadrant-e2e-shared-a-w2-06e461","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-a-w2-06e461","uid":"d2c5712f-dd0e-4053-9a1f-54cc2f9da146"}],"resourceVersion":"99380","uid":"1ac11796-f745-4493-904e-fe4a3aaa4896"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d385206b1115a96c9f0147bd3800677310b659b18edb542eabe78e9dcf3d5903\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w2-06e461-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__19a73354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-06e461\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-06e461\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__19a73354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-06e461\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-06e461\"]}],\"name\":\"b549b8e82700c4f9440c76e2e87986ec39a088e7107894713b59cde4495a76e2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3c9315326fe75b44d6f5e3c7cd9fac13abf4b1a9918698589b0faa0c42deeb08\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w2-06e461-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__19a73354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-06e461\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-06e461\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__19a73354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-06e461\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-06e461\"]}],\"name\":\"479365efca2e3b90f48cc446d43f713f2be6711d43c072384287f8744152c4ac\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5257a14d8fc9908d3b52cf96fc5c9a6cd32b6940ef72c0e96cba23b3ded3d1b4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w2-06e461-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__19a73354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-06e461\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-06e461\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__19a73354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-06e461\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-06e461\"]}],\"name\":\"5ab05e09b5086d58bc3ba357893103478807d6be035c97b1dfa823c5c9b6d62d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"33019b54557cbd49426d4158e18ab3a88d235b9f20f792586c271053788a54a8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w2-06e461-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__19a73354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-06e461\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-06e461\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__19a73354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-06e461\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-06e461\"]}],\"name\":\"71b4675439e02b53cfb6ef6df9336acea0a91b623222cb67411d492fdda99858\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2ed83c23a8290f3646a543920910524ccfc2baad0ca9fb2e965cb8bd4f0fbf83\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w2-06e461-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__19a73354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-06e461\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-06e461\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__19a73354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-06e461\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-06e461\"]}],\"name\":\"328152874d79d022e9a61088d93d937d2ebf6d33b715fdcdae40b206cc472cb5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f1500aad848242a78004ce946110822a45e41d3c4e8b411396c76761e740aa13\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w2-06e461-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__19a73354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-06e461\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-06e461\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__19a73354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-06e461\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-06e461\"]}],\"name\":\"bae0bb257f438d171a6a8fd83d7ffa1f9ec9c7b6dcd238460f21f5c9b5fe8942\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-shared-a-w2-06e461"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-shared-a-w2-06e461\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:08:28.363Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w2-c7e71f/auth-test-model-c7e71f-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w2-c7e71f/auth-test-model-c7e71f-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-02T22:03:46Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:06:17Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:06:17Z"}],"name":"c6781155b69f56d432b80873e9fb2bc01e118e1688cd7f70c221e787d3bf74af","namespace":"kuadrant-system","resourceVersion":"99722","uid":"12a30421-73fe-4792-891c-325cce7e6aa5"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["c6781155b69f56d432b80873e9fb2bc01e118e1688cd7f70c221e787d3bf74af"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-c7e71f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-c7e71f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:03:46Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:03:46Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["c6781155b69f56d432b80873e9fb2bc01e118e1688cd7f70c221e787d3bf74af"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"c6781155b69f56d432b80873e9fb2bc01e118e1688cd7f70c221e787d3bf74af\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:08:28.431Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-c7e71f","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-c7e71f#rule-5"},"creationTimestamp":"2026-11-02T21:59:34Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:06:17Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:06:17Z"}],"name":"1c842f011243ad9a03724d6985fbcc2786da0a851d4830084a6dd6535b142162","namespace":"kuadrant-system","resourceVersion":"99712","uid":"84b7fa37-a63d-4347-a208-18193b5648da"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["1c842f011243ad9a03724d6985fbcc2786da0a851d4830084a6dd6535b142162"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-c7e71f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-c7e71f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:59:34Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:59:34Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["1c842f011243ad9a03724d6985fbcc2786da0a851d4830084a6dd6535b142162"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"1c842f011243ad9a03724d6985fbcc2786da0a851d4830084a6dd6535b142162\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:08:28.493Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-c7e71f","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-c7e71f#rule-6"},"creationTimestamp":"2026-11-02T21:59:35Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:06:17Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:06:17Z"}],"name":"12167602fd6f0121f28300ae64a13003d4a0fa7f5ff7d0cb33d38b9e60b0d728","namespace":"kuadrant-system","resourceVersion":"99710","uid":"0b3addc8-d5af-4701-b225-1c083811dcad"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["12167602fd6f0121f28300ae64a13003d4a0fa7f5ff7d0cb33d38b9e60b0d728"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-c7e71f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-c7e71f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:59:36Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:59:36Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["12167602fd6f0121f28300ae64a13003d4a0fa7f5ff7d0cb33d38b9e60b0d728"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"12167602fd6f0121f28300ae64a13003d4a0fa7f5ff7d0cb33d38b9e60b0d728\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:08:28.557Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w2-c7e71f/auth-test-model-c7e71f-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w2-c7e71f/auth-test-model-c7e71f-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-02T22:03:46Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:06:16Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:06:16Z"}],"name":"56efd71ee9003bd393c9ed8963fe14e1f8b6e4a757a89e23c403722689091c08","namespace":"kuadrant-system","resourceVersion":"99681","uid":"352f5f62-7b4e-47b9-a430-f832b5ef21eb"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["56efd71ee9003bd393c9ed8963fe14e1f8b6e4a757a89e23c403722689091c08"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-c7e71f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-c7e71f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:03:46Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:03:46Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["56efd71ee9003bd393c9ed8963fe14e1f8b6e4a757a89e23c403722689091c08"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"56efd71ee9003bd393c9ed8963fe14e1f8b6e4a757a89e23c403722689091c08\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:08:28.622Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w2-c7e71f/auth-test-model-c7e71f-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w2-c7e71f/auth-test-model-c7e71f-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-02T22:03:43Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:06:17Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:06:17Z"}],"name":"41b5741ddfb758034607d1d2ea9d1c356c87dcb7b23e43e966b5365c10380b7e","namespace":"kuadrant-system","resourceVersion":"99703","uid":"9056d4fb-b9e6-453e-a173-ce82a4ccf431"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["41b5741ddfb758034607d1d2ea9d1c356c87dcb7b23e43e966b5365c10380b7e"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-c7e71f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-c7e71f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:03:44Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:03:44Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["41b5741ddfb758034607d1d2ea9d1c356c87dcb7b23e43e966b5365c10380b7e"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"41b5741ddfb758034607d1d2ea9d1c356c87dcb7b23e43e966b5365c10380b7e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:08:28.684Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w2-c7e71f/auth-test-model-c7e71f-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w2-c7e71f/auth-test-model-c7e71f-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-02T22:03:45Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:06:17Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:06:17Z"}],"name":"201f3cf7fa468a2f3604c79c393cf0df72de31d956d35d026a7e06aa7607a326","namespace":"kuadrant-system","resourceVersion":"99729","uid":"5bfd4d27-be7c-428e-9f30-6b06fc191f3e"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["201f3cf7fa468a2f3604c79c393cf0df72de31d956d35d026a7e06aa7607a326"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-c7e71f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-c7e71f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:03:45Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:03:45Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["201f3cf7fa468a2f3604c79c393cf0df72de31d956d35d026a7e06aa7607a326"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"201f3cf7fa468a2f3604c79c393cf0df72de31d956d35d026a7e06aa7607a326\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:08:28.749Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w2-c7e71f/auth-test-model-c7e71f-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w2-c7e71f/auth-test-model-c7e71f-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-02T22:03:45Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:06:16Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:06:17Z"}],"name":"e3b3f700f2eeafe2be400c762bd03fcf0022b0c061ec0ac7f08a7b2bc5faba48","namespace":"kuadrant-system","resourceVersion":"99701","uid":"55233e2a-4bb8-493b-b01c-d469218a412c"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["e3b3f700f2eeafe2be400c762bd03fcf0022b0c061ec0ac7f08a7b2bc5faba48"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-c7e71f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-c7e71f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:03:45Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:03:45Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["e3b3f700f2eeafe2be400c762bd03fcf0022b0c061ec0ac7f08a7b2bc5faba48"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"e3b3f700f2eeafe2be400c762bd03fcf0022b0c061ec0ac7f08a7b2bc5faba48\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:08:28.818Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-06e461","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-06e461#rule-5"},"creationTimestamp":"2026-11-02T21:57:01Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:04:44Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:04:44Z"}],"name":"5257a14d8fc9908d3b52cf96fc5c9a6cd32b6940ef72c0e96cba23b3ded3d1b4","namespace":"kuadrant-system","resourceVersion":"97211","uid":"e7756686-cd59-4df4-8a32-787b41c0b843"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["5257a14d8fc9908d3b52cf96fc5c9a6cd32b6940ef72c0e96cba23b3ded3d1b4"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w2-06e461.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w2-06e461.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:04:44Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:04:44Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["5257a14d8fc9908d3b52cf96fc5c9a6cd32b6940ef72c0e96cba23b3ded3d1b4"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"5257a14d8fc9908d3b52cf96fc5c9a6cd32b6940ef72c0e96cba23b3ded3d1b4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:08:28.879Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-06e461","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-06e461#rule-1"},"creationTimestamp":"2026-11-02T21:57:00Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:04:44Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:04:45Z"}],"name":"f1500aad848242a78004ce946110822a45e41d3c4e8b411396c76761e740aa13","namespace":"kuadrant-system","resourceVersion":"97241","uid":"ab4ff536-92a4-4c0b-a97f-42c61dcbf287"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f1500aad848242a78004ce946110822a45e41d3c4e8b411396c76761e740aa13"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w2-06e461.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w2-06e461.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:57:01Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:57:01Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["f1500aad848242a78004ce946110822a45e41d3c4e8b411396c76761e740aa13"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"f1500aad848242a78004ce946110822a45e41d3c4e8b411396c76761e740aa13\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:08:28.941Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-c7e71f","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-c7e71f#rule-3"},"creationTimestamp":"2026-11-02T21:59:35Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:06:16Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:06:16Z"}],"name":"4a53308e71fbbb856396e651af44b1538dffa452616a580a700fb2b56d6332f1","namespace":"kuadrant-system","resourceVersion":"99689","uid":"f5b560f7-9f25-44ef-9f84-d2420963cb75"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["4a53308e71fbbb856396e651af44b1538dffa452616a580a700fb2b56d6332f1"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-c7e71f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-c7e71f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:59:36Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:59:36Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["4a53308e71fbbb856396e651af44b1538dffa452616a580a700fb2b56d6332f1"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"4a53308e71fbbb856396e651af44b1538dffa452616a580a700fb2b56d6332f1\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:08:29.004Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w2-c7e71f/auth-test-model-c7e71f-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w2-c7e71f/auth-test-model-c7e71f-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-02T22:03:44Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:06:16Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:06:17Z"}],"name":"9cc8fb3324c01518520bae1e0e4d676e946cb335d1b0795c5375e5a1e60a1181","namespace":"kuadrant-system","resourceVersion":"99693","uid":"ab5f0d06-7a1f-4b8f-89b3-3b38672ad669"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["9cc8fb3324c01518520bae1e0e4d676e946cb335d1b0795c5375e5a1e60a1181"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-c7e71f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-c7e71f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:06:16Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:06:16Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["9cc8fb3324c01518520bae1e0e4d676e946cb335d1b0795c5375e5a1e60a1181"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"9cc8fb3324c01518520bae1e0e4d676e946cb335d1b0795c5375e5a1e60a1181\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:08:29.065Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w2-c7e71f/auth-test-model-c7e71f-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w2-c7e71f/auth-test-model-c7e71f-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-02T22:03:43Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:06:17Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:06:17Z"}],"name":"b12ef3edb08880a461b22912fd9492960ca7d75dce45594fb545bca1cbc97404","namespace":"kuadrant-system","resourceVersion":"99715","uid":"233a48d0-0a74-4b4d-bdba-36fcbf1a0e32"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["b12ef3edb08880a461b22912fd9492960ca7d75dce45594fb545bca1cbc97404"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-c7e71f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w2-c7e71f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:03:43Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:03:43Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["b12ef3edb08880a461b22912fd9492960ca7d75dce45594fb545bca1cbc97404"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"b12ef3edb08880a461b22912fd9492960ca7d75dce45594fb545bca1cbc97404\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:08:29.127Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-06e461","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-06e461#rule-4"},"creationTimestamp":"2026-11-02T21:57:01Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:04:45Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:04:46Z"}],"name":"2ed83c23a8290f3646a543920910524ccfc2baad0ca9fb2e965cb8bd4f0fbf83","namespace":"kuadrant-system","resourceVersion":"97286","uid":"d5fca4de-9e7e-481e-afb2-e1753985d971"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["2ed83c23a8290f3646a543920910524ccfc2baad0ca9fb2e965cb8bd4f0fbf83"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w2-06e461.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w2-06e461.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:57:01Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:57:01Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["2ed83c23a8290f3646a543920910524ccfc2baad0ca9fb2e965cb8bd4f0fbf83"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"2ed83c23a8290f3646a543920910524ccfc2baad0ca9fb2e965cb8bd4f0fbf83\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:08:29.186Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/be41fa1d3323b7258317f58eba852b7b1df727d18fc3ee5a8bc5ad9352718c96","error":"authconfigs.authorino.kuadrant.io \"be41fa1d3323b7258317f58eba852b7b1df727d18fc3ee5a8bc5ad9352718c96\" not found"}
{"level":"error","ts":"2026-11-02T22:08:29.240Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/9b3326c40973f3bae861a4301f060e6309ac1149cb391b2ce57bd775c94f8c94","error":"authconfigs.authorino.kuadrant.io \"9b3326c40973f3bae861a4301f060e6309ac1149cb391b2ce57bd775c94f8c94\" not found"}
{"level":"error","ts":"2026-11-02T22:08:29.295Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/0bdd85d0c5d72530296ec80e18137c67533d79207dd839bc21f06973780ff0f7","error":"authconfigs.authorino.kuadrant.io \"0bdd85d0c5d72530296ec80e18137c67533d79207dd839bc21f06973780ff0f7\" not found"}
{"level":"error","ts":"2026-11-02T22:08:29.350Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/60ec2d78d907b7757451410076aebf7c05311c64398a9859346016520fa4fdb5","error":"authconfigs.authorino.kuadrant.io \"60ec2d78d907b7757451410076aebf7c05311c64398a9859346016520fa4fdb5\" not found"}
{"level":"error","ts":"2026-11-02T22:08:29.405Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/1d0d881a9dc71c6fee94329409cd94f4924596799c71b4e23e5b04e1e5322ec3","error":"authconfigs.authorino.kuadrant.io \"1d0d881a9dc71c6fee94329409cd94f4924596799c71b4e23e5b04e1e5322ec3\" not found"}
{"level":"error","ts":"2026-11-02T22:08:29.460Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/1eaa4e55e51f69196534f42bdab14aeaa07561fd434ded5d363589ea3c382138","error":"authconfigs.authorino.kuadrant.io \"1eaa4e55e51f69196534f42bdab14aeaa07561fd434ded5d363589ea3c382138\" not found"}
{"level":"error","ts":"2026-11-02T22:08:29.514Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/782fff9577e2fa4f490d8cd7dd45f05e73a58ab6d5932bb26b584692ad58aa58","error":"authconfigs.authorino.kuadrant.io \"782fff9577e2fa4f490d8cd7dd45f05e73a58ab6d5932bb26b584692ad58aa58\" not found"}
{"level":"error","ts":"2026-11-02T22:08:29.569Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/68a6b0e714f4c962fdd6f870e2ce0522e8a0dad7d749f4212b8ebc8a5669988e","error":"authconfigs.authorino.kuadrant.io \"68a6b0e714f4c962fdd6f870e2ce0522e8a0dad7d749f4212b8ebc8a5669988e\" not found"}
{"level":"error","ts":"2026-11-02T22:08:29.624Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/376a7c0b362126d2df7b7d580d5c3cd5027f25fb8b56a9dbbe9e48660857dc0a","error":"authconfigs.authorino.kuadrant.io \"376a7c0b362126d2df7b7d580d5c3cd5027f25fb8b56a9dbbe9e48660857dc0a\" not found"}
{"level":"error","ts":"2026-11-02T22:08:29.678Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/15c6b1eefed27150a7b7bdd1240715075bbd750a05cffb4b27f0e2e620e3ced7","error":"authconfigs.authorino.kuadrant.io \"15c6b1eefed27150a7b7bdd1240715075bbd750a05cffb4b27f0e2e620e3ced7\" not found"}
{"level":"error","ts":"2026-11-02T22:08:29.733Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/c1f395fe657de9926a17e2585660efe2122126d80c128be98e3caadff48b0d8b","error":"authconfigs.authorino.kuadrant.io \"c1f395fe657de9926a17e2585660efe2122126d80c128be98e3caadff48b0d8b\" not found"}
{"level":"error","ts":"2026-11-02T22:08:29.788Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/a39b5e3422070c9db5e6c6cc30ae4c9eb9786da116b4b414de7ad8c0af6593a1","error":"authconfigs.authorino.kuadrant.io \"a39b5e3422070c9db5e6c6cc30ae4c9eb9786da116b4b414de7ad8c0af6593a1\" not found"}
{"level":"error","ts":"2026-11-02T22:08:30.087Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-b-w2-c7e71f","namespace":"openshift-ingress","uid":"6decd2e5-6aa1-451b-97e5-5dd8911def76","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-b-w2-c7e71f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:08:30.087Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-a-w2-06e461-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-a-w2-06e461-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:08:30.220Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-extmod-a-1538c4-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-extmod-a-1538c4-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:08:30.754Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-extmod-a-1538c4","namespace":"openshift-ingress","uid":"7425a546-5e57-45c9-aa72-3cad2c77fa92","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-extmod-a-1538c4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:08:30.957Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-b-w2-c7e71f-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-b-w2-c7e71f-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:08:31.179Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-a-w2-06e461","namespace":"openshift-ingress","uid":"c459fc7a-4e41-4226-a9ad-15cf3c29611a","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-a-w2-06e461\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:08:31.714Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T22:08:31.714Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T22:08:32.345Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"auth-test-model-c7e71f-kserve-route","namespace":"ai-tenant-e2e-shared-b-w2-c7e71f","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"auth-test-model-c7e71f-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:08:32.608Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-extmod-b-6ba06f","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-extmod-b-6ba06f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:08:43.969Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","Gateway","HTTPRoute","EnvoyFilter","ConfigMap","Limitador","AuthPolicy","TokenRateLimitPolicy","Kuadrant"],"eventTypes":{"create":4,"delete":12,"update":37}}
{"level":"info","ts":"2026-11-02T22:08:44.275Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:08:44.295Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T22:08:48.129Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T22:08:48.323Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:08:48.341Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T22:08:48.367Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:08:48.367Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T22:08:52.129Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:08:52.140Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:08:52.151Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T22:08:52.152Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:08:52.167Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:08:52.167Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-02T22:08:52.306Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:08:52.306Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T22:08:56.002Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T22:08:56.002Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T22:08:58.060Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway","HTTPRoute"],"eventTypes":{"delete":1,"update":2}}
{"level":"info","ts":"2026-11-02T22:08:59Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-extmod-a-1538c4","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-a-1538c4","reconcileID":"f7e583d3-6038-4602-995b-6768950e152c","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-extmod-a-1538c4","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T22:08:59Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-a-1538c4","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T22:08:59Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T22:08:59Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-11-02T22:08:59Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T22:09:00Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-11-02T22:09:00Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-extmod-a-1538c4","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-a-1538c4","reconcileID":"f7e583d3-6038-4602-995b-6768950e152c","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-extmod-a-1538c4","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T22:09:00Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-a-1538c4","event":"DELETE"}
{"level":"info","ts":"2026-11-02T22:09:00Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-02T22:09:00Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-extmod-a-1538c4\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-02T22:09:00Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T22:09:05.488Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:09:05.488Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:09:05.495Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T22:09:05.497Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:09:05.510Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:09:05.510Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-02T22:09:05.602Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:09:05.602Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T22:09:05.604Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-extmod-b-6ba06f","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"kuadrant-auth-e2e-extmod-b-6ba06f","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-extmod-b-6ba06f","uid":"661335ad-1ade-4dff-81a5-98be18a75622"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-auth-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local","port_value":50051}}}}]}]},"name":"kuadrant-auth-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-extmod-b-6ba06f"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-extmod-b-6ba06f\" already exists"}
{"level":"error","ts":"2026-11-02T22:09:05.651Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-extmod-b-6ba06f","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/ratelimit":"true"},"name":"kuadrant-ratelimiting-e2e-extmod-b-6ba06f","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-extmod-b-6ba06f","uid":"661335ad-1ade-4dff-81a5-98be18a75622"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"limitador-limitador.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-ratelimit-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"limitador-limitador.kuadrant-system.svc.cluster.local","port_value":8081}}}}]}]},"name":"kuadrant-ratelimit-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-extmod-b-6ba06f"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-extmod-b-6ba06f\" already exists"}
{"level":"error","ts":"2026-11-02T22:09:05.653Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-extmod-b-6ba06f","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-extmod-b-6ba06f#rule-6"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"3666c6eaeb54f2a79950d88c9e27a04c1595d03b3cbd5889af37ce503f9cedcc","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["3666c6eaeb54f2a79950d88c9e27a04c1595d03b3cbd5889af37ce503f9cedcc"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-extmod-b-6ba06f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-extmod-b-6ba06f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"3666c6eaeb54f2a79950d88c9e27a04c1595d03b3cbd5889af37ce503f9cedcc\" already exists"}
{"level":"error","ts":"2026-11-02T22:09:05.732Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-extmod-b-6ba06f","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-extmod-b-6ba06f#rule-3"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"2211201d5699349b2ed146fc531632aa882d40f692891eff6c9bee428e823297","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["2211201d5699349b2ed146fc531632aa882d40f692891eff6c9bee428e823297"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-extmod-b-6ba06f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-extmod-b-6ba06f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"2211201d5699349b2ed146fc531632aa882d40f692891eff6c9bee428e823297\" already exists"}
{"level":"error","ts":"2026-11-02T22:09:05.842Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-extmod-b-6ba06f","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-extmod-b-6ba06f#rule-4"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"b905ca73bcf6b698520678a4014d4912c1ab9a643d7fd102ce83ba56f250e986","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["b905ca73bcf6b698520678a4014d4912c1ab9a643d7fd102ce83ba56f250e986"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-extmod-b-6ba06f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-extmod-b-6ba06f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"b905ca73bcf6b698520678a4014d4912c1ab9a643d7fd102ce83ba56f250e986\" already exists"}
{"level":"error","ts":"2026-11-02T22:09:05.941Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-extmod-b-6ba06f","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-extmod-b-6ba06f#rule-2"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"90b248f7b6fa80cbc6beaef3dc212b7a13e5f9609eedc2faac7d8a64425eced1","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["90b248f7b6fa80cbc6beaef3dc212b7a13e5f9609eedc2faac7d8a64425eced1"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-extmod-b-6ba06f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-extmod-b-6ba06f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"90b248f7b6fa80cbc6beaef3dc212b7a13e5f9609eedc2faac7d8a64425eced1\" already exists"}
{"level":"error","ts":"2026-11-02T22:09:06.040Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-extmod-b-6ba06f","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-extmod-b-6ba06f#rule-5"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"f6a43550f2397247bfdce29483aaf94e8e7b0962611fe9b618c447b9f737467d","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f6a43550f2397247bfdce29483aaf94e8e7b0962611fe9b618c447b9f737467d"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-extmod-b-6ba06f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-extmod-b-6ba06f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"f6a43550f2397247bfdce29483aaf94e8e7b0962611fe9b618c447b9f737467d\" already exists"}
{"level":"error","ts":"2026-11-02T22:09:06.114Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-extmod-b-6ba06f","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-extmod-b-6ba06f#rule-1"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"10f63664c27b6303acdafdaa069e4a048c6a5e30eda1114491faec5151af7d2c","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["10f63664c27b6303acdafdaa069e4a048c6a5e30eda1114491faec5151af7d2c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-extmod-b-6ba06f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-extmod-b-6ba06f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"10f63664c27b6303acdafdaa069e4a048c6a5e30eda1114491faec5151af7d2c\" already exists"}
{"level":"error","ts":"2026-11-02T22:09:06.172Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/41b5741ddfb758034607d1d2ea9d1c356c87dcb7b23e43e966b5365c10380b7e","error":"authconfigs.authorino.kuadrant.io \"41b5741ddfb758034607d1d2ea9d1c356c87dcb7b23e43e966b5365c10380b7e\" not found"}
{"level":"error","ts":"2026-11-02T22:09:06.229Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/57a9096ab0405732537038fb211b629c90e694fbb492bebc958aed02f510ef7f","error":"authconfigs.authorino.kuadrant.io \"57a9096ab0405732537038fb211b629c90e694fbb492bebc958aed02f510ef7f\" not found"}
{"level":"error","ts":"2026-11-02T22:09:06.284Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/b12ef3edb08880a461b22912fd9492960ca7d75dce45594fb545bca1cbc97404","error":"authconfigs.authorino.kuadrant.io \"b12ef3edb08880a461b22912fd9492960ca7d75dce45594fb545bca1cbc97404\" not found"}
{"level":"error","ts":"2026-11-02T22:09:06.342Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/c6781155b69f56d432b80873e9fb2bc01e118e1688cd7f70c221e787d3bf74af","error":"authconfigs.authorino.kuadrant.io \"c6781155b69f56d432b80873e9fb2bc01e118e1688cd7f70c221e787d3bf74af\" not found"}
{"level":"error","ts":"2026-11-02T22:09:06.400Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/e3b3f700f2eeafe2be400c762bd03fcf0022b0c061ec0ac7f08a7b2bc5faba48","error":"authconfigs.authorino.kuadrant.io \"e3b3f700f2eeafe2be400c762bd03fcf0022b0c061ec0ac7f08a7b2bc5faba48\" not found"}
{"level":"error","ts":"2026-11-02T22:09:06.404Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-shared-b-w2-c7e71f","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T21:59:35Z","generation":4,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"ebcff346-2b0d-4f9a-a3f4-224ad73d2413\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:08:16Z"}],"name":"kuadrant-e2e-shared-b-w2-c7e71f","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-b-w2-c7e71f","uid":"ebcff346-2b0d-4f9a-a3f4-224ad73d2413"}],"resourceVersion":"102184","uid":"cd4beb76-ddfd-4478-b89f-26e4821ddc54"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"12167602fd6f0121f28300ae64a13003d4a0fa7f5ff7d0cb33d38b9e60b0d728\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-c7e71f-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__33bcb143\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-c7e71f\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-c7e71f\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__33bcb143\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-c7e71f\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-c7e71f\"]}],\"name\":\"d6fd397a77e8ba7bd2b80982953233d4c16560b8b52f01f81a3012b140803648\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7ed2ba1aeffbfe14d596981ced332ed955f46afacea1925e585ea9fdc0e6c4fc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-c7e71f-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__33bcb143\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-c7e71f\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-c7e71f\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__33bcb143\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-c7e71f\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-c7e71f\"]}],\"name\":\"1259a3c59f69156cefd87eb3fe06722a4ecdbf218855b5a7c71a7377f9548f3b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1c842f011243ad9a03724d6985fbcc2786da0a851d4830084a6dd6535b142162\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-c7e71f-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__33bcb143\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-c7e71f\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-c7e71f\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__33bcb143\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-c7e71f\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-c7e71f\"]}],\"name\":\"af900efc7a2e3b9f60be113185d106a0451a229cf9370f0929a4d72c529cb925\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4a53308e71fbbb856396e651af44b1538dffa452616a580a700fb2b56d6332f1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-c7e71f-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__33bcb143\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-c7e71f\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-c7e71f\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__33bcb143\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-c7e71f\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-c7e71f\"]}],\"name\":\"492d64afae2da60bbcf76896d263ddb4805c85282b2bcbb4bc8e8b1db4911994\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5384f5c4ddc9ccb72784e0e07297d2dd640458e7b7a22716374ed0b8930f3320\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-c7e71f-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__33bcb143\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-c7e71f\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-c7e71f\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__33bcb143\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-c7e71f\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-c7e71f\"]}],\"name\":\"8e5687b6a8c279faab35816724c8db684cc4abc2316eccc4624fe39e3db0597e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"17c8e0f32f1474abdd1596736289f0ee22b2ff3b2707aefff8f6535c03b8536a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w2-c7e71f-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__33bcb143\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-c7e71f\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-c7e71f\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__33bcb143\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w2-c7e71f\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w2-c7e71f\"]}],\"name\":\"a6d20ccac542be62116e052eda23f0e7a87a985220b8de577336362a77406dd5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-shared-b-w2-c7e71f"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-shared-b-w2-c7e71f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:09:06.454Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/56efd71ee9003bd393c9ed8963fe14e1f8b6e4a757a89e23c403722689091c08","error":"authconfigs.authorino.kuadrant.io \"56efd71ee9003bd393c9ed8963fe14e1f8b6e4a757a89e23c403722689091c08\" not found"}
{"level":"error","ts":"2026-11-02T22:09:06.509Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/d5e81d30c7859ec349ea8e38f2e4c6fedbcf5e357545918afba2acaa78098503","error":"authconfigs.authorino.kuadrant.io \"d5e81d30c7859ec349ea8e38f2e4c6fedbcf5e357545918afba2acaa78098503\" not found"}
{"level":"error","ts":"2026-11-02T22:09:06.564Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/be0c2dec494f93e5def6c0e153c741dd90cb42ce2d01105ce31915372ce14c76","error":"authconfigs.authorino.kuadrant.io \"be0c2dec494f93e5def6c0e153c741dd90cb42ce2d01105ce31915372ce14c76\" not found"}
{"level":"error","ts":"2026-11-02T22:09:06.619Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/4d88bf66d5ceafc38266bf37c7db4dfef8e1ab5251b1d07519b741bfcd782682","error":"authconfigs.authorino.kuadrant.io \"4d88bf66d5ceafc38266bf37c7db4dfef8e1ab5251b1d07519b741bfcd782682\" not found"}
{"level":"error","ts":"2026-11-02T22:09:06.673Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/9cc8fb3324c01518520bae1e0e4d676e946cb335d1b0795c5375e5a1e60a1181","error":"authconfigs.authorino.kuadrant.io \"9cc8fb3324c01518520bae1e0e4d676e946cb335d1b0795c5375e5a1e60a1181\" not found"}
{"level":"error","ts":"2026-11-02T22:09:06.730Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/12a9a00eb5747449264860422ed6dd24b90178af3f25ef20f99758779a292d80","error":"authconfigs.authorino.kuadrant.io \"12a9a00eb5747449264860422ed6dd24b90178af3f25ef20f99758779a292d80\" not found"}
{"level":"error","ts":"2026-11-02T22:09:06.787Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/201f3cf7fa468a2f3604c79c393cf0df72de31d956d35d026a7e06aa7607a326","error":"authconfigs.authorino.kuadrant.io \"201f3cf7fa468a2f3604c79c393cf0df72de31d956d35d026a7e06aa7607a326\" not found"}
{"level":"error","ts":"2026-11-02T22:09:07.317Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-extmod-b-6ba06f","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"name":"kuadrant-e2e-extmod-b-6ba06f","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-extmod-b-6ba06f","uid":"661335ad-1ade-4dff-81a5-98be18a75622"}]},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3666c6eaeb54f2a79950d88c9e27a04c1595d03b3cbd5889af37ce503f9cedcc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-extmod-b-6ba06f-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5a152bdc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-extmod-b-6ba06f\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-extmod-b-6ba06f\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5a152bdc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-extmod-b-6ba06f\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-extmod-b-6ba06f\"]}],\"name\":\"3b6420a6f2192c357012d86df9db605024430d986ea172e03122bc36be6140ca\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"90b248f7b6fa80cbc6beaef3dc212b7a13e5f9609eedc2faac7d8a64425eced1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-extmod-b-6ba06f-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5a152bdc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-extmod-b-6ba06f\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-extmod-b-6ba06f\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5a152bdc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-extmod-b-6ba06f\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-extmod-b-6ba06f\"]}],\"name\":\"d77be2363088206782d5fbbc8888a9cedd112dc694cbbef6a7bdf37cbc922782\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f6a43550f2397247bfdce29483aaf94e8e7b0962611fe9b618c447b9f737467d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-extmod-b-6ba06f-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5a152bdc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-extmod-b-6ba06f\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-extmod-b-6ba06f\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5a152bdc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-extmod-b-6ba06f\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-extmod-b-6ba06f\"]}],\"name\":\"bbd2ef081850baffffda084a8e2d376c22ea2713305600d14d60023c6108561e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2211201d5699349b2ed146fc531632aa882d40f692891eff6c9bee428e823297\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-extmod-b-6ba06f-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5a152bdc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-extmod-b-6ba06f\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-extmod-b-6ba06f\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5a152bdc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-extmod-b-6ba06f\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-extmod-b-6ba06f\"]}],\"name\":\"19257c7575f9b549bb5f1a0245edcbc0dca902212af75476c5e1e40bdf8e61d1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b905ca73bcf6b698520678a4014d4912c1ab9a643d7fd102ce83ba56f250e986\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-extmod-b-6ba06f-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5a152bdc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-extmod-b-6ba06f\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-extmod-b-6ba06f\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5a152bdc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-extmod-b-6ba06f\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-extmod-b-6ba06f\"]}],\"name\":\"d9cf04a94c3f21014e40d2b524a7dc08cf40b11871cc74f5d459a357d280b33d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"10f63664c27b6303acdafdaa069e4a048c6a5e30eda1114491faec5151af7d2c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-extmod-b-6ba06f-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5a152bdc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-extmod-b-6ba06f\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-extmod-b-6ba06f\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__5a152bdc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-extmod-b-6ba06f\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-extmod-b-6ba06f\"]}],\"name\":\"ca6bd66bf675eab30e4998c37865ce54273b03d0eeb4372d14b50b2cb22e4276\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-extmod-b-6ba06f"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-e2e-extmod-b-6ba06f\" already exists"}
{"level":"error","ts":"2026-11-02T22:09:07.677Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-extmod-b-6ba06f","namespace":"openshift-ingress","uid":"1aab7d25-e3c3-4c8a-a554-f16d607fd8db","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-extmod-b-6ba06f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:09:07.967Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-a-w2-06e461-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-a-w2-06e461-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:09:08.175Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-b-w2-c7e71f-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-b-w2-c7e71f-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:09:08.305Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-extmod-b-6ba06f-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-extmod-b-6ba06f-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:09:08.600Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-extmod-a-1538c4-maas-auth","namespace":"openshift-ingress","error":"authpolicies.kuadrant.io \"e2e-extmod-a-1538c4-maas-auth\" not found"}
{"level":"error","ts":"2026-11-02T22:09:08.916Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-extmod-a-1538c4","namespace":"openshift-ingress","uid":"7425a546-5e57-45c9-aa72-3cad2c77fa92","error":"tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-extmod-a-1538c4\" not found"}
{"level":"info","ts":"2026-11-02T22:09:09.597Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T22:09:09.597Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T22:09:10.410Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"maas-api-route-e2e-extmod-b-6ba06f","namespace":"odh-ai-gateway-infra","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"maas-api-route-e2e-extmod-b-6ba06f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:09:10.700Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-extmod-a-1538c4","error":"gateways.gateway.networking.k8s.io \"e2e-extmod-a-1538c4\" not found"}
{"level":"error","ts":"2026-11-02T22:09:10.767Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-extmod-b-6ba06f","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-extmod-b-6ba06f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:09:18.318Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","HTTPRoute","AuthPolicy","ConfigMap","Gateway","Limitador","TokenRateLimitPolicy","EnvoyFilter","Kuadrant"],"eventTypes":{"create":10,"delete":19,"update":11}}
{"level":"info","ts":"2026-11-02T22:09:18.569Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:09:18.589Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T22:09:21.928Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T22:09:22.456Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T22:09:22.467Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:09:22.659Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:09:22.659Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T22:09:26.170Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:09:26.183Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:09:26.184Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:09:26.184Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T22:09:26.188Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:09:26.224Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T22:09:26.344Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T22:09:29.011Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"maas-gateway-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"maas-gateway-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:09:29.969Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T22:09:29.969Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T22:09:38.388Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["HTTPRoute","ConfigMap","AuthConfig","TokenRateLimitPolicy","AuthPolicy","EnvoyFilter","Limitador"],"eventTypes":{"create":5,"delete":6,"update":7}}
{"level":"info","ts":"2026-11-02T22:09:38.885Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T22:09:40.828Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T22:09:41.056Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:09:41.056Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T22:09:44.860Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:09:44.865Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:09:44.872Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T22:09:44.874Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:09:44.878Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:09:44.878Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-02T22:09:45.092Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:09:45.092Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T22:09:54.663Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T22:09:54.663Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T22:10:03.282Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","HTTPRoute","Limitador","EnvoyFilter","ConfigMap","AuthPolicy","TokenRateLimitPolicy"],"eventTypes":{"update":112}}
{"level":"info","ts":"2026-11-02T22:10:03.526Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T22:10:05.370Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T22:10:05.537Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:10:05.537Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T22:10:09.553Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:10:09.567Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:10:09.567Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T22:10:09.569Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:10:09.569Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:10:09.630Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T22:10:09.747Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T22:10:12.246Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-e2e-dft-55455f","namespace":"llm","uid":"eede1ab5-0f23-4a1d-89e6-f35678d0829e","error":"tokenratelimitpolicies.kuadrant.io \"maas-trlp-e2e-dft-55455f\" not found"}
{"level":"info","ts":"2026-11-02T22:10:12Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-autores-363e15","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-autores-363e15","reconcileID":"15ff8039-1579-48c4-98b4-fff389571056","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-autores-363e15","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T22:10:12Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-autores-363e15","event":"CREATE"}
{"level":"info","ts":"2026-11-02T22:10:12Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-02T22:10:12.704Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"maas-gateway-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"maas-gateway-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:10:12Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-02T22:10:12Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-02T22:10:12Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T22:10:12Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-autores-363e15","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-autores-363e15","reconcileID":"faf5a046-940b-4796-84fc-4976096c98de","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-autores-363e15","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T22:10:12Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-autores-363e15","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T22:10:12Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T22:10:13.322Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T22:10:13.322Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T22:10:13Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-02T22:10:13Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-02T22:10:13Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-02T22:10:13Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"error","ts":"2026-11-02T22:10:14.127Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"maas-default-gateway","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"maas-default-gateway\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:10:14.366Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-autores-363e15","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-autores-363e15\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:10:25.387Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway","AuthPolicy","ConfigMap","Kuadrant","TokenRateLimitPolicy","Limitador","HTTPRoute"],"eventTypes":{"create":4,"delete":2,"update":6}}
{"level":"info","ts":"2026-11-02T22:10:25.697Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:10:25.718Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T22:10:29.547Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T22:10:29.725Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T22:10:29.737Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:10:29.868Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:10:29.868Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T22:10:34.104Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:10:34.112Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T22:10:34.104Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:10:34.114Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:10:34.143Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:10:34.143Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-02T22:10:34.221Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:10:34.221Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T22:10:44.443Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T22:10:44.443Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T22:10:44.944Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"maas-default-gateway","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"maas-default-gateway\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:10:46.355Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway","HTTPRoute"],"eventTypes":{"delete":1,"update":1}}
{"level":"info","ts":"2026-11-02T22:10:54.353Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:10:54.360Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T22:10:54.353Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:10:54.365Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:10:54.372Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:10:54.372Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-02T22:10:54.413Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-autores-363e15","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"kuadrant-auth-e2e-autores-363e15","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-autores-363e15","uid":"b503c6f8-803e-4564-949f-2eb6fb6fd84d"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-auth-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local","port_value":50051}}}}]}]},"name":"kuadrant-auth-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-autores-363e15"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-autores-363e15\" already exists"}
{"level":"error","ts":"2026-11-02T22:10:54.424Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-autores-363e15","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/ratelimit":"true"},"name":"kuadrant-ratelimiting-e2e-autores-363e15","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-autores-363e15","uid":"b503c6f8-803e-4564-949f-2eb6fb6fd84d"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"limitador-limitador.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-ratelimit-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"limitador-limitador.kuadrant-system.svc.cluster.local","port_value":8081}}}}]}]},"name":"kuadrant-ratelimit-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-autores-363e15"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-autores-363e15\" already exists"}
{"level":"error","ts":"2026-11-02T22:10:54.468Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:10:54.468Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T22:10:54.534Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-02T21:18:39Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:09:48Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:09:48Z"}],"name":"ce7d381faee9ff949d68d825ffa1dcb9247dad19667ec59a8e91847320dacbe0","namespace":"kuadrant-system","resourceVersion":"104423","uid":"3282c010-eba7-4069-b458-e4a81b773586"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["ce7d381faee9ff949d68d825ffa1dcb9247dad19667ec59a8e91847320dacbe0"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:36:34Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:36:34Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["ce7d381faee9ff949d68d825ffa1dcb9247dad19667ec59a8e91847320dacbe0"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"ce7d381faee9ff949d68d825ffa1dcb9247dad19667ec59a8e91847320dacbe0\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:10:54.623Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-2-simulated-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-2-simulated-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-02T21:18:17Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:09:51Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:09:55Z"}],"name":"6687eb3cec74c6c51428ce3f3d22d50ba269f59015d1bc8f185da49eb095534e","namespace":"kuadrant-system","resourceVersion":"104779","uid":"3da539ac-ddf5-4993-bbec-cea1d8e0b607"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["6687eb3cec74c6c51428ce3f3d22d50ba269f59015d1bc8f185da49eb095534e"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:09:55Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:09:55Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["6687eb3cec74c6c51428ce3f3d22d50ba269f59015d1bc8f185da49eb095534e"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"6687eb3cec74c6c51428ce3f3d22d50ba269f59015d1bc8f185da49eb095534e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:10:54.724Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-02T21:18:39Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:09:45Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:09:45Z"}],"name":"a8c8220ad6f1387002e262ace5db78a2c4bb39e5953306702a228215174f6796","namespace":"kuadrant-system","resourceVersion":"104209","uid":"7c5acab6-424a-4637-b109-0053b2a76119"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a8c8220ad6f1387002e262ace5db78a2c4bb39e5953306702a228215174f6796"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:19:17Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:19:17Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["a8c8220ad6f1387002e262ace5db78a2c4bb39e5953306702a228215174f6796"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a8c8220ad6f1387002e262ace5db78a2c4bb39e5953306702a228215174f6796\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:10:54.788Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route#rule-5"},"creationTimestamp":"2026-11-02T21:16:03Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:09:50Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:09:52Z"}],"name":"a82769ff87473da04c27497e160e9b4b1a5dd93578e0cf2342be8b2f06845269","namespace":"kuadrant-system","resourceVersion":"104631","uid":"39cbf22a-c6ff-4ae7-8f94-107ee05355b1"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a82769ff87473da04c27497e160e9b4b1a5dd93578e0cf2342be8b2f06845269"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:16:17Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:16:17Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["a82769ff87473da04c27497e160e9b4b1a5dd93578e0cf2342be8b2f06845269"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a82769ff87473da04c27497e160e9b4b1a5dd93578e0cf2342be8b2f06845269\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:10:54.850Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-02T21:18:39Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:09:52Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:09:54Z"}],"name":"54eea38241838159e47386cb814ad20fc30631ee8c42d57f0ff8da80fbbf62a0","namespace":"kuadrant-system","resourceVersion":"104707","uid":"d9223dea-d924-4405-9e2c-4f57e5726de8"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["54eea38241838159e47386cb814ad20fc30631ee8c42d57f0ff8da80fbbf62a0"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:18:39Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:18:39Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["54eea38241838159e47386cb814ad20fc30631ee8c42d57f0ff8da80fbbf62a0"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"54eea38241838159e47386cb814ad20fc30631ee8c42d57f0ff8da80fbbf62a0\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:10:54.912Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-02T21:18:39Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:09:52Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:09:55Z"}],"name":"3386c5e86c72abcdab369776ccd7182024ab8681cbe497e81724868f101a3c0c","namespace":"kuadrant-system","resourceVersion":"104771","uid":"f21d9629-8bf6-47f9-85be-817ee7208229"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["3386c5e86c72abcdab369776ccd7182024ab8681cbe497e81724868f101a3c0c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:09:55Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:09:55Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["3386c5e86c72abcdab369776ccd7182024ab8681cbe497e81724868f101a3c0c"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"3386c5e86c72abcdab369776ccd7182024ab8681cbe497e81724868f101a3c0c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:10:54.975Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-02T21:18:39Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:09:46Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:09:47Z"}],"name":"cc1ffc2ee4e05618c28c108cac668c0c02eb8e658953439e47a733edab44a1a0","namespace":"kuadrant-system","resourceVersion":"104308","uid":"4dbe387c-9a2c-477c-8e7b-adf4e1e2c366"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["cc1ffc2ee4e05618c28c108cac668c0c02eb8e658953439e47a733edab44a1a0"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:18:39Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:18:39Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["cc1ffc2ee4e05618c28c108cac668c0c02eb8e658953439e47a733edab44a1a0"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"cc1ffc2ee4e05618c28c108cac668c0c02eb8e658953439e47a733edab44a1a0\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:10:55.039Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-02T21:18:21Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:09:47Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:09:47Z"}],"name":"2f53b030326b8e1f5908c601aecd3fffcb6d08a8337d0bdc53ee1fc699a4cd71","namespace":"kuadrant-system","resourceVersion":"104345","uid":"3aaf392c-3146-4f82-b8e9-519ccf02d326"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["2f53b030326b8e1f5908c601aecd3fffcb6d08a8337d0bdc53ee1fc699a4cd71"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:09:47Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:09:47Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["2f53b030326b8e1f5908c601aecd3fffcb6d08a8337d0bdc53ee1fc699a4cd71"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"2f53b030326b8e1f5908c601aecd3fffcb6d08a8337d0bdc53ee1fc699a4cd71\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:10:55.105Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-autores-363e15","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-autores-363e15#rule-1"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"36c387407442b9a646531f6110f864d6de1f0c2046bc6135607877328d6ae79e","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["36c387407442b9a646531f6110f864d6de1f0c2046bc6135607877328d6ae79e"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-autores-363e15.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-autores-363e15.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"36c387407442b9a646531f6110f864d6de1f0c2046bc6135607877328d6ae79e\" already exists"}
{"level":"error","ts":"2026-11-02T22:10:55.167Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-02T21:18:39Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:09:49Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:09:54Z"}],"name":"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455","namespace":"kuadrant-system","resourceVersion":"104714","uid":"59609df0-6834-4465-9d51-ef3cc66016e4"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:09:54Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:09:54Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:10:55.229Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-02T21:18:39Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:09:49Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:09:54Z"}],"name":"68502d1c1143a647ad56f2759ea89a4c5b3c74a8054739f7e7ea9ba6535e3b74","namespace":"kuadrant-system","resourceVersion":"104716","uid":"63709ab4-6be0-4e14-9268-69177159cc65"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["68502d1c1143a647ad56f2759ea89a4c5b3c74a8054739f7e7ea9ba6535e3b74"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:09:54Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:09:54Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["68502d1c1143a647ad56f2759ea89a4c5b3c74a8054739f7e7ea9ba6535e3b74"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"68502d1c1143a647ad56f2759ea89a4c5b3c74a8054739f7e7ea9ba6535e3b74\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:10:55.314Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-02T21:18:31Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:09:51Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:09:53Z"}],"name":"7c924aa2b37ea38067b4e69052d541ea2e7c86fbdaa79b19f9ea09e87adbe4ff","namespace":"kuadrant-system","resourceVersion":"104674","uid":"70f5f392-3df1-43dd-b512-1367e63f2541"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["7c924aa2b37ea38067b4e69052d541ea2e7c86fbdaa79b19f9ea09e87adbe4ff"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:36:34Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:36:34Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["7c924aa2b37ea38067b4e69052d541ea2e7c86fbdaa79b19f9ea09e87adbe4ff"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"7c924aa2b37ea38067b4e69052d541ea2e7c86fbdaa79b19f9ea09e87adbe4ff\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:10:55.390Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-02T21:18:48Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:09:50Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:09:53Z"}],"name":"f9b535aed6243496a67741936e53a0d303bea1b872a06fb62f1f9c27150edc40","namespace":"kuadrant-system","resourceVersion":"104676","uid":"11fbb3b6-813e-42ac-8b1e-a16e089db4f5"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f9b535aed6243496a67741936e53a0d303bea1b872a06fb62f1f9c27150edc40"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:09:53Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:09:53Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["f9b535aed6243496a67741936e53a0d303bea1b872a06fb62f1f9c27150edc40"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"f9b535aed6243496a67741936e53a0d303bea1b872a06fb62f1f9c27150edc40\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:10:55.454Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-embedding-simulated-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-embedding-simulated-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-02T21:18:26Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:09:46Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:09:46Z"}],"name":"810f299b76daf089b33c92cfbe0445ab5cc89a48d38e36df0cc89ed6cd1fe8df","namespace":"kuadrant-system","resourceVersion":"104247","uid":"dafc8b3f-2b7d-4454-82b8-a2a6d3d92763"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["810f299b76daf089b33c92cfbe0445ab5cc89a48d38e36df0cc89ed6cd1fe8df"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:18:27Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:18:27Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["810f299b76daf089b33c92cfbe0445ab5cc89a48d38e36df0cc89ed6cd1fe8df"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"810f299b76daf089b33c92cfbe0445ab5cc89a48d38e36df0cc89ed6cd1fe8df\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:10:55.517Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-02T21:18:48Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:09:49Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:09:51Z"}],"name":"a4493fc88328eba553ef36791fbf4706bffae04a1ac501d099b12309ebc85c6b","namespace":"kuadrant-system","resourceVersion":"104575","uid":"58f8e417-4e4e-42bc-a88d-38b8b56a4c80"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a4493fc88328eba553ef36791fbf4706bffae04a1ac501d099b12309ebc85c6b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:09:51Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:09:51Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["a4493fc88328eba553ef36791fbf4706bffae04a1ac501d099b12309ebc85c6b"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a4493fc88328eba553ef36791fbf4706bffae04a1ac501d099b12309ebc85c6b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:10:55.578Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-02T21:18:39Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:09:46Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:09:46Z"}],"name":"a6a6232fd5656520e75d100c41add5f1637dde9705a4ec608bbb90b724c258a5","namespace":"kuadrant-system","resourceVersion":"104263","uid":"f1cd9b56-4a31-4ce1-b740-613be7e0159c"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a6a6232fd5656520e75d100c41add5f1637dde9705a4ec608bbb90b724c258a5"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:09:46Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:09:46Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["a6a6232fd5656520e75d100c41add5f1637dde9705a4ec608bbb90b724c258a5"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a6a6232fd5656520e75d100c41add5f1637dde9705a4ec608bbb90b724c258a5\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:10:55.640Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-02T21:18:49Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:09:45Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:09:45Z"}],"name":"0e89fc4b75d3a5dd95fca2c4d8ae33c7826f05a8016c44eb39e28c3c1860fcfb","namespace":"kuadrant-system","resourceVersion":"104213","uid":"fb6659c8-fd81-45b1-ae33-089f73dc2054"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["0e89fc4b75d3a5dd95fca2c4d8ae33c7826f05a8016c44eb39e28c3c1860fcfb"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:19:19Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:19:19Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["0e89fc4b75d3a5dd95fca2c4d8ae33c7826f05a8016c44eb39e28c3c1860fcfb"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"0e89fc4b75d3a5dd95fca2c4d8ae33c7826f05a8016c44eb39e28c3c1860fcfb\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:10:55.707Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-autores-363e15","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-autores-363e15#rule-3"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"5cdab84016ac0cbdcdeefa51af6073e3b4b585224a1dc1fbb3d563f73cfa370a","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["5cdab84016ac0cbdcdeefa51af6073e3b4b585224a1dc1fbb3d563f73cfa370a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-autores-363e15.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-autores-363e15.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"5cdab84016ac0cbdcdeefa51af6073e3b4b585224a1dc1fbb3d563f73cfa370a\" already exists"}
{"level":"error","ts":"2026-11-02T22:10:55.768Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-02T21:18:31Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:09:49Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:09:50Z"}],"name":"0e042276580ed8976d8ad3afd87a71640025c28b9b48f5c88eb159ec9998209f","namespace":"kuadrant-system","resourceVersion":"104558","uid":"107c286d-68a8-4f57-846f-aa2ab62e698d"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["0e042276580ed8976d8ad3afd87a71640025c28b9b48f5c88eb159ec9998209f"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:18:31Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:18:31Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["0e042276580ed8976d8ad3afd87a71640025c28b9b48f5c88eb159ec9998209f"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"0e042276580ed8976d8ad3afd87a71640025c28b9b48f5c88eb159ec9998209f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:10:55.780Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-autores-363e15","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"name":"kuadrant-e2e-autores-363e15","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-autores-363e15","uid":"b503c6f8-803e-4564-949f-2eb6fb6fd84d"}]},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e972c675546ea6af7d81cc5a73f2cdd49a66549d6da470ffb2560f70e0f57e7b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-autores-363e15-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__984ca63d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-autores-363e15\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-autores-363e15\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__984ca63d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-autores-363e15\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-autores-363e15\"]}],\"name\":\"163982789abdac20fc654f6dcfe2f62075ab17523b0b2413d3dfe3fa45a73a35\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4ab093bbd181f524f77e6add42b63b164c6fa1763796bec87d0c8b6ba5d1ee73\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-autores-363e15-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__984ca63d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-autores-363e15\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-autores-363e15\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__984ca63d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-autores-363e15\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-autores-363e15\"]}],\"name\":\"a1d1c73d9d2f66a7a60a50de6c42aa98c810c4acd51708f2021dff5714396119\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a5aed9501c7dea48c7bdcc613b6d3b3d62f185606c8b0360624970557c5f14c3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-autores-363e15-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__984ca63d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-autores-363e15\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-autores-363e15\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__984ca63d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-autores-363e15\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-autores-363e15\"]}],\"name\":\"aa42b86d8f3ca4d6b7ffe99ac916ddc3b112eb22c838cf59ac69f9143ed7ef05\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5cdab84016ac0cbdcdeefa51af6073e3b4b585224a1dc1fbb3d563f73cfa370a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-autores-363e15-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__984ca63d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-autores-363e15\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-autores-363e15\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__984ca63d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-autores-363e15\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-autores-363e15\"]}],\"name\":\"9312817ecd1f9dbb687598216efb9bd4ec6353aa83acb4d8159fb321c2de9fca\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d16a81ba9f403bee59919e44768171dccc31ac7576e0a1c39bd1c0d01193241d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-autores-363e15-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__984ca63d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-autores-363e15\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-autores-363e15\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__984ca63d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-autores-363e15\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-autores-363e15\"]}],\"name\":\"67576e6a6e3ac749bd7c9c3b0ce3473a26b5ae2f42ad617f5121b8b81010d497\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"36c387407442b9a646531f6110f864d6de1f0c2046bc6135607877328d6ae79e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-autores-363e15-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__984ca63d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-autores-363e15\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-autores-363e15\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__984ca63d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-autores-363e15\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-autores-363e15\"]}],\"name\":\"01d1f8bf80ffc68633c4f5eda1ea4b71cea7d2576cbbde0559d3de5d46d45b3b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-autores-363e15"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-e2e-autores-363e15\" already exists"}
{"level":"error","ts":"2026-11-02T22:10:55.832Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-02T21:18:21Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:09:50Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:09:51Z"}],"name":"2ddbced6f2f51d410743da1d9db1257d0006d99f38986dd7cc7efd26620791ad","namespace":"kuadrant-system","resourceVersion":"104609","uid":"cd4dbfde-d07e-4a14-91a9-0670da25429a"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["2ddbced6f2f51d410743da1d9db1257d0006d99f38986dd7cc7efd26620791ad"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:19:18Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:19:18Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["2ddbced6f2f51d410743da1d9db1257d0006d99f38986dd7cc7efd26620791ad"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"2ddbced6f2f51d410743da1d9db1257d0006d99f38986dd7cc7efd26620791ad\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:10:55.894Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-02T21:18:49Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:09:48Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:09:49Z"}],"name":"2d953f7313807988e63546aa32431d96f77e6989c672f8ab42827c1c21918630","namespace":"kuadrant-system","resourceVersion":"104449","uid":"b738046d-ab13-49cc-aed5-7c740b8a58fd"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["2d953f7313807988e63546aa32431d96f77e6989c672f8ab42827c1c21918630"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:19:20Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:19:20Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["2d953f7313807988e63546aa32431d96f77e6989c672f8ab42827c1c21918630"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"2d953f7313807988e63546aa32431d96f77e6989c672f8ab42827c1c21918630\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:10:55.959Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-02T21:18:48Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:09:46Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:09:47Z"}],"name":"99606c4eac496429be47144db9f3f48867815df12eb99d7be8073b767d7e44de","namespace":"kuadrant-system","resourceVersion":"104298","uid":"d6cb47d1-1dc7-42b6-8504-7d432068f40a"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["99606c4eac496429be47144db9f3f48867815df12eb99d7be8073b767d7e44de"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:34:17Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:34:17Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["99606c4eac496429be47144db9f3f48867815df12eb99d7be8073b767d7e44de"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"99606c4eac496429be47144db9f3f48867815df12eb99d7be8073b767d7e44de\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:10:56.026Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-2-simulated-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-2-simulated-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-02T21:18:16Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:09:52Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:09:54Z"}],"name":"669658556fba0f45c2a82def2f57614416614ddf154ed8dc5f4f9188f10130f2","namespace":"kuadrant-system","resourceVersion":"104715","uid":"51e387c8-3ff5-4593-8714-ca56441125ed"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["669658556fba0f45c2a82def2f57614416614ddf154ed8dc5f4f9188f10130f2"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:18:17Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:18:17Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["669658556fba0f45c2a82def2f57614416614ddf154ed8dc5f4f9188f10130f2"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"669658556fba0f45c2a82def2f57614416614ddf154ed8dc5f4f9188f10130f2\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:10:56.088Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-02T21:18:31Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:09:47Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:09:48Z"}],"name":"596921ddc7ba8523386263c5cffcbd6ad9b6a385318ed7e24f72be06f36fc398","namespace":"kuadrant-system","resourceVersion":"104441","uid":"e8225d03-0c84-4de9-b550-3d9f9f1ec089"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["596921ddc7ba8523386263c5cffcbd6ad9b6a385318ed7e24f72be06f36fc398"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:09:48Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:09:48Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["596921ddc7ba8523386263c5cffcbd6ad9b6a385318ed7e24f72be06f36fc398"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"596921ddc7ba8523386263c5cffcbd6ad9b6a385318ed7e24f72be06f36fc398\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:10:56.150Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-02T21:18:38Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:09:47Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:09:48Z"}],"name":"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce","namespace":"kuadrant-system","resourceVersion":"104416","uid":"214d0d20-7d9b-4385-aa4a-c6a227088314"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:09:48Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:09:48Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:10:56.214Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-02T21:18:31Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:09:49Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:09:50Z"}],"name":"d303c788902ad4467c7ae545d65cbef45564d1c0d56396c93057df3909461aa1","namespace":"kuadrant-system","resourceVersion":"104535","uid":"7521f93f-4074-4748-8dfc-7b8329156ff3"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d303c788902ad4467c7ae545d65cbef45564d1c0d56396c93057df3909461aa1"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:34:11Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:34:11Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["d303c788902ad4467c7ae545d65cbef45564d1c0d56396c93057df3909461aa1"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"d303c788902ad4467c7ae545d65cbef45564d1c0d56396c93057df3909461aa1\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:10:56.277Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-02T21:18:21Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:09:51Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:09:53Z"}],"name":"1704c6bc15d6f547acca888061680f2275f690cb79e5af6fee44747bcf278b95","namespace":"kuadrant-system","resourceVersion":"104684","uid":"0c1e6b62-dc00-4c2d-acdb-49434ea56239"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["1704c6bc15d6f547acca888061680f2275f690cb79e5af6fee44747bcf278b95"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:18:21Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:18:21Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["1704c6bc15d6f547acca888061680f2275f690cb79e5af6fee44747bcf278b95"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"1704c6bc15d6f547acca888061680f2275f690cb79e5af6fee44747bcf278b95\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:10:56.364Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-02T21:18:31Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:09:51Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:09:53Z"}],"name":"75fd86e2a4870af5fd78f2ad7aa2a9d79aff977b3678d81954b1e207a9315f2c","namespace":"kuadrant-system","resourceVersion":"104678","uid":"e083d534-231a-42e3-b214-9a8de2773576"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["75fd86e2a4870af5fd78f2ad7aa2a9d79aff977b3678d81954b1e207a9315f2c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:19:19Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:19:19Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["75fd86e2a4870af5fd78f2ad7aa2a9d79aff977b3678d81954b1e207a9315f2c"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"75fd86e2a4870af5fd78f2ad7aa2a9d79aff977b3678d81954b1e207a9315f2c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:10:56.425Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/maas-default-gateway","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T21:16:03Z","generation":19,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"371b36ef-c4b7-499a-87db-1bdf4e8f92de\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:09:46Z"}],"name":"kuadrant-maas-default-gateway","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"maas-default-gateway","uid":"371b36ef-c4b7-499a-87db-1bdf4e8f92de"}],"resourceVersion":"104216","uid":"86b5bad7-2bb7-41c9-b2c7-bb4c8f13292a"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"61b044087f8d56658ae99d15d4fab3cf1ad74e6636795c133e054a5aace0540d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e511d90f2140d9cde0b2100a0a488dacadd8f510bb901601d5e6fd25343a0f1c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"1e42d143d6033a677e2aa0de97c78600094e515d7c0d3f86b4925ef8be636163\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"26b7799af8a40e8b9585c255ec018a63b0074c27282d4dccebed45f14e703b5e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"ce74c295ef1588342c7308478a1dc6f6aa2cefc063e489a124e536ac32ecfdba\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"fbe95a07558afcf05ef68ff5beb293f527d6ab93dfe79956b5406dc463d78363\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"40a29ce438b5ca497e4389ce52025a9b91c0cf3177b1bd5c8519b041cfdcf75f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"845137604829fbc62550504d7bbe5ae8d55ea1cf474160cd789a72e811000e4b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5322619ef71b1d1ea3204f9014d0341d4402275b6ca23fca69d61cfc9a61e883\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"16b86e50920afda06ca195a717436238f5fca7f2e1bbe0939875bcb7d559cf31\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5da9070dfa3a5637213b5443376170dda26f57f381af542891ff3b19cc7a9d06\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"00ac1aeee65e93fab2ccfd89c11167f4d954e1cfb3e8b09ad3371a4fab4b6369\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"55c23b9552cb66c175ed2202220df6480eae89be2cda2e925458acf31c5bdbce\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"99f16470bd82ba57465b128d1c0fe73ef189001d77c6ead3fc34c98ad3ce27a2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"a6d134df42d4d90d93840f63dc770cadabd22dc22af01f991b6c067e96733c95\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"0be74a5083c4760789001949965ce7020664f6347b769f9f20735f95f9d34989\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4902f5a84509d49ec2fb75275af9692b524b1334f7c919eff1d9f33957acd5c4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4f0e9d14c4d1857d5415458306310b00d6a94ce68179c717917d13d30ede9b87\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"29d1c55f30b76c66bfb15588c297271fac7d5e9ca415f0c938d63e524a8187e5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"df729ecdaa88f0abfee16b94ea7be9c5aa7ccdfe91fbe0676e22ca4bfae35f29\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"69baf76a5f2e8f4f8d3e40025586b942794274a22455dc40e0b7c0116f0d2297\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"8199294e302361a6898546d62809d67d522e9c2b375c8b8727f0d966f7ad4d39\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"61ef91ec2e76cc107813a7351d7e38bb32d1ebbff452efa771b01f8a512fb99e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"f2d9c20918355999f92bc489c836e0d17ed8acb713739da4b73fc8ee019fc8a4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"c19d17a63dc280a83fa4dce8ef0f825a16118c6817d3126d095473335018edd0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"05aa8311318e9111c5925f4be454406e209ab832bc6e8ddf01725ebe4f1ffdcc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e680857c19914d59f115788ea93836704a1ddab04f5e495bf863d62ad8a5aa8e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"96b761d418352e3f8d172aa80bfb5542df670414bec97704e615f2e3e665c8aa\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4a199d441e37ffe8d62509ae7048cfd055df0de5619e9be81a8f47f9a64a7051\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"f17cbb57db714a7faf03a7e4ef3921069096709486e13c6b84b4b75ded84ca96\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"d8631ed26c63871d1138b31e9c971d72ad1152273309b27ee33862700ff4fb0c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"67a5fec0fb2398a03579a732c5e4640c9f9c5db5385b91db90ffb49522369904\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e5b5be5a42ead835fa1a13840fda21cf5afb14b8226da9a3008a321db777f685\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"a01c6bf1aa626b04ec6a9fc85abb6ced9b4a9c4cafe81d2176013cf3b0b4c4aa\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"0eb9568cf0385cf054d8f3ebcce089d8b225a9fe1b6061e3689f7bd26415f872\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"633e4cdca29207ccc8220565a86635db5bf3f227ef564ee1a0da6a5d6076231e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"ecaead2c94524df89be70a7c961f93dee41ef96545655d22914542a89dffe341\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b9f3d06eb6a92218fa1757dab6cb8e66e42102d46c94e6c0db854f694d6d855c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"7054423a069def7a36dcb993faa1143223d985021782b2552d55a522caf2eba9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"deac1d64e5b84f2fc26848a49153d512090eb1e2bffb72dd7091fd21a1234e18\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"3dbcd4467449162cad999d40988202fafebe535215351d004f1bf05937c76508\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"534f6056dec477fad33defb3049c84dc5497dacd9f6e3f2061b13ba089ed1cbd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"fa823b540319ebed6b9b488f79dda81b66933f7e616cfdaebe3543ae31b33b13\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"fb6ca2eee2169356e662d36e92b2b679a1235a86d976f9807297ad56386f6e2a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"0427c8054235bfb15b63a5a467ab470ce1cca867b5a232117e73059a4ec8891c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4aa2417057e81c2889811e45d786ab1591e3dfafc889b838aad26a3ec2cbfe9b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"acb4b8def068bc86711642e3242fd621a66a54452bf86a82586fc6bf69e8192b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"66831c252eeacbf3e19995c48be4a005b1726766550076c58cb47b979bece639\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"a80090acc18b7b092f5e9f2d49fd8643f16514df89a716f8f69afe4a7afebb76\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"f85e753996f9e90384b461c5504814ca0cada63ea0f44d6630a619ab36edbe08\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b72a3d2d64d0ddc05f076a7fcf59d924552b45080846c09e1084e67867a76e9c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"cd58d9e2c4a744adbc8ab336cd016f27bc1f14a1de2e975afa26b7f5113d1bfe\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"29c80f1787fdadd41eb24cbda56972d49e35d261e06b4f4fcd5851c7e2de3068\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"277489d8f3c2c5149e18b965c81958774efa7e81299a66265853d6af2e16037b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"7c211141c74fe1e91cc494ac860a81616dc49e2a5d1951dc70bf0f42824d53e5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"17df13edb14ef5c49ef0cc29deaea97728695c57b5ccad8feb2b23589083e083\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"014f0c5a15872002db778e7e40dfcf7dede4ab2db05bb6a08641f5d523cb3afc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"bdac37244e7b891cd2973e74c7b0db5110c344505a09a86e51fc6486ba35139d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"ea8a88726b68ceff7de514d89e12df024a67856b697e02c26b6e762395fdaf0d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"81df9bef1abee093a91a2eaab4b1a53122eb16d4150f27c879439ca5d99112f3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b3be2474c46178c0c39839b29d8d7c87b103574b042bb23175ac0e9786fde158\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"13fe2d56bb22ec9a1307da7bad05cdda8724fe788533352aa581ffdc96874c78\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"fbd262e90a5eaaf98d72db889488cbe13bdac9381f78343ea46c402679569fb2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"9794c132b0cd770efeb9723db862265df6a3584117821e44e2a5660a971c59eb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7def4ca304ff3869be64c2c02523fd9d2ff43465099dcd1124399f293eb4480f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"a86375603000eab9b808785894e0e63f3e53024a46681e97c41a06c4e0c67023\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"54eea38241838159e47386cb814ad20fc30631ee8c42d57f0ff8da80fbbf62a0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"d5b69938a04a8020c8a8d10df4921f2989326ca4811c3843a7201bdb1d5cb848\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-unconfigured-model/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c5a685f2a5ebdef5f1dee488990c0798a45ddce399cf99e7d0c505a5f46c69ac\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"0fcfc87f76b773c6a38375e46d76e569a372370e3ae2e7003932ed8ef776f5bd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fac07f302f653115fda3d376325a268abaf66025ed0e4af73e88bea3f41fe933\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"aa28eac51fc5e37c385a11a534759b09fb7998ba74bb01195dd8ff89d9e9ec43\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model-2/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"06165835c4461c0b16a2bc5bae936aff3c2f351edbef8aa378f1110874acedfc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"17390f436804c5d305f1dcb9ea78a72032310736cf630bb9589448f605bd1fd6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m-premium/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ad8714d3b8aed2a9ffd68fbcf0288557e9c1c059c1b59ad3e9a09910b37fd61b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"c4353817d988db43a8dd6b0d5c29305f9dcda76e19c9ef2c820808b0384a0bf4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-embedding-model/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"726a74c13fee356e859d9317271facbb60b066acbc5571de22d056f13c60878f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"1415e0d2aa117656e44a7d6aeaaf16aa87f18bdeee129f7e6757b2e1c7f996d3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-trlp-test-model/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cad6ab5a81a65fd4cb03a0fefdab5de82aa18c30a5b95078b1d05214b0606f40\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"0629facd48a81e3c82281be4a3f8566f55e61d1a30a8516b23bbb63c58e8f6f8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e5f81c7f7812462ebef000c68dc043013159f22201d2eeecf05c220e809f96ed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"2e292ccc99f990aa723c04a99267923f5b62fb8f3e0ab1a978e8334b9397ada0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-unconfigured-model/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"68502d1c1143a647ad56f2759ea89a4c5b3c74a8054739f7e7ea9ba6535e3b74\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"2b69b629cb2b5224adc61a8925f43333ba0b52ab39260c124057e9e82898937f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"74b47f1aa1203aad58596cbaab10ae46e8fddd08ac49eb57a26bdba532d88e72\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"d1e427bebfc099de9df176c73ee76d5dbd6f77919e840913d3a10818678c7394\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model-2/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3167d3bf853032a93e8569019dcd3e5aa33af9cb580cf9ca138990567fc9d857\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"482d2a79771eafe7f8d177701f43a13c6c4916251440ca00830042e050247443\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-unconfigured-model/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"99606c4eac496429be47144db9f3f48867815df12eb99d7be8073b767d7e44de\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"e635ba9dc59ae1e09b34ee6e0f2718b1c31e6f6b6ff2bc6d05c094fedc42c40b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m-premium/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5d590119308c6f848b12dd3ecdfb1b06cc2fe172af702455c342075944a045ff\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"caf1a50009b65f25df3a996283d38ada17bb57a2ebed842a552f137f6121c63a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-embedding-model/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0e042276580ed8976d8ad3afd87a71640025c28b9b48f5c88eb159ec9998209f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e17697b7e023603155a06feebe0602591826e794ee2f5189abf795c259be1b37\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-trlp-test-model/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0829dbf2b5dc0900de272826295adf351de381b46fa6fba00b896213530780f6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"1e772a79f4b1660c75cf3493e21c9ddb58d2de640363115c57dac03a10f22c33\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cc1ffc2ee4e05618c28c108cac668c0c02eb8e658953439e47a733edab44a1a0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4fe1d1c6df78a26f30e2392ae9da7fc67b0845dfda48a89e247bee6aa536d8e1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-unconfigured-model/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"486615827938fa99814e929fe7dc62bc16f7563179fef855074eb73dc7ce4724\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"ee2f6a8baeba450552a3e168b9df1808bba4e2c59106ad0881ae78aee4fcbd40\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-echo-model/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"98ec9d74d07c88c1e6923ed1cbafd4c5b41bf1763b3a942282f964f72425ae57\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"653f23106eb8a10791805e2f9355c750c56aa6873ef311fe707e76083d93d55d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model-2/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2ddbced6f2f51d410743da1d9db1257d0006d99f38986dd7cc7efd26620791ad\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"1e776cd43733621e16ebc27c91dbdeea062f73e4dde2f494701c85a6843faeed\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d752a44ad8df3a50b5a1147110eb89039ed764e1fed197b1f77e0935c424a90b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"62f67bf9885222d9a86a95e02ed17ae26ad7cf71e15aae0a7517e647c29618ca\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3083301b5359be118f04faaefcd72fd127f2297a3374ef7231b59a59a31b405c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"e85460469045801c3e6927ab49333ff01612a4899d5a7c29ec27824b9942f3b9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m-premium/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"67c67ce733de50e7b3d797bb248036b01badfe02e958f5f76af05b58a504989c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"f9b414e31cae5d16cc1ad22ba2462b8816d9369a97316f40f32a6e7912fc4f78\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model-2/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2d4a2275e6cbab5c26d5c3cf2d75aa2776066390e5b66f5498b16b26bc596af7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e33110b3dae1dd80b2bfa573def0b488a6fd4f1243962fe81d58e1853ed2d3f5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-embedding-model/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"23672b974f0dbc05100a34c78d2b029e41f1d5a3752f3fcb52915f56db360e25\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"a6183db94e49e3ba0149a19f4e52ff19aebb55d6261b0cacec0656136bd2adf4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-trlp-test-model/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8274337fc3f0de48e5213819aeb4a46559c4f8b3428c1bae43c0d75207ef5264\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"efcdf81b8f74d74207beb897f447376d1f950ae12e8a330f1ae67b0d9dc6a545\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0e89fc4b75d3a5dd95fca2c4d8ae33c7826f05a8016c44eb39e28c3c1860fcfb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"7f0f599e497ae797f3b5922614ceddb3375c007237412d01b520bb7498ef288d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/premium-simulated-simulated-premium/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ab505bdf28287fe00099987c1bde2c2f297c40c792a7f6cb5fbfa5adc44754d3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"06c1aa31be81b1f5c6266514c955712865b30117291a39dd749994f4ce931145\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m-premium/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1704c6bc15d6f547acca888061680f2275f690cb79e5af6fee44747bcf278b95\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"6a8319194e2c2fc998268cdbab03a5aae2d83019f5ac30c316c4e548895b7c63\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"eaeb360b41b3f9e0bd6b247d4dae3eef1ffc3355d6e9408df3f8f71bc7f033b5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"32cfee4e66c307d5ebed6a406d2260f4374553d184b5486fc53cb64bc6ffcd8d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-embedding-model/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"135ffad9bbcd33779a0b9a1c0dc5d5f547356be21489762803640aca855c728a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"3194cef788c3fa9898599a57480aeaed07c6eac2edf957788235b37d22918588\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-trlp-test-model/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"17002b7f0c8e62582ad262d9c2b8b038ee7f2a9327fe34f21fd4f47134b7b8cf\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5acde2b886749c1c54f99db5c33887e6fc5ed0caf412daacfb5df0f329882c66\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a6a6232fd5656520e75d100c41add5f1637dde9705a4ec608bbb90b724c258a5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"37a71c27032e51fdbc7ca688064a47abb86230a8138af6eb55e8069fad975a93\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-echo-model/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"92917da87eaba4f2684cd45947a3698434b99ff4ca6d3ddde51d6573aecb1600\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b2b26e0af9ad7defb486e5d1db19af6bbdd0998559d16f3776651669aeb4d067\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-echo-model/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aa7038625b8f43b0c002f79637065e5ab90468f50f998759d08f2c4640c07c04\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"2a62f0614f6526bc3f195f838aebd1abe29514f2707db40d9ef738d645ccf001\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"de97dd5d45c6eb12b4a1112ed1f362d8544427428d2249a399e26ba069d6aadb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"22b2ec7ec96ee09c9e07a84cd3d313c2223af42433bbb28c5846401f64d5e3c1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/premium-simulated-simulated-premium/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"dc061bec60bd28b1c132bf30965b4810124429576337bcc4a6030617600d1714\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b188b939a496049e47b8ef664d7c7c490722f1753404a08d89ccec1dcb87b8fa\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-echo-model/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"75612d85af2bae456dadd78163b2d2f9015c0a0bf4e20bcb8a555e6a5ab3b8c0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"96bc4fc13cb63707a942ca33034f78d2b39476a10860398523789db3990584d1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a4493fc88328eba553ef36791fbf4706bffae04a1ac501d099b12309ebc85c6b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"d84e45c7a3e370ea510e8e0294e009b29bc2f2ea789c47559293007b6c4410d2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/premium-simulated-simulated-premium/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2d953f7313807988e63546aa32431d96f77e6989c672f8ab42827c1c21918630\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"dd2f15d9a08862ab664dadf9bf5da25828d327a11a07849fa919713f034c2b0d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/facebook-opt-125m-simulated/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d69b9c128f599c9ea1af84bb3e783ed71688baf6b3ad2b86f2b7183f9a4208b9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"4dfeb9ff2318af8f84e70b11545800bb83948c080a97ae1ece5780d4022bb383\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"dd89509e97b96670685602ae2d08749226db8693944d2c6f868af9d3e0a5feb5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"1025db78adc8b9c9592b692cc227b1a306a99ac5502300d9ed4ed7615f5e3ef8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/premium-simulated-simulated-premium/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3386c5e86c72abcdab369776ccd7182024ab8681cbe497e81724868f101a3c0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"58e90354179740b1af406b2911c9997f3f3283475aeb77ce7918f3b3239a293f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9e75e9fd02f51c2f043b145c5d6b82e95f1447b388ee529262aea27a6a2774ef\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b89d1075a79c93acaa097e4e6db4d6a4b23bf3ffe5e964409e29b258ed725a99\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-2-simulated/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0913a452a02695c6681f1037232199b40b64236fed4d29cdbb41561695826340\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5c0b495d1a10c1cf1548ef17998cb18c0ca25371ad42d5ffe1aed42bd55e31ad\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-unconfigured-facebook-opt-125m-simulated')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"010adf02b2e7deb40c572f4729b6dd4619847c8e6344137326b72df28772fc1a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"c04f8a7c7387e6794115c41161cb001d8a07340d2878cb8f36774a8f6a200ba4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"105cf4dd91a8abf4a93abd65b255521c3d37b560b5d23f3ec59757b5b362fae6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"7e7d1a0ec6d957a4d4de94f93078f10e836b23442c9cfa90f11c8520cca12e87\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-embedding-simulated/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"75fd86e2a4870af5fd78f2ad7aa2a9d79aff977b3678d81954b1e207a9315f2c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"c3cfc634a11046a837448628e2f17db0ed3466194da289a808544d874ecf6451\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-trlp-test-simulated/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"54cd0149b818480305f3d0024b3c95629cafb641b48195d003b2b7006d5c6bcd\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"f5bc618bde549671e84473b23ef3632426f8606e2045744a860c603f2a7675d3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bf65ad13397c94660867eb0205e06d1c9bebda4b019f632c0d0b8ef989930381\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"d8d67afd40f17474755bd3f6b00e265761bf5154febca129bc3f2b0bcd749c41\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-simulated/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f9fa9cfc2b4e701183573419a92c79384cd30210289602f0115c75c5029d55aa\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"ac2105eead12bb02dd7d1691cc77fc8a580b903f98564a8fd585dfa345dec1dd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"596921ddc7ba8523386263c5cffcbd6ad9b6a385318ed7e24f72be06f36fc398\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"f4ae34c5c82a0969651301a535f404653a60a5d75f20c7ea56ad9bb89b67e9fb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f95805f0e9b755664735d898c1d644d571943be553204d3f86136bc35719ff13\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"95c39f44eae69bd53f57e5ff93243887dafd591c9b8cf2e736f0ab034e67021d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/facebook-opt-125m-simulated/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8d5571efc1d304f5bcfc2ffb4ac6819154ba5556c29ce33416d460b887427984\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5d6b359055267732253f201a1fe48f0abe6d5e22b011c70e1cb006eea672f535\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e91aceffc2d4f6d6b120625bd3ca23781b74a1cae6cf1da26bda310bbed0ef07\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"c8475d27649a649c955538ff79eb001372050ff4f1d4ad295b01dc6fcc69ba2a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/facebook-opt-125m-simulated/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a402d1681ab35bace735c19b1d084a86eb3d741d4e1c14371cfdaa55d22c3ebe\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"7320c049419b863194fd55db5ebd887462dd24e1289e6308d79f047431f2bed9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-2-simulated/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f9b535aed6243496a67741936e53a0d303bea1b872a06fb62f1f9c27150edc40\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"5eeab80447ec6c71797517b4d94c6623353e89097743360eadd7f31115976dfe\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/facebook-opt-125m-simulated/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a9800464506c58f005016df354e160757732171ff4d19747202524955329b998\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4984a24eb707d1b965a79974a98ed4afc271f2ca356b150cbc8943de1ddcfef8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-embedding-simulated/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c82a1a3dc2ce54c0b664f79a2cd895a3c40f774b3694999badae8cedd328292e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"276f5d5d67b2bd83c05c2b39e4a262885498e6807e3129a866eff0651b3604a9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-trlp-test-simulated/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"669658556fba0f45c2a82def2f57614416614ddf154ed8dc5f4f9188f10130f2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"692f39321f892929348fe56801dc14c8a35eaf749609a3a5f4b5e684edddf17c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-2-simulated/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c4399a95e89654e5b2bb5fabe45bc947d11ccd1448ebf64c30b195b34f239d58\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5b273834f06c6341dd07bba6c809b3297ba2514e6d3b9b5d0f4f8211c68ccf8b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-simulated/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5e4821ff903ad6ca2e1c42162432e34d8b0a2a78052961e753d36b742193432f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"f35ed2fb168a3a608435006c8c1b103242765d7d37f41bf1dbdb7bbc0331da89\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a91faccafad197e2a4065ce3d12a052ac484d2e8fb2fc9265ee48f02b28e6dce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"fbfd0ada86117ffb0a134e591bf8b8390012983d25496ef188c6da73fef5eaec\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-2-simulated/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0020c64019ffd1a0bdcc75e6441e6a30e6d8bb08f463f67bd2408a1e82b95b2a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e78a4964c93ec23890e62f7f50201f5b832b4c714066a914dc734d8ef60e8213\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-embedding-simulated/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7c924aa2b37ea38067b4e69052d541ea2e7c86fbdaa79b19f9ea09e87adbe4ff\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"d5cf96eeeaa56bb891ea0cba28f7beabf17a8c0f061ea01c768ed842dd26334f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-trlp-test-simulated/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"028a8b5bd5d4e690eebb2f20c5fd47cf0b3c6e2a3619ba9e55322bbca7b94cc3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"8fe4100eab1f023f5b06dd8e19bcc80109b82503466d49576acc234cdda9bf0e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-simulated/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"80056c658070f49140955cb6eabdbd252857a614af6b0f2f2de7a1ab1cd47949\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"53aad0199369eb8c8f787ea099e93092089c04344e8f910dcff366f54bc831cb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-embedding-simulated/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2416d7b42d11a09d7152746be0e114f8fdc87d0fbd0efa9dec5b52b011082194\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e0cfec53d1f17771317082d9a7d69806ae3468971bac79a1135f2b0d51ecdc07\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-trlp-test-simulated/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"50c2058cf11e07a931b06ac4446a56eee86855f00badf26618abe486a7bdcfd7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"f3b6e6c38a521fae8ef5c7fddf3b3178baba88effb4e5338e0b387e28ecc468d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"134a7a790ba665547ca14f80f917549f66ee5063fc41096471c0778399db6dd5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"4ddd3fa1f54c642a57a48737e710ec0116705776084d8cebd8134dfa49accdde\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/premium-simulated-simulated-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4d18a96899c43d55ee63d2ae1a7a938c7e873d88b2fd95f06b2e3aae2c7f1c84\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"44e38055536c3f0d49cb81abb42bfefcf2c78faf963a6160afbe459bbc04db39\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-simulated/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8d34bd12ba2030284fcb69127f53b8158bbdd4a1432bfe619165b4c2c96cc061\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"c9dd9c233e43b53241ee27e937246e51b8f3331f30a7fba22640617c1b0bf47a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/echo-simulator/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"319e246831bdaf5e765e63d5511b516594fd2b64527850e2ddabd2a4a85532ea\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"7cfd2ed5cb8a5913fa5f55b92b02805c6778991c01c80eb14a0962cc710a56ff\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/echo-simulator/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a8c8220ad6f1387002e262ace5db78a2c4bb39e5953306702a228215174f6796\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"87e1712d02794c6d66ec1a932f02901d7a4369f46d0f041178cd3efadb7f59b7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/echo-simulator/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1e077a716d89a43572a3c16e8d0b0436816baa48a2ea227603701f10cad6d6f4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"ae9eac2a2b8c8311bb8c6ea82ab445a5d6f50d2d51c3f79962be9d82007097ad\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/facebook-opt-125m-simulated')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3f23315aacd6e16f4ab41f96aeedc9549d1abdfc9476577a47d45d12875dec5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"165d3b8e224f71685dee07aadd133117aeeed097eae99437d561d5bfa2d22233\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/echo-simulator/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6687eb3cec74c6c51428ce3f3d22d50ba269f59015d1bc8f185da49eb095534e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"05ac0e89d0298398d3996609d7c22b514bdf08bfa3787653bc739995c5942441\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-2-simulated')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bfd36c5ed73eb81df97258ffa1aa36d8cbf6f3e7a8096c33ca4ff417be59d002\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"d5ac583036f3821c88111dd82571eab1fc94aa4e9fcd045b27336f798e26075d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-embedding-simulated')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d303c788902ad4467c7ae545d65cbef45564d1c0d56396c93057df3909461aa1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4a6b0d84cc35c0f532405eea81056481fd54e7ad71284a97ce8f6a2424eac819\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-trlp-test-simulated')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2f53b030326b8e1f5908c601aecd3fffcb6d08a8337d0bdc53ee1fc699a4cd71\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5c3bcd9fb119b0fd45f3b4ba5de5f905cacbb4963fec309a0961a40f76a7a7a9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-simulated')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"94ddc5e77f082c32bebc7a36bcebf621518ebf303e83b9c540da1352d04e620b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"50057c9a2acf4ae7152e8c97f7778cb04340d1470974e5272422d0bf244a4e5c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/echo-simulator')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c6918972d1a7f8ad5201880b7d6d9c1191ca1f25376682f691def7868e3fd02\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"01cc37113b4d6c301e355f63decf46a21e93a023494bdfeaeed2890c97ec1f57\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a82769ff87473da04c27497e160e9b4b1a5dd93578e0cf2342be8b2f06845269\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e747b72d92315b743934153588614b27670cf0c9d9dc4fb380ea4965def7f235\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"06b05a8e4dd69bdc4f333ad9509ee8cad3c5c0f5dd48edbe94c1158b60f79ed3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"661962837510c6dc6d1faa64e61ec3086efa9e0a2e7315c6ded616c1879e5ba8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b4bfec1b33959dd0ebfc5cd6fb410688e820d4b55c7f149cb4acc4353f30a9b2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a7740f6e77d024a437502c023fb1d8939cb3cc2b9ed7f4073af7d779e19459eb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"f82564e076ea3e672592bab71e048537faba17a5e909884c2a0204e235905a69\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a908063c86927e6bf07b7d793aad9f277ac3c2a8f5f5d468b116cb9e07929b14\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"fbdfff5b213f506d78434055d011cf63d616653e502ee04408a43578986e1e5c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d1d232e06f90d479cd9b802f24889e83af58c51cf54ba273d5e24dcb8a297688\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b49f2d7e152d4de959577465d2494ee11771b4c439cb6eae71c90bff26224fb4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"810f299b76daf089b33c92cfbe0445ab5cc89a48d38e36df0cc89ed6cd1fe8df\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b27d6255cac73fc039120e157e1f3ce0e99e86995ac5a66974d5e8744df6c64d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4f800155f293f82eeaf5fd6a9553c0a1bee90f47a295bba8d7a04b3f11faea33\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b1ccc7ca46f6a14e90afe1dddfab8763f07f30549ce1cda0bae985581f063098\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ce7d381faee9ff949d68d825ffa1dcb9247dad19667ec59a8e91847320dacbe0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5d72fc7cc241ffd60d83142a900be014cc5d57320142e013493b21ecc86cb534\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6565c4085b3917d5390fe1b0194fb3d8319f1d56b45867e3c68ff740b5c16ef3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"be1ccea8a4cc19c7190600de6631fcb661b63db81e2862348a6ef4f90bf33fa3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8d8c8aae1332bb0300ac2d65be9b8708fbfde6d4b5599ec52380cf1f70956045\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"ca48ea5d9ee701ac5383800306378d945e66ca5427eba33396e6805ebbdc1ea7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f6df6bc14432fdc346191db86ee06e75c8090ed87a32c984493c837e97a10be6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"fc54a1d4f18d4d59e58b6a3aa31dbfaddda2b89e5c28dc9eacf14ff38a414021\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"maas-default-gateway"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-maas-default-gateway\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:10:56.427Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-02T21:18:49Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:09:51Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:09:54Z"}],"name":"8274337fc3f0de48e5213819aeb4a46559c4f8b3428c1bae43c0d75207ef5264","namespace":"kuadrant-system","resourceVersion":"104735","uid":"c327b713-1cdf-45d8-a6fb-af24dc0f9100"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["8274337fc3f0de48e5213819aeb4a46559c4f8b3428c1bae43c0d75207ef5264"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:09:54Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:09:54Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["8274337fc3f0de48e5213819aeb4a46559c4f8b3428c1bae43c0d75207ef5264"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"8274337fc3f0de48e5213819aeb4a46559c4f8b3428c1bae43c0d75207ef5264\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:10:56.496Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-autores-363e15","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-autores-363e15#rule-5"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"a5aed9501c7dea48c7bdcc613b6d3b3d62f185606c8b0360624970557c5f14c3","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a5aed9501c7dea48c7bdcc613b6d3b3d62f185606c8b0360624970557c5f14c3"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-autores-363e15.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-autores-363e15.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"a5aed9501c7dea48c7bdcc613b6d3b3d62f185606c8b0360624970557c5f14c3\" already exists"}
{"level":"error","ts":"2026-11-02T22:10:56.560Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-02T21:18:49Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:09:49Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:09:49Z"}],"name":"d69b9c128f599c9ea1af84bb3e783ed71688baf6b3ad2b86f2b7183f9a4208b9","namespace":"kuadrant-system","resourceVersion":"104500","uid":"13bee5e7-c8df-4c6f-a232-b3a081875254"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d69b9c128f599c9ea1af84bb3e783ed71688baf6b3ad2b86f2b7183f9a4208b9"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:34:13Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:34:13Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["d69b9c128f599c9ea1af84bb3e783ed71688baf6b3ad2b86f2b7183f9a4208b9"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"d69b9c128f599c9ea1af84bb3e783ed71688baf6b3ad2b86f2b7183f9a4208b9\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:10:56.622Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-02T21:18:39Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:09:49Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:09:51Z"}],"name":"dc061bec60bd28b1c132bf30965b4810124429576337bcc4a6030617600d1714","namespace":"kuadrant-system","resourceVersion":"104615","uid":"5f74c226-33a3-4e04-adc3-a29cc8c718dd"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["dc061bec60bd28b1c132bf30965b4810124429576337bcc4a6030617600d1714"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:09:51Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:09:51Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["dc061bec60bd28b1c132bf30965b4810124429576337bcc4a6030617600d1714"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"dc061bec60bd28b1c132bf30965b4810124429576337bcc4a6030617600d1714\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:10:56.685Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-embedding-simulated-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-embedding-simulated-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-02T21:18:26Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:09:47Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:09:47Z"}],"name":"80056c658070f49140955cb6eabdbd252857a614af6b0f2f2de7a1ab1cd47949","namespace":"kuadrant-system","resourceVersion":"104358","uid":"c5c390bf-e2ba-4432-9294-bc1e1d24c250"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["80056c658070f49140955cb6eabdbd252857a614af6b0f2f2de7a1ab1cd47949"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:19:19Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:19:19Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["80056c658070f49140955cb6eabdbd252857a614af6b0f2f2de7a1ab1cd47949"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"80056c658070f49140955cb6eabdbd252857a614af6b0f2f2de7a1ab1cd47949\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:10:56.750Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-2-simulated-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-2-simulated-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-02T21:18:16Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:09:49Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:09:50Z"}],"name":"67c67ce733de50e7b3d797bb248036b01badfe02e958f5f76af05b58a504989c","namespace":"kuadrant-system","resourceVersion":"104528","uid":"e420c302-9915-4089-bfe2-7a898cce5fa1"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["67c67ce733de50e7b3d797bb248036b01badfe02e958f5f76af05b58a504989c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:18:16Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:18:16Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["67c67ce733de50e7b3d797bb248036b01badfe02e958f5f76af05b58a504989c"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"67c67ce733de50e7b3d797bb248036b01badfe02e958f5f76af05b58a504989c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:10:56.813Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-embedding-simulated-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-embedding-simulated-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-02T21:18:27Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:09:46Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:09:46Z"}],"name":"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e","namespace":"kuadrant-system","resourceVersion":"104274","uid":"5c8c5582-a46f-48f1-bd3c-8ecdbc99ff42"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:19:17Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:19:17Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:10:56.874Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-02T21:18:21Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:09:51Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:09:53Z"}],"name":"d1d232e06f90d479cd9b802f24889e83af58c51cf54ba273d5e24dcb8a297688","namespace":"kuadrant-system","resourceVersion":"104670","uid":"58700c89-42ff-439b-b31f-db7a33d76650"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d1d232e06f90d479cd9b802f24889e83af58c51cf54ba273d5e24dcb8a297688"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:18:21Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:18:21Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["d1d232e06f90d479cd9b802f24889e83af58c51cf54ba273d5e24dcb8a297688"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"d1d232e06f90d479cd9b802f24889e83af58c51cf54ba273d5e24dcb8a297688\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:10:56.940Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-autores-363e15","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-autores-363e15#rule-2"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"4ab093bbd181f524f77e6add42b63b164c6fa1763796bec87d0c8b6ba5d1ee73","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["4ab093bbd181f524f77e6add42b63b164c6fa1763796bec87d0c8b6ba5d1ee73"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-autores-363e15.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-autores-363e15.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"4ab093bbd181f524f77e6add42b63b164c6fa1763796bec87d0c8b6ba5d1ee73\" already exists"}
{"level":"error","ts":"2026-11-02T22:10:57.004Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-02T21:18:31Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:09:49Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:09:54Z"}],"name":"135ffad9bbcd33779a0b9a1c0dc5d5f547356be21489762803640aca855c728a","namespace":"kuadrant-system","resourceVersion":"104711","uid":"c3780164-c9ad-4e6a-b0c2-52b22bced4f7"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["135ffad9bbcd33779a0b9a1c0dc5d5f547356be21489762803640aca855c728a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:09:54Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:09:54Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["135ffad9bbcd33779a0b9a1c0dc5d5f547356be21489762803640aca855c728a"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"135ffad9bbcd33779a0b9a1c0dc5d5f547356be21489762803640aca855c728a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:10:57.066Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-02T21:18:48Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:09:47Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:09:47Z"}],"name":"1e077a716d89a43572a3c16e8d0b0436816baa48a2ea227603701f10cad6d6f4","namespace":"kuadrant-system","resourceVersion":"104360","uid":"13421850-0cba-4578-882d-5e70335a29e6"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["1e077a716d89a43572a3c16e8d0b0436816baa48a2ea227603701f10cad6d6f4"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:09:47Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:09:47Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["1e077a716d89a43572a3c16e8d0b0436816baa48a2ea227603701f10cad6d6f4"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"1e077a716d89a43572a3c16e8d0b0436816baa48a2ea227603701f10cad6d6f4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:10:57.128Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-embedding-simulated-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-embedding-simulated-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-02T21:18:27Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:09:48Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:09:49Z"}],"name":"ad8714d3b8aed2a9ffd68fbcf0288557e9c1c059c1b59ad3e9a09910b37fd61b","namespace":"kuadrant-system","resourceVersion":"104488","uid":"67233c6f-12ee-408b-9d10-e95973c9e911"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["ad8714d3b8aed2a9ffd68fbcf0288557e9c1c059c1b59ad3e9a09910b37fd61b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:18:28Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:18:28Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["ad8714d3b8aed2a9ffd68fbcf0288557e9c1c059c1b59ad3e9a09910b37fd61b"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"ad8714d3b8aed2a9ffd68fbcf0288557e9c1c059c1b59ad3e9a09910b37fd61b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:10:57.192Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-2-simulated-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-2-simulated-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-02T21:18:17Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:09:44Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:09:45Z"}],"name":"74b47f1aa1203aad58596cbaab10ae46e8fddd08ac49eb57a26bdba532d88e72","namespace":"kuadrant-system","resourceVersion":"104190","uid":"9a36249e-7376-46a4-b2d3-242b00d8f143"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["74b47f1aa1203aad58596cbaab10ae46e8fddd08ac49eb57a26bdba532d88e72"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:09:45Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:09:45Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["74b47f1aa1203aad58596cbaab10ae46e8fddd08ac49eb57a26bdba532d88e72"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"74b47f1aa1203aad58596cbaab10ae46e8fddd08ac49eb57a26bdba532d88e72\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:10:57.255Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-02T21:18:31Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:09:47Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:09:47Z"}],"name":"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec","namespace":"kuadrant-system","resourceVersion":"104351","uid":"b970691b-aeab-4ab1-8c26-716a1d192d99"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:09:47Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:09:47Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:10:57.319Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-2-simulated-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-2-simulated-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-02T21:18:16Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:09:51Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:09:53Z"}],"name":"98ec9d74d07c88c1e6923ed1cbafd4c5b41bf1763b3a942282f964f72425ae57","namespace":"kuadrant-system","resourceVersion":"104666","uid":"e4861f95-ed6a-4e9b-a90e-286b8b37cd64"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["98ec9d74d07c88c1e6923ed1cbafd4c5b41bf1763b3a942282f964f72425ae57"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:19:19Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:19:19Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["98ec9d74d07c88c1e6923ed1cbafd4c5b41bf1763b3a942282f964f72425ae57"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"98ec9d74d07c88c1e6923ed1cbafd4c5b41bf1763b3a942282f964f72425ae57\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:10:57.393Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-02T21:18:31Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:09:47Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:09:47Z"}],"name":"2416d7b42d11a09d7152746be0e114f8fdc87d0fbd0efa9dec5b52b011082194","namespace":"kuadrant-system","resourceVersion":"104337","uid":"dca4432d-1e71-4b9a-b327-da52977476c8"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["2416d7b42d11a09d7152746be0e114f8fdc87d0fbd0efa9dec5b52b011082194"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:19:19Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:19:19Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["2416d7b42d11a09d7152746be0e114f8fdc87d0fbd0efa9dec5b52b011082194"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"2416d7b42d11a09d7152746be0e114f8fdc87d0fbd0efa9dec5b52b011082194\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:10:57.462Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-2-simulated-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-2-simulated-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-02T21:18:17Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:09:48Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:09:54Z"}],"name":"9e75e9fd02f51c2f043b145c5d6b82e95f1447b388ee529262aea27a6a2774ef","namespace":"kuadrant-system","resourceVersion":"104747","uid":"b93d340e-64c4-40b2-8396-2392e938aa5f"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["9e75e9fd02f51c2f043b145c5d6b82e95f1447b388ee529262aea27a6a2774ef"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:09:54Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:09:54Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["9e75e9fd02f51c2f043b145c5d6b82e95f1447b388ee529262aea27a6a2774ef"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"9e75e9fd02f51c2f043b145c5d6b82e95f1447b388ee529262aea27a6a2774ef\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:10:57.524Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-02T21:18:21Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:09:48Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:09:49Z"}],"name":"17002b7f0c8e62582ad262d9c2b8b038ee7f2a9327fe34f21fd4f47134b7b8cf","namespace":"kuadrant-system","resourceVersion":"104457","uid":"ca2e1742-8adc-44a1-8d25-bd844ad1bcab"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["17002b7f0c8e62582ad262d9c2b8b038ee7f2a9327fe34f21fd4f47134b7b8cf"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:36:33Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:36:33Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["17002b7f0c8e62582ad262d9c2b8b038ee7f2a9327fe34f21fd4f47134b7b8cf"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"17002b7f0c8e62582ad262d9c2b8b038ee7f2a9327fe34f21fd4f47134b7b8cf\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:10:57.586Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-02T21:18:48Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:09:50Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:09:54Z"}],"name":"75612d85af2bae456dadd78163b2d2f9015c0a0bf4e20bcb8a555e6a5ab3b8c0","namespace":"kuadrant-system","resourceVersion":"104709","uid":"f4654ece-9841-4e26-a8a9-f3ec6fdc7a00"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["75612d85af2bae456dadd78163b2d2f9015c0a0bf4e20bcb8a555e6a5ab3b8c0"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:09:54Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:09:54Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["75612d85af2bae456dadd78163b2d2f9015c0a0bf4e20bcb8a555e6a5ab3b8c0"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"75612d85af2bae456dadd78163b2d2f9015c0a0bf4e20bcb8a555e6a5ab3b8c0\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:10:57.649Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route#rule-6"},"creationTimestamp":"2026-11-02T21:16:03Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:09:45Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:09:45Z"}],"name":"7def4ca304ff3869be64c2c02523fd9d2ff43465099dcd1124399f293eb4480f","namespace":"kuadrant-system","resourceVersion":"104185","uid":"a4896849-289b-4300-9ee8-e13530534d2a"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["7def4ca304ff3869be64c2c02523fd9d2ff43465099dcd1124399f293eb4480f"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:36:28Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:36:28Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["7def4ca304ff3869be64c2c02523fd9d2ff43465099dcd1124399f293eb4480f"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"7def4ca304ff3869be64c2c02523fd9d2ff43465099dcd1124399f293eb4480f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:10:57.711Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-02T21:18:49Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:09:47Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:09:47Z"}],"name":"ab505bdf28287fe00099987c1bde2c2f297c40c792a7f6cb5fbfa5adc44754d3","namespace":"kuadrant-system","resourceVersion":"104313","uid":"08a412f0-c481-428d-b90b-d528efffcf47"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["ab505bdf28287fe00099987c1bde2c2f297c40c792a7f6cb5fbfa5adc44754d3"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:19:18Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:19:18Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["ab505bdf28287fe00099987c1bde2c2f297c40c792a7f6cb5fbfa5adc44754d3"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"ab505bdf28287fe00099987c1bde2c2f297c40c792a7f6cb5fbfa5adc44754d3\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:10:57.773Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-02T21:18:38Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:09:51Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:09:53Z"}],"name":"92917da87eaba4f2684cd45947a3698434b99ff4ca6d3ddde51d6573aecb1600","namespace":"kuadrant-system","resourceVersion":"104696","uid":"f089c98c-5867-4541-b602-9c8b8b3f94b4"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["92917da87eaba4f2684cd45947a3698434b99ff4ca6d3ddde51d6573aecb1600"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:18:39Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:18:39Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["92917da87eaba4f2684cd45947a3698434b99ff4ca6d3ddde51d6573aecb1600"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"92917da87eaba4f2684cd45947a3698434b99ff4ca6d3ddde51d6573aecb1600\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:10:57.837Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-02T21:18:31Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:09:51Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:09:53Z"}],"name":"726a74c13fee356e859d9317271facbb60b066acbc5571de22d056f13c60878f","namespace":"kuadrant-system","resourceVersion":"104692","uid":"d0b642c8-7a95-495a-b0d2-9191c7bbc9eb"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["726a74c13fee356e859d9317271facbb60b066acbc5571de22d056f13c60878f"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:19:18Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:19:18Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["726a74c13fee356e859d9317271facbb60b066acbc5571de22d056f13c60878f"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"726a74c13fee356e859d9317271facbb60b066acbc5571de22d056f13c60878f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:10:57.900Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-02T21:18:48Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:09:50Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:09:52Z"}],"name":"50c2058cf11e07a931b06ac4446a56eee86855f00badf26618abe486a7bdcfd7","namespace":"kuadrant-system","resourceVersion":"104622","uid":"de9d1cc9-14b7-409e-bb3a-aa08103ae0bc"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["50c2058cf11e07a931b06ac4446a56eee86855f00badf26618abe486a7bdcfd7"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:19:18Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:19:18Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["50c2058cf11e07a931b06ac4446a56eee86855f00badf26618abe486a7bdcfd7"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"50c2058cf11e07a931b06ac4446a56eee86855f00badf26618abe486a7bdcfd7\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:10:57.962Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-02T21:18:39Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:09:48Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:09:52Z"}],"name":"c5a685f2a5ebdef5f1dee488990c0798a45ddce399cf99e7d0c505a5f46c69ac","namespace":"kuadrant-system","resourceVersion":"104636","uid":"dfe561d7-5924-4cb8-8b77-3e8dc714e323"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["c5a685f2a5ebdef5f1dee488990c0798a45ddce399cf99e7d0c505a5f46c69ac"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:09:52Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:09:52Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["c5a685f2a5ebdef5f1dee488990c0798a45ddce399cf99e7d0c505a5f46c69ac"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"c5a685f2a5ebdef5f1dee488990c0798a45ddce399cf99e7d0c505a5f46c69ac\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:10:58.023Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-02T21:18:49Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:09:45Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:09:45Z"}],"name":"dd89509e97b96670685602ae2d08749226db8693944d2c6f868af9d3e0a5feb5","namespace":"kuadrant-system","resourceVersion":"104196","uid":"a26fa170-07c3-485e-a718-34a17e58d302"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["dd89509e97b96670685602ae2d08749226db8693944d2c6f868af9d3e0a5feb5"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:34:10Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:34:10Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["dd89509e97b96670685602ae2d08749226db8693944d2c6f868af9d3e0a5feb5"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"dd89509e97b96670685602ae2d08749226db8693944d2c6f868af9d3e0a5feb5\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:10:58.086Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-2-simulated-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-2-simulated-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-02T21:18:17Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:09:46Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:09:46Z"}],"name":"a908063c86927e6bf07b7d793aad9f277ac3c2a8f5f5d468b116cb9e07929b14","namespace":"kuadrant-system","resourceVersion":"104277","uid":"957a9438-ed77-444c-a333-1526b1b744d3"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a908063c86927e6bf07b7d793aad9f277ac3c2a8f5f5d468b116cb9e07929b14"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:19:17Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:19:17Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["a908063c86927e6bf07b7d793aad9f277ac3c2a8f5f5d468b116cb9e07929b14"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a908063c86927e6bf07b7d793aad9f277ac3c2a8f5f5d468b116cb9e07929b14\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:10:58.148Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-02T21:18:49Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:09:50Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:09:54Z"}],"name":"54cd0149b818480305f3d0024b3c95629cafb641b48195d003b2b7006d5c6bcd","namespace":"kuadrant-system","resourceVersion":"104744","uid":"0502152b-1d9d-492f-bb61-0a9806d87310"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["54cd0149b818480305f3d0024b3c95629cafb641b48195d003b2b7006d5c6bcd"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:09:54Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:09:54Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["54cd0149b818480305f3d0024b3c95629cafb641b48195d003b2b7006d5c6bcd"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"54cd0149b818480305f3d0024b3c95629cafb641b48195d003b2b7006d5c6bcd\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:10:58.210Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-02T21:18:38Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:09:48Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:09:49Z"}],"name":"486615827938fa99814e929fe7dc62bc16f7563179fef855074eb73dc7ce4724","namespace":"kuadrant-system","resourceVersion":"104479","uid":"214125ca-42ba-4094-b605-6ce561e537ca"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["486615827938fa99814e929fe7dc62bc16f7563179fef855074eb73dc7ce4724"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:36:31Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:36:31Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["486615827938fa99814e929fe7dc62bc16f7563179fef855074eb73dc7ce4724"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"486615827938fa99814e929fe7dc62bc16f7563179fef855074eb73dc7ce4724\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:10:58.272Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-embedding-simulated-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-embedding-simulated-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-02T21:18:27Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:09:52Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:09:54Z"}],"name":"eaeb360b41b3f9e0bd6b247d4dae3eef1ffc3355d6e9408df3f8f71bc7f033b5","namespace":"kuadrant-system","resourceVersion":"104712","uid":"81b7d841-b540-4e73-8c65-7c4e6612cbf9"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["eaeb360b41b3f9e0bd6b247d4dae3eef1ffc3355d6e9408df3f8f71bc7f033b5"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:18:27Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:18:27Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["eaeb360b41b3f9e0bd6b247d4dae3eef1ffc3355d6e9408df3f8f71bc7f033b5"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"eaeb360b41b3f9e0bd6b247d4dae3eef1ffc3355d6e9408df3f8f71bc7f033b5\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:10:58.334Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-02T21:18:38Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:09:50Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:09:51Z"}],"name":"e5f81c7f7812462ebef000c68dc043013159f22201d2eeecf05c220e809f96ed","namespace":"kuadrant-system","resourceVersion":"104611","uid":"817bb8d6-da9d-4dd2-bd9e-34b731410642"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["e5f81c7f7812462ebef000c68dc043013159f22201d2eeecf05c220e809f96ed"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:18:39Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:18:39Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["e5f81c7f7812462ebef000c68dc043013159f22201d2eeecf05c220e809f96ed"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"e5f81c7f7812462ebef000c68dc043013159f22201d2eeecf05c220e809f96ed\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:10:58.395Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-02T21:18:21Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:09:45Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:09:46Z"}],"name":"cad6ab5a81a65fd4cb03a0fefdab5de82aa18c30a5b95078b1d05214b0606f40","namespace":"kuadrant-system","resourceVersion":"104252","uid":"ad7a5c7a-3f09-47be-8d53-f79bcd3bfd41"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["cad6ab5a81a65fd4cb03a0fefdab5de82aa18c30a5b95078b1d05214b0606f40"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:09:46Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:09:46Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["cad6ab5a81a65fd4cb03a0fefdab5de82aa18c30a5b95078b1d05214b0606f40"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"cad6ab5a81a65fd4cb03a0fefdab5de82aa18c30a5b95078b1d05214b0606f40\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:10:58.458Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-embedding-simulated-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-embedding-simulated-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-02T21:18:27Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:09:52Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:09:53Z"}],"name":"bfd36c5ed73eb81df97258ffa1aa36d8cbf6f3e7a8096c33ca4ff417be59d002","namespace":"kuadrant-system","resourceVersion":"104703","uid":"33d0d859-f2a7-4b2b-a6fb-da332a727697"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["bfd36c5ed73eb81df97258ffa1aa36d8cbf6f3e7a8096c33ca4ff417be59d002"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:18:27Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:18:27Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["bfd36c5ed73eb81df97258ffa1aa36d8cbf6f3e7a8096c33ca4ff417be59d002"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"bfd36c5ed73eb81df97258ffa1aa36d8cbf6f3e7a8096c33ca4ff417be59d002\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:10:58.520Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-02T21:18:21Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:09:47Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:09:47Z"}],"name":"bf65ad13397c94660867eb0205e06d1c9bebda4b019f632c0d0b8ef989930381","namespace":"kuadrant-system","resourceVersion":"104370","uid":"93912093-eaa2-4499-99a2-d89aa4b8d80d"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["bf65ad13397c94660867eb0205e06d1c9bebda4b019f632c0d0b8ef989930381"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:18:21Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:18:21Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["bf65ad13397c94660867eb0205e06d1c9bebda4b019f632c0d0b8ef989930381"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"bf65ad13397c94660867eb0205e06d1c9bebda4b019f632c0d0b8ef989930381\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:10:58.583Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-02T21:18:39Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:09:46Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:09:47Z"}],"name":"319e246831bdaf5e765e63d5511b516594fd2b64527850e2ddabd2a4a85532ea","namespace":"kuadrant-system","resourceVersion":"104302","uid":"f1da8ca3-152e-476b-a1bb-96a91bcea0e3"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["319e246831bdaf5e765e63d5511b516594fd2b64527850e2ddabd2a4a85532ea"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:18:40Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:18:40Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["319e246831bdaf5e765e63d5511b516594fd2b64527850e2ddabd2a4a85532ea"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"319e246831bdaf5e765e63d5511b516594fd2b64527850e2ddabd2a4a85532ea\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:10:58.645Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-02T21:18:48Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:09:47Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:09:47Z"}],"name":"06165835c4461c0b16a2bc5bae936aff3c2f351edbef8aa378f1110874acedfc","namespace":"kuadrant-system","resourceVersion":"104348","uid":"af7b4f34-b762-421c-8955-bf4dad876336"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["06165835c4461c0b16a2bc5bae936aff3c2f351edbef8aa378f1110874acedfc"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:19:19Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:19:19Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["06165835c4461c0b16a2bc5bae936aff3c2f351edbef8aa378f1110874acedfc"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"06165835c4461c0b16a2bc5bae936aff3c2f351edbef8aa378f1110874acedfc\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:10:58.707Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-02T21:18:21Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:09:51Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:09:52Z"}],"name":"028a8b5bd5d4e690eebb2f20c5fd47cf0b3c6e2a3619ba9e55322bbca7b94cc3","namespace":"kuadrant-system","resourceVersion":"104634","uid":"9dc62010-cc65-401d-a4ad-ffc9902aab1a"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["028a8b5bd5d4e690eebb2f20c5fd47cf0b3c6e2a3619ba9e55322bbca7b94cc3"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:18:21Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:18:21Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["028a8b5bd5d4e690eebb2f20c5fd47cf0b3c6e2a3619ba9e55322bbca7b94cc3"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"028a8b5bd5d4e690eebb2f20c5fd47cf0b3c6e2a3619ba9e55322bbca7b94cc3\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:10:58.768Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-2-simulated-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-2-simulated-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-02T21:18:17Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:09:46Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:09:46Z"}],"name":"010adf02b2e7deb40c572f4729b6dd4619847c8e6344137326b72df28772fc1a","namespace":"kuadrant-system","resourceVersion":"104271","uid":"d59bd379-de22-4260-a63f-ca258b3bd69f"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["010adf02b2e7deb40c572f4729b6dd4619847c8e6344137326b72df28772fc1a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:09:46Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:09:46Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["010adf02b2e7deb40c572f4729b6dd4619847c8e6344137326b72df28772fc1a"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"010adf02b2e7deb40c572f4729b6dd4619847c8e6344137326b72df28772fc1a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:10:58.832Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-embedding-simulated-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-embedding-simulated-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-02T21:18:26Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:09:48Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:09:48Z"}],"name":"105cf4dd91a8abf4a93abd65b255521c3d37b560b5d23f3ec59757b5b362fae6","namespace":"kuadrant-system","resourceVersion":"104436","uid":"e721320b-b0dd-48bb-9d6b-9a3cf2c2dc7a"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["105cf4dd91a8abf4a93abd65b255521c3d37b560b5d23f3ec59757b5b362fae6"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:19:19Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:19:19Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["105cf4dd91a8abf4a93abd65b255521c3d37b560b5d23f3ec59757b5b362fae6"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"105cf4dd91a8abf4a93abd65b255521c3d37b560b5d23f3ec59757b5b362fae6\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:10:58.893Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-02T21:18:49Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:09:50Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:09:52Z"}],"name":"f6df6bc14432fdc346191db86ee06e75c8090ed87a32c984493c837e97a10be6","namespace":"kuadrant-system","resourceVersion":"104665","uid":"d71ee8ab-248f-46ed-a17b-96ad3cd4cee8"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f6df6bc14432fdc346191db86ee06e75c8090ed87a32c984493c837e97a10be6"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:09:52Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:09:52Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["f6df6bc14432fdc346191db86ee06e75c8090ed87a32c984493c837e97a10be6"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"f6df6bc14432fdc346191db86ee06e75c8090ed87a32c984493c837e97a10be6\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:10:58.955Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-02T21:18:48Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:09:48Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:09:49Z"}],"name":"8d8c8aae1332bb0300ac2d65be9b8708fbfde6d4b5599ec52380cf1f70956045","namespace":"kuadrant-system","resourceVersion":"104493","uid":"0c073bfe-3acf-43c3-938f-7f8117dea42f"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["8d8c8aae1332bb0300ac2d65be9b8708fbfde6d4b5599ec52380cf1f70956045"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:18:49Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:18:49Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["8d8c8aae1332bb0300ac2d65be9b8708fbfde6d4b5599ec52380cf1f70956045"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"8d8c8aae1332bb0300ac2d65be9b8708fbfde6d4b5599ec52380cf1f70956045\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:10:59.016Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-02T21:18:49Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:09:49Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:09:50Z"}],"name":"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0","namespace":"kuadrant-system","resourceVersion":"104561","uid":"8c9443c9-f182-4677-85bf-323ad47fe3c9"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:09:50Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:09:50Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:10:59.078Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-02T21:18:38Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:09:51Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:09:55Z"}],"name":"0913a452a02695c6681f1037232199b40b64236fed4d29cdbb41561695826340","namespace":"kuadrant-system","resourceVersion":"104750","uid":"233e732a-3129-4d24-a654-aa4a94b616ec"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["0913a452a02695c6681f1037232199b40b64236fed4d29cdbb41561695826340"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:09:55Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:09:55Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["0913a452a02695c6681f1037232199b40b64236fed4d29cdbb41561695826340"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"0913a452a02695c6681f1037232199b40b64236fed4d29cdbb41561695826340\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:10:59.144Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-autores-363e15","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-autores-363e15#rule-6"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"e972c675546ea6af7d81cc5a73f2cdd49a66549d6da470ffb2560f70e0f57e7b","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["e972c675546ea6af7d81cc5a73f2cdd49a66549d6da470ffb2560f70e0f57e7b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-autores-363e15.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-autores-363e15.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"e972c675546ea6af7d81cc5a73f2cdd49a66549d6da470ffb2560f70e0f57e7b\" already exists"}
{"level":"error","ts":"2026-11-02T22:10:59.206Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-2-simulated-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-2-simulated-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-02T21:18:17Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:09:49Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:09:53Z"}],"name":"fac07f302f653115fda3d376325a268abaf66025ed0e4af73e88bea3f41fe933","namespace":"kuadrant-system","resourceVersion":"104681","uid":"fb8da4ca-ef70-459f-9cee-d8db6b6c7404"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["fac07f302f653115fda3d376325a268abaf66025ed0e4af73e88bea3f41fe933"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:09:53Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:09:53Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["fac07f302f653115fda3d376325a268abaf66025ed0e4af73e88bea3f41fe933"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"fac07f302f653115fda3d376325a268abaf66025ed0e4af73e88bea3f41fe933\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:10:59.267Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-02T21:18:31Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:09:48Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:09:48Z"}],"name":"4f800155f293f82eeaf5fd6a9553c0a1bee90f47a295bba8d7a04b3f11faea33","namespace":"kuadrant-system","resourceVersion":"104434","uid":"2c4af3f9-f598-4a6c-a301-b71e2082acaa"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["4f800155f293f82eeaf5fd6a9553c0a1bee90f47a295bba8d7a04b3f11faea33"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:09:48Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:09:48Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["4f800155f293f82eeaf5fd6a9553c0a1bee90f47a295bba8d7a04b3f11faea33"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"4f800155f293f82eeaf5fd6a9553c0a1bee90f47a295bba8d7a04b3f11faea33\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:10:59.329Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-02T21:18:39Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:09:45Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:09:45Z"}],"name":"8d34bd12ba2030284fcb69127f53b8158bbdd4a1432bfe619165b4c2c96cc061","namespace":"kuadrant-system","resourceVersion":"104199","uid":"972c5e7d-6947-4552-85a1-5a6c0ed21173"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["8d34bd12ba2030284fcb69127f53b8158bbdd4a1432bfe619165b4c2c96cc061"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:19:18Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:19:18Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["8d34bd12ba2030284fcb69127f53b8158bbdd4a1432bfe619165b4c2c96cc061"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"8d34bd12ba2030284fcb69127f53b8158bbdd4a1432bfe619165b4c2c96cc061\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:10:59.391Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-02T21:18:21Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:09:50Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:09:52Z"}],"name":"8d5571efc1d304f5bcfc2ffb4ac6819154ba5556c29ce33416d460b887427984","namespace":"kuadrant-system","resourceVersion":"104624","uid":"3149db6f-9137-40bb-ac0a-71328c3f9cee"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["8d5571efc1d304f5bcfc2ffb4ac6819154ba5556c29ce33416d460b887427984"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:18:22Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:18:22Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["8d5571efc1d304f5bcfc2ffb4ac6819154ba5556c29ce33416d460b887427984"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"8d5571efc1d304f5bcfc2ffb4ac6819154ba5556c29ce33416d460b887427984\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:10:59.452Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-embedding-simulated-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-embedding-simulated-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-02T21:18:26Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:09:48Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:09:48Z"}],"name":"f9fa9cfc2b4e701183573419a92c79384cd30210289602f0115c75c5029d55aa","namespace":"kuadrant-system","resourceVersion":"104410","uid":"34368a78-ce64-4c38-a3d7-caaf25e6b83b"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f9fa9cfc2b4e701183573419a92c79384cd30210289602f0115c75c5029d55aa"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:18:27Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:18:27Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["f9fa9cfc2b4e701183573419a92c79384cd30210289602f0115c75c5029d55aa"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"f9fa9cfc2b4e701183573419a92c79384cd30210289602f0115c75c5029d55aa\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:10:59.514Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-02T21:18:38Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:09:45Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:09:45Z"}],"name":"5e4821ff903ad6ca2e1c42162432e34d8b0a2a78052961e753d36b742193432f","namespace":"kuadrant-system","resourceVersion":"104203","uid":"da957b52-9188-4192-a0f2-de72febcdd38"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["5e4821ff903ad6ca2e1c42162432e34d8b0a2a78052961e753d36b742193432f"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:19:19Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:19:19Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["5e4821ff903ad6ca2e1c42162432e34d8b0a2a78052961e753d36b742193432f"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"5e4821ff903ad6ca2e1c42162432e34d8b0a2a78052961e753d36b742193432f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:10:59.575Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route#rule-3"},"creationTimestamp":"2026-11-02T21:16:03Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:09:48Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:09:49Z"}],"name":"06b05a8e4dd69bdc4f333ad9509ee8cad3c5c0f5dd48edbe94c1158b60f79ed3","namespace":"kuadrant-system","resourceVersion":"104471","uid":"0a3fd9fd-cbf8-4e06-8178-b81d7348efd7"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["06b05a8e4dd69bdc4f333ad9509ee8cad3c5c0f5dd48edbe94c1158b60f79ed3"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:16:16Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:16:16Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["06b05a8e4dd69bdc4f333ad9509ee8cad3c5c0f5dd48edbe94c1158b60f79ed3"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"06b05a8e4dd69bdc4f333ad9509ee8cad3c5c0f5dd48edbe94c1158b60f79ed3\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:10:59.638Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-2-simulated-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-2-simulated-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-02T21:18:16Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:09:50Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:09:51Z"}],"name":"a91faccafad197e2a4065ce3d12a052ac484d2e8fb2fc9265ee48f02b28e6dce","namespace":"kuadrant-system","resourceVersion":"104613","uid":"4cc5ed8f-00de-4c7e-be3a-12c0a62618f8"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a91faccafad197e2a4065ce3d12a052ac484d2e8fb2fc9265ee48f02b28e6dce"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:36:27Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:36:27Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["a91faccafad197e2a4065ce3d12a052ac484d2e8fb2fc9265ee48f02b28e6dce"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a91faccafad197e2a4065ce3d12a052ac484d2e8fb2fc9265ee48f02b28e6dce\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:10:59.699Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-02T21:18:31Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:09:46Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:09:46Z"}],"name":"23672b974f0dbc05100a34c78d2b029e41f1d5a3752f3fcb52915f56db360e25","namespace":"kuadrant-system","resourceVersion":"104279","uid":"8464ab4b-fcc7-4b42-8fc7-5c7330242a1c"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["23672b974f0dbc05100a34c78d2b029e41f1d5a3752f3fcb52915f56db360e25"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:18:31Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:18:31Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["23672b974f0dbc05100a34c78d2b029e41f1d5a3752f3fcb52915f56db360e25"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"23672b974f0dbc05100a34c78d2b029e41f1d5a3752f3fcb52915f56db360e25\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:10:59.761Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-embedding-simulated-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-embedding-simulated-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-02T21:18:27Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:09:50Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:09:53Z"}],"name":"0020c64019ffd1a0bdcc75e6441e6a30e6d8bb08f463f67bd2408a1e82b95b2a","namespace":"kuadrant-system","resourceVersion":"104706","uid":"9c300a5f-b9bf-4a8d-9e83-93143f3748ed"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["0020c64019ffd1a0bdcc75e6441e6a30e6d8bb08f463f67bd2408a1e82b95b2a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:09:53Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:09:53Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["0020c64019ffd1a0bdcc75e6441e6a30e6d8bb08f463f67bd2408a1e82b95b2a"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"0020c64019ffd1a0bdcc75e6441e6a30e6d8bb08f463f67bd2408a1e82b95b2a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:10:59.823Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-02T21:18:21Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:09:47Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:09:49Z"}],"name":"4d18a96899c43d55ee63d2ae1a7a938c7e873d88b2fd95f06b2e3aae2c7f1c84","namespace":"kuadrant-system","resourceVersion":"104447","uid":"14a6542f-adae-4641-b133-a36e1c22c289"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["4d18a96899c43d55ee63d2ae1a7a938c7e873d88b2fd95f06b2e3aae2c7f1c84"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:09:49Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:09:49Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["4d18a96899c43d55ee63d2ae1a7a938c7e873d88b2fd95f06b2e3aae2c7f1c84"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"4d18a96899c43d55ee63d2ae1a7a938c7e873d88b2fd95f06b2e3aae2c7f1c84\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:10:59.885Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-02T21:18:49Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:09:45Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:09:45Z"}],"name":"f95805f0e9b755664735d898c1d644d571943be553204d3f86136bc35719ff13","namespace":"kuadrant-system","resourceVersion":"104193","uid":"25d13ab5-6706-4293-baf5-d681d17b9688"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f95805f0e9b755664735d898c1d644d571943be553204d3f86136bc35719ff13"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:34:13Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:34:13Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["f95805f0e9b755664735d898c1d644d571943be553204d3f86136bc35719ff13"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"f95805f0e9b755664735d898c1d644d571943be553204d3f86136bc35719ff13\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:10:59.950Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-embedding-simulated-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-embedding-simulated-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-02T21:18:26Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:09:51Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:09:54Z"}],"name":"2d4a2275e6cbab5c26d5c3cf2d75aa2776066390e5b66f5498b16b26bc596af7","namespace":"kuadrant-system","resourceVersion":"104725","uid":"c3ac65e6-4145-4da0-b26f-278381d5074b"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["2d4a2275e6cbab5c26d5c3cf2d75aa2776066390e5b66f5498b16b26bc596af7"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:09:54Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:09:54Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["2d4a2275e6cbab5c26d5c3cf2d75aa2776066390e5b66f5498b16b26bc596af7"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"2d4a2275e6cbab5c26d5c3cf2d75aa2776066390e5b66f5498b16b26bc596af7\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:11:00.011Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-02T21:18:38Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:09:48Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:09:48Z"}],"name":"6565c4085b3917d5390fe1b0194fb3d8319f1d56b45867e3c68ff740b5c16ef3","namespace":"kuadrant-system","resourceVersion":"104430","uid":"f82393c1-5f1c-4802-b1a2-9277da9f1c19"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["6565c4085b3917d5390fe1b0194fb3d8319f1d56b45867e3c68ff740b5c16ef3"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:18:38Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:18:38Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["6565c4085b3917d5390fe1b0194fb3d8319f1d56b45867e3c68ff740b5c16ef3"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"6565c4085b3917d5390fe1b0194fb3d8319f1d56b45867e3c68ff740b5c16ef3\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:11:00.073Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-02T21:18:48Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:09:47Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:09:47Z"}],"name":"aa7038625b8f43b0c002f79637065e5ab90468f50f998759d08f2c4640c07c04","namespace":"kuadrant-system","resourceVersion":"104379","uid":"bbed2434-8880-494c-80c3-f3902b031a86"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["aa7038625b8f43b0c002f79637065e5ab90468f50f998759d08f2c4640c07c04"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:18:48Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:18:48Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["aa7038625b8f43b0c002f79637065e5ab90468f50f998759d08f2c4640c07c04"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"aa7038625b8f43b0c002f79637065e5ab90468f50f998759d08f2c4640c07c04\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:11:00.136Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-2-simulated-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-2-simulated-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-02T21:18:17Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:09:50Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:09:51Z"}],"name":"a402d1681ab35bace735c19b1d084a86eb3d741d4e1c14371cfdaa55d22c3ebe","namespace":"kuadrant-system","resourceVersion":"104602","uid":"52b71f16-5b7b-4195-a89e-cd6a461067dc"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a402d1681ab35bace735c19b1d084a86eb3d741d4e1c14371cfdaa55d22c3ebe"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:36:28Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:36:28Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["a402d1681ab35bace735c19b1d084a86eb3d741d4e1c14371cfdaa55d22c3ebe"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a402d1681ab35bace735c19b1d084a86eb3d741d4e1c14371cfdaa55d22c3ebe\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:11:00.197Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-02T21:18:48Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:09:51Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:09:52Z"}],"name":"3083301b5359be118f04faaefcd72fd127f2297a3374ef7231b59a59a31b405c","namespace":"kuadrant-system","resourceVersion":"104659","uid":"5afbfc99-d75d-4a37-b31c-c7756d5bc7ac"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["3083301b5359be118f04faaefcd72fd127f2297a3374ef7231b59a59a31b405c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:19:19Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:19:19Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["3083301b5359be118f04faaefcd72fd127f2297a3374ef7231b59a59a31b405c"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"3083301b5359be118f04faaefcd72fd127f2297a3374ef7231b59a59a31b405c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:11:00.259Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-embedding-simulated-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-embedding-simulated-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-02T21:18:27Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:09:45Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:09:45Z"}],"name":"5d590119308c6f848b12dd3ecdfb1b06cc2fe172af702455c342075944a045ff","namespace":"kuadrant-system","resourceVersion":"104207","uid":"7dfcd152-bda8-4fc5-bf20-c55f443cef33"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["5d590119308c6f848b12dd3ecdfb1b06cc2fe172af702455c342075944a045ff"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:36:35Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:36:35Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["5d590119308c6f848b12dd3ecdfb1b06cc2fe172af702455c342075944a045ff"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"5d590119308c6f848b12dd3ecdfb1b06cc2fe172af702455c342075944a045ff\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:11:00.325Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-autores-363e15","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-autores-363e15#rule-4"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"d16a81ba9f403bee59919e44768171dccc31ac7576e0a1c39bd1c0d01193241d","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d16a81ba9f403bee59919e44768171dccc31ac7576e0a1c39bd1c0d01193241d"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-autores-363e15.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-autores-363e15.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"d16a81ba9f403bee59919e44768171dccc31ac7576e0a1c39bd1c0d01193241d\" already exists"}
{"level":"error","ts":"2026-11-02T22:11:00.386Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route#rule-1"},"creationTimestamp":"2026-11-02T21:16:03Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:09:46Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:09:46Z"}],"name":"a7740f6e77d024a437502c023fb1d8939cb3cc2b9ed7f4073af7d779e19459eb","namespace":"kuadrant-system","resourceVersion":"104286","uid":"b27e2780-f07b-43fa-84a9-edcc72049032"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a7740f6e77d024a437502c023fb1d8939cb3cc2b9ed7f4073af7d779e19459eb"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:36:27Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:36:27Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["a7740f6e77d024a437502c023fb1d8939cb3cc2b9ed7f4073af7d779e19459eb"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a7740f6e77d024a437502c023fb1d8939cb3cc2b9ed7f4073af7d779e19459eb\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:11:00.449Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-02T21:18:48Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:09:47Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:09:48Z"}],"name":"e91aceffc2d4f6d6b120625bd3ca23781b74a1cae6cf1da26bda310bbed0ef07","namespace":"kuadrant-system","resourceVersion":"104432","uid":"65d58591-7795-4c35-af85-1b2c814c21e7"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["e91aceffc2d4f6d6b120625bd3ca23781b74a1cae6cf1da26bda310bbed0ef07"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:09:48Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:09:48Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["e91aceffc2d4f6d6b120625bd3ca23781b74a1cae6cf1da26bda310bbed0ef07"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"e91aceffc2d4f6d6b120625bd3ca23781b74a1cae6cf1da26bda310bbed0ef07\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:11:00.511Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-02T21:18:31Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:09:49Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:09:53Z"}],"name":"c82a1a3dc2ce54c0b664f79a2cd895a3c40f774b3694999badae8cedd328292e","namespace":"kuadrant-system","resourceVersion":"104671","uid":"c7a1b1d3-cccd-4fb1-8b6f-709e5202e78a"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["c82a1a3dc2ce54c0b664f79a2cd895a3c40f774b3694999badae8cedd328292e"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:09:53Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:09:53Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["c82a1a3dc2ce54c0b664f79a2cd895a3c40f774b3694999badae8cedd328292e"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"c82a1a3dc2ce54c0b664f79a2cd895a3c40f774b3694999badae8cedd328292e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:11:00.573Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-02T21:18:40Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:09:45Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:09:45Z"}],"name":"3f23315aacd6e16f4ab41f96aeedc9549d1abdfc9476577a47d45d12875dec5a","namespace":"kuadrant-system","resourceVersion":"104206","uid":"f5e32c57-1a0d-435d-92aa-0ee98e8baeba"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["3f23315aacd6e16f4ab41f96aeedc9549d1abdfc9476577a47d45d12875dec5a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:18:40Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:18:40Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["3f23315aacd6e16f4ab41f96aeedc9549d1abdfc9476577a47d45d12875dec5a"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"3f23315aacd6e16f4ab41f96aeedc9549d1abdfc9476577a47d45d12875dec5a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:11:00.635Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-02T21:18:39Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:09:49Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:09:53Z"}],"name":"0829dbf2b5dc0900de272826295adf351de381b46fa6fba00b896213530780f6","namespace":"kuadrant-system","resourceVersion":"104688","uid":"0b814b73-0e6c-457e-b018-77f53c7fc590"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["0829dbf2b5dc0900de272826295adf351de381b46fa6fba00b896213530780f6"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:09:53Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:09:53Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["0829dbf2b5dc0900de272826295adf351de381b46fa6fba00b896213530780f6"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"0829dbf2b5dc0900de272826295adf351de381b46fa6fba00b896213530780f6\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:11:00.697Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-02T21:18:40Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:09:52Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:09:53Z"}],"name":"d752a44ad8df3a50b5a1147110eb89039ed764e1fed197b1f77e0935c424a90b","namespace":"kuadrant-system","resourceVersion":"104704","uid":"ae9a13fe-d5e8-4fc6-b4ac-3d2d16f6c78b"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d752a44ad8df3a50b5a1147110eb89039ed764e1fed197b1f77e0935c424a90b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:36:31Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:36:31Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["d752a44ad8df3a50b5a1147110eb89039ed764e1fed197b1f77e0935c424a90b"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"d752a44ad8df3a50b5a1147110eb89039ed764e1fed197b1f77e0935c424a90b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:11:00.758Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-embedding-simulated-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-embedding-simulated-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-02T21:18:27Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:09:52Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:09:55Z"}],"name":"a9800464506c58f005016df354e160757732171ff4d19747202524955329b998","namespace":"kuadrant-system","resourceVersion":"104768","uid":"f6f9e98f-7883-4e00-aa33-65bc8f401c6b"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a9800464506c58f005016df354e160757732171ff4d19747202524955329b998"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:09:55Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:09:55Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["a9800464506c58f005016df354e160757732171ff4d19747202524955329b998"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a9800464506c58f005016df354e160757732171ff4d19747202524955329b998\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:11:00.820Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-02T21:18:38Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:09:45Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:09:45Z"}],"name":"3167d3bf853032a93e8569019dcd3e5aa33af9cb580cf9ca138990567fc9d857","namespace":"kuadrant-system","resourceVersion":"104188","uid":"de8437b4-29c6-42d1-bbfa-ad2e23016891"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["3167d3bf853032a93e8569019dcd3e5aa33af9cb580cf9ca138990567fc9d857"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:18:39Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:18:39Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["3167d3bf853032a93e8569019dcd3e5aa33af9cb580cf9ca138990567fc9d857"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"3167d3bf853032a93e8569019dcd3e5aa33af9cb580cf9ca138990567fc9d857\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:11:00.882Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-2-simulated-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-2-simulated-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-02T21:18:16Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:09:49Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:09:52Z"}],"name":"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96","namespace":"kuadrant-system","resourceVersion":"104653","uid":"3bd7e588-b2c0-4f88-ad6c-92c4a4f5a345"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:09:52Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:09:52Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:11:00.944Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-02T21:18:39Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:09:46Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:09:46Z"}],"name":"94ddc5e77f082c32bebc7a36bcebf621518ebf303e83b9c540da1352d04e620b","namespace":"kuadrant-system","resourceVersion":"104283","uid":"a58039fc-701c-47fe-b574-32560eabeba1"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["94ddc5e77f082c32bebc7a36bcebf621518ebf303e83b9c540da1352d04e620b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:18:39Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:18:39Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["94ddc5e77f082c32bebc7a36bcebf621518ebf303e83b9c540da1352d04e620b"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"94ddc5e77f082c32bebc7a36bcebf621518ebf303e83b9c540da1352d04e620b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:11:01.007Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-02T21:18:21Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:09:48Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:09:49Z"}],"name":"c4399a95e89654e5b2bb5fabe45bc947d11ccd1448ebf64c30b195b34f239d58","namespace":"kuadrant-system","resourceVersion":"104443","uid":"00dd952d-c2f0-4d46-ae0d-3a90b1246f0f"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["c4399a95e89654e5b2bb5fabe45bc947d11ccd1448ebf64c30b195b34f239d58"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:36:29Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:36:29Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["c4399a95e89654e5b2bb5fabe45bc947d11ccd1448ebf64c30b195b34f239d58"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"c4399a95e89654e5b2bb5fabe45bc947d11ccd1448ebf64c30b195b34f239d58\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:11:01.070Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-02T21:18:21Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:09:52Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:09:54Z"}],"name":"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668","namespace":"kuadrant-system","resourceVersion":"104719","uid":"1ea3e25e-e6b5-4d08-a5f2-d4913a2e97a5"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:19:19Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:19:19Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:11:01.132Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-02T21:18:49Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:09:46Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:09:46Z"}],"name":"de97dd5d45c6eb12b4a1112ed1f362d8544427428d2249a399e26ba069d6aadb","namespace":"kuadrant-system","resourceVersion":"104266","uid":"947a2dde-5efe-4b41-a559-c49149ecb7ff"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["de97dd5d45c6eb12b4a1112ed1f362d8544427428d2249a399e26ba069d6aadb"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:18:49Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:18:49Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["de97dd5d45c6eb12b4a1112ed1f362d8544427428d2249a399e26ba069d6aadb"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"de97dd5d45c6eb12b4a1112ed1f362d8544427428d2249a399e26ba069d6aadb\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:11:01.194Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-02T21:18:48Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:09:47Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:09:47Z"}],"name":"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c","namespace":"kuadrant-system","resourceVersion":"104340","uid":"bc14a61f-9404-4823-8949-3cba93b62894"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:19:18Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:19:18Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:11:01.256Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-02T21:18:48Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:09:45Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:09:45Z"}],"name":"134a7a790ba665547ca14f80f917549f66ee5063fc41096471c0778399db6dd5","namespace":"kuadrant-system","resourceVersion":"104214","uid":"1b27e6b9-ccc6-4e12-8a61-c671706271cd"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["134a7a790ba665547ca14f80f917549f66ee5063fc41096471c0778399db6dd5"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:09:45Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:09:45Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["134a7a790ba665547ca14f80f917549f66ee5063fc41096471c0778399db6dd5"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"134a7a790ba665547ca14f80f917549f66ee5063fc41096471c0778399db6dd5\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:11:01.317Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route#rule-4"},"creationTimestamp":"2026-11-02T21:16:03Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:09:50Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:09:53Z"}],"name":"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e","namespace":"kuadrant-system","resourceVersion":"104669","uid":"92701ca2-3dfa-402d-8b2c-3e09ecb2ea11"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:09:53Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:09:53Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:11:01.380Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route#rule-2"},"creationTimestamp":"2026-11-02T21:16:03Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-grid-geo-fencing":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:09:52Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:09:54Z"}],"name":"5c6918972d1a7f8ad5201880b7d6d9c1191ca1f25376682f691def7868e3fd02","namespace":"kuadrant-system","resourceVersion":"104745","uid":"11d8aa0d-8ddd-4892-858b-e95eb780085e"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["5c6918972d1a7f8ad5201880b7d6d9c1191ca1f25376682f691def7868e3fd02"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:16:17Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:16:17Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["5c6918972d1a7f8ad5201880b7d6d9c1191ca1f25376682f691def7868e3fd02"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":16,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"5c6918972d1a7f8ad5201880b7d6d9c1191ca1f25376682f691def7868e3fd02\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:11:01.437Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/a12661827944e5b5c5f1b64dcba0978722d7b341f8bcfbc6f9f0f852b9b7d0e5","error":"authconfigs.authorino.kuadrant.io \"a12661827944e5b5c5f1b64dcba0978722d7b341f8bcfbc6f9f0f852b9b7d0e5\" not found"}
{"level":"error","ts":"2026-11-02T22:11:01.491Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/efeb046ada75fcf5a7e2e594b97e3d4f03750ab0dd40d91638aa049521ee25d4","error":"authconfigs.authorino.kuadrant.io \"efeb046ada75fcf5a7e2e594b97e3d4f03750ab0dd40d91638aa049521ee25d4\" not found"}
{"level":"error","ts":"2026-11-02T22:11:01.546Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/a779843715a86eec00c4c4159fd43b112ad699c1c2670ee8a3441feae551dcb5","error":"authconfigs.authorino.kuadrant.io \"a779843715a86eec00c4c4159fd43b112ad699c1c2670ee8a3441feae551dcb5\" not found"}
{"level":"error","ts":"2026-11-02T22:11:01.601Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/620730b8ac7bac038dbd24a2bcf0f58de08b021c3734753d67952c04e06ec598","error":"authconfigs.authorino.kuadrant.io \"620730b8ac7bac038dbd24a2bcf0f58de08b021c3734753d67952c04e06ec598\" not found"}
{"level":"error","ts":"2026-11-02T22:11:01.778Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-autores-363e15","namespace":"openshift-ingress","uid":"2b016150-2fbf-46fd-8dd8-fcc820678b52","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-autores-363e15\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:11:01.941Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-autores-363e15-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-autores-363e15-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:11:02.769Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"maas-gateway-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"maas-gateway-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:11:03.503Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T22:11:03.503Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T22:11:03.823Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-autores-363e15","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-autores-363e15\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:11:03.981Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"maas-api-route-e2e-autores-363e15","namespace":"odh-ai-gateway-infra","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"maas-api-route-e2e-autores-363e15\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:11:04.188Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"maas-default-gateway","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"maas-default-gateway\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:11:11Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-extmod-a-8702a9","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-a-8702a9","reconcileID":"50fb8c5b-5c45-4b6d-9695-f081d174b545","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-extmod-a-8702a9","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T22:11:11Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-a-8702a9","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T22:11:11Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T22:11:11Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-11-02T22:11:11Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T22:11:11Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-11-02T22:11:11Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-extmod-a-8702a9","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-a-8702a9","reconcileID":"50fb8c5b-5c45-4b6d-9695-f081d174b545","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-extmod-a-8702a9","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T22:11:11Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-a-8702a9","event":"DELETE"}
{"level":"info","ts":"2026-11-02T22:11:11Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-02T22:11:11Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-extmod-a-8702a9\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-02T22:11:11Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T22:11:15.245Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","AuthConfig","Gateway","EnvoyFilter","AuthPolicy","HTTPRoute","TokenRateLimitPolicy","Limitador"],"eventTypes":{"create":10,"delete":4,"update":111}}
{"level":"info","ts":"2026-11-02T22:11:15.487Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T22:11:18.071Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T22:11:18.239Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:11:18.239Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T22:11:22.153Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:11:22.166Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:11:22.168Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:11:22.168Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T22:11:22.176Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:11:22.183Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"error","ts":"2026-11-02T22:11:22.236Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to delete envoyfilter object","envoyfilter":"openshift-ingress/kuadrant-ratelimiting-e2e-extmod-a-8702a9","error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-extmod-a-8702a9\" not found"}
{"level":"error","ts":"2026-11-02T22:11:22.265Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to delete envoyfilter object","envoyfilter":"openshift-ingress/kuadrant-auth-e2e-extmod-a-8702a9","error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-extmod-a-8702a9\" not found"}
{"level":"info","ts":"2026-11-02T22:11:22.273Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T22:11:22.649Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to delete envoyfilter object","gateway":"openshift-ingress/e2e-extmod-a-8702a9","envoyfilter":"openshift-ingress/kuadrant-e2e-extmod-a-8702a9","error":"envoyfilters.networking.istio.io \"kuadrant-e2e-extmod-a-8702a9\" not found"}
{"level":"info","ts":"2026-11-02T22:11:23Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-extmod-b-6ba06f","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-b-6ba06f","reconcileID":"6f0a2985-0afe-4241-ab23-e0624444d3ae","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-extmod-b-6ba06f","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T22:11:23Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-b-6ba06f","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T22:11:23Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T22:11:23Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-11-02T22:11:23Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T22:11:23Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-11-02T22:11:23Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-extmod-b-6ba06f","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-b-6ba06f","reconcileID":"6f0a2985-0afe-4241-ab23-e0624444d3ae","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-extmod-b-6ba06f","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T22:11:23Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-b-6ba06f","event":"DELETE"}
{"level":"info","ts":"2026-11-02T22:11:23Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-02T22:11:23Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-extmod-b-6ba06f\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-02T22:11:23Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T22:11:24Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-extmod-a-9981d2","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-a-9981d2","reconcileID":"8014d6f6-9a10-4ff4-b6e6-7c78a1fbfbcd","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-extmod-a-9981d2","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T22:11:24Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-a-9981d2","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T22:11:24Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T22:11:24Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-11-02T22:11:24Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T22:11:24Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-11-02T22:11:24Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-extmod-a-9981d2","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-a-9981d2","reconcileID":"8014d6f6-9a10-4ff4-b6e6-7c78a1fbfbcd","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-extmod-a-9981d2","namespace":"openshift-ingress"}
{"level":"error","ts":"2026-11-02T22:11:24Z","logger":"telemetry-policy-extension-controller","msg":"Reconciler error","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-extmod-a-9981d2","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-a-9981d2","reconcileID":"3c3aef36-4f63-4b12-a312-edeb7c59baaf","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-extmod-a-9981d2\" not found","stacktrace":"sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:353\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-02T22:11:24Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-a-9981d2","event":"DELETE"}
{"level":"info","ts":"2026-11-02T22:11:24Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-02T22:11:24Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-extmod-a-9981d2\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-02T22:11:24Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"error","ts":"2026-11-02T22:11:24.949Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-extmod-a-9981d2","namespace":"openshift-ingress","uid":"8ecf93b7-604b-456a-b6fb-921118f5a9f0","error":"tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-extmod-a-9981d2\" not found"}
{"level":"error","ts":"2026-11-02T22:11:25.183Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-extmod-b-6ba06f","namespace":"openshift-ingress","uid":"1aab7d25-e3c3-4c8a-a554-f16d607fd8db","error":"tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-extmod-b-6ba06f\" not found"}
{"level":"info","ts":"2026-11-02T22:11:25Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-shared-a-w1-6689da","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-a-w1-6689da","reconcileID":"ed31bc2b-25cf-48aa-92bb-11247030dbf8","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-shared-a-w1-6689da","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T22:11:25.850Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T22:11:25.850Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T22:11:25Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-a-w1-6689da","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T22:11:25Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T22:11:25Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-11-02T22:11:25Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"error","ts":"2026-11-02T22:11:25.909Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-extmod-a-9981d2","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-extmod-a-9981d2\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:11:25Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-11-02T22:11:25Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-shared-a-w1-6689da","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-a-w1-6689da","reconcileID":"ed31bc2b-25cf-48aa-92bb-11247030dbf8","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-shared-a-w1-6689da","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T22:11:26Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-a-w1-6689da","event":"DELETE"}
{"level":"info","ts":"2026-11-02T22:11:26Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-02T22:11:26Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-shared-a-w1-6689da\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-02T22:11:26Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"error","ts":"2026-11-02T22:11:26.134Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-a-w1-6689da","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-shared-a-w1-6689da\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:11:26.190Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-extmod-a-8702a9","error":"gateways.gateway.networking.k8s.io \"e2e-extmod-a-8702a9\" not found"}
{"level":"error","ts":"2026-11-02T22:11:26.779Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-extmod-b-6ba06f","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-extmod-b-6ba06f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:11:27.797Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Kuadrant","Gateway","TokenRateLimitPolicy","HTTPRoute","AuthPolicy"],"eventTypes":{"delete":3,"update":2}}
{"level":"info","ts":"2026-11-02T22:11:28.001Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:11:28.022Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T22:11:32.267Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T22:11:32.274Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T22:11:32.543Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:11:32.543Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T22:11:32.543Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:11:36.255Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:11:36.271Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:11:36.342Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:11:36.346Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:11:36.346Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T22:11:36.346Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"error","ts":"2026-11-02T22:11:36.382Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to delete envoyfilter object","envoyfilter":"openshift-ingress/kuadrant-auth-e2e-extmod-a-8702a9","error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-extmod-a-8702a9\" not found"}
{"level":"error","ts":"2026-11-02T22:11:36.388Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to delete envoyfilter object","envoyfilter":"openshift-ingress/kuadrant-ratelimiting-e2e-extmod-a-8702a9","error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-extmod-a-8702a9\" not found"}
{"level":"error","ts":"2026-11-02T22:11:36.438Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/952a70f76ce9bb4e633ebbd8a7937503120bb526cc40a11d97c2120eaf7d5cb2","error":"authconfigs.authorino.kuadrant.io \"952a70f76ce9bb4e633ebbd8a7937503120bb526cc40a11d97c2120eaf7d5cb2\" not found"}
{"level":"error","ts":"2026-11-02T22:11:36.441Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:11:36.441Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T22:11:36.494Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/b8041a514e8491778a83cb48d7dbe37a6744b17717fecbe9fa2ef12ea3d3704b","error":"authconfigs.authorino.kuadrant.io \"b8041a514e8491778a83cb48d7dbe37a6744b17717fecbe9fa2ef12ea3d3704b\" not found"}
{"level":"error","ts":"2026-11-02T22:11:36.549Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/dcc003360f6371bfd59fb51dbe24d440140b656ade1906af00f891f8f3712ea6","error":"authconfigs.authorino.kuadrant.io \"dcc003360f6371bfd59fb51dbe24d440140b656ade1906af00f891f8f3712ea6\" not found"}
{"level":"error","ts":"2026-11-02T22:11:36.603Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/43fe43cf600a938cfdf3d1f28c8091519261999cc304be62b4bcd6090899abfd","error":"authconfigs.authorino.kuadrant.io \"43fe43cf600a938cfdf3d1f28c8091519261999cc304be62b4bcd6090899abfd\" not found"}
{"level":"error","ts":"2026-11-02T22:11:36.658Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/4c1f793a8045d4e482f8695521e648924a4efb4beddcdb340057d2239cea08ce","error":"authconfigs.authorino.kuadrant.io \"4c1f793a8045d4e482f8695521e648924a4efb4beddcdb340057d2239cea08ce\" not found"}
{"level":"error","ts":"2026-11-02T22:11:36.712Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/ee5045507453ce2b860eb25ed20510343e9145d7ef328cddc7247dbc9a38aee2","error":"authconfigs.authorino.kuadrant.io \"ee5045507453ce2b860eb25ed20510343e9145d7ef328cddc7247dbc9a38aee2\" not found"}
{"level":"error","ts":"2026-11-02T22:11:37.214Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-extmod-a-9981d2","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T22:06:56Z","generation":1,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"711d9b03-2eaf-4618-a1ee-f54d0fd91c96\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:06:56Z"}],"name":"kuadrant-e2e-extmod-a-9981d2","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-extmod-a-9981d2","uid":"711d9b03-2eaf-4618-a1ee-f54d0fd91c96"}],"resourceVersion":"100625","uid":"729e36b0-11d8-4d9b-a81b-7225b566ec96"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3742d5f4ac1e4aeae03c8674f111ed22224ae7c3afb891ed750abdb47e8d30e3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-extmod-a-9981d2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__29fbd049\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-9981d2\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-extmod-a-9981d2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__29fbd049\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-9981d2\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-extmod-a-9981d2\"]}],\"name\":\"58a6889c2376a6382e5af6bc64a32c1d8b96ebdd7e4c1e60bfb3ad1db857ccc8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9519ccab5d12fc7287d943fc71f19110d90ef6c19edab74a228d71ebb29531ba\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-extmod-a-9981d2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__29fbd049\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-9981d2\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-extmod-a-9981d2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__29fbd049\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-9981d2\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-extmod-a-9981d2\"]}],\"name\":\"e2e01242be4ecd4cf8a2ced5b75574850d08d339583f9f63dd7eec1d8755dae7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2b3df20e8b38156488201f24bd07403597a3ee9a299eb1765c6a2364fd9d5a19\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-extmod-a-9981d2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__29fbd049\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-9981d2\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-extmod-a-9981d2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__29fbd049\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-9981d2\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-extmod-a-9981d2\"]}],\"name\":\"f0d1bb9d1a47ed566f841bf9fd1954300ed80b31862476d20415737462680b6b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"dd1b88707253ad02344e5cf8519b15dc472dad64394067bc8528905a15edfe3b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-extmod-a-9981d2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__29fbd049\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-9981d2\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-extmod-a-9981d2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__29fbd049\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-9981d2\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-extmod-a-9981d2\"]}],\"name\":\"4db6995b26e79e82407e81b0980cd18a193684ae79dd293556b6a07d8cb79028\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"76357ed717983f505f26065c47c15517d662b4818a3f40e88b6e17bacee0a5ca\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-extmod-a-9981d2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__29fbd049\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-9981d2\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-extmod-a-9981d2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__29fbd049\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-9981d2\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-extmod-a-9981d2\"]}],\"name\":\"66ea23710a0ee4981e64358458c7627ad119a132ef203da5757e396ca754d786\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e2db3539288b8fded9c21f86b104d6cb027d08994877a52655731082c7f13aab\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-extmod-a-9981d2-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__29fbd049\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-9981d2\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-extmod-a-9981d2\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__29fbd049\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-9981d2\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-extmod-a-9981d2\"]}],\"name\":\"716ea26072e32a07828cd67e71adc60fd1f666cd6c7e460e9a38d4e5541f73ca\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}}],\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-extmod-a-9981d2"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-e2e-extmod-a-9981d2\" not found"}
{"level":"error","ts":"2026-11-02T22:11:37.470Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-shared-a-w1-6689da","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T22:04:10Z","generation":1,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"def49e9c-a5db-4c1d-9263-8f0b6e3fc6b6\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:04:10Z"}],"name":"kuadrant-e2e-shared-a-w1-6689da","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-a-w1-6689da","uid":"def49e9c-a5db-4c1d-9263-8f0b6e3fc6b6"}],"resourceVersion":"96636","uid":"06b83945-c8eb-45d5-9e08-0301bbc035e1"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b006ad729b2188ace5faf61aa80663fc9bd84c64954016fcca1b3119504d80ef\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w1-6689da-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ee5374ea\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w1-6689da\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w1-6689da\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ee5374ea\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w1-6689da\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w1-6689da\"]}],\"name\":\"d1efa3892d2930e0914fff25e45c26e9350dd5768f3e3570a92056a5386414b1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"52f16f2579f0972b25c79646516d0b524ccd11f35bf97140e7a17004f04958a0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w1-6689da-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ee5374ea\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w1-6689da\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w1-6689da\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ee5374ea\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w1-6689da\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w1-6689da\"]}],\"name\":\"b98c0ed9e221dc10d7f33c75550156549e86e03ed847a552bd6ac759f2d85acb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b448f08c35cad10231a4caace1ef450ff8a77e5b20a28eee89d0c690d78dc63e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w1-6689da-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ee5374ea\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w1-6689da\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w1-6689da\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ee5374ea\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w1-6689da\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w1-6689da\"]}],\"name\":\"50c5d15dc441c5afe0e4e0b7eba4f644de459b5c1800cbabc40a76b70ac396c5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"67e5b24c3247b6535e48582dcd841c834bd22005b0954bf3ef3ec72658b5a352\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w1-6689da-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ee5374ea\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w1-6689da\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w1-6689da\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ee5374ea\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w1-6689da\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w1-6689da\"]}],\"name\":\"e1312a603b424eb91bc2d725e46f969a6e4f8f82f72e5e7e38f47a2b042e5f54\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d8a51cee975cd9c0d9911ce8ea5ca2d06c5a66798ecb321ef52a246e99aba7bb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w1-6689da-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ee5374ea\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w1-6689da\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w1-6689da\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ee5374ea\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w1-6689da\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w1-6689da\"]}],\"name\":\"9929ec06e1f1ae29fb3111aa27ce6cbceeec300b407d06ba3014bf63246927ef\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9a8d103eb97e68d1cda1b42c44a3c03b0bb4d7aafa28f5f0d0f31ce70414e058\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w1-6689da-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ee5374ea\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w1-6689da\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w1-6689da\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ee5374ea\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w1-6689da\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w1-6689da\"]}],\"name\":\"6f48a8cd8781be155e12b4c5199cecf4c35bd08b7867a70f4de0802d5ca85537\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}}],\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-shared-a-w1-6689da"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-e2e-shared-a-w1-6689da\" not found"}
{"level":"error","ts":"2026-11-02T22:11:37.929Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to delete envoyfilter object","gateway":"openshift-ingress/e2e-extmod-a-8702a9","envoyfilter":"openshift-ingress/kuadrant-e2e-extmod-a-8702a9","error":"envoyfilters.networking.istio.io \"kuadrant-e2e-extmod-a-8702a9\" not found"}
{"level":"error","ts":"2026-11-02T22:11:38.420Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-extmod-a-9981d2","namespace":"openshift-ingress","uid":"8ecf93b7-604b-456a-b6fb-921118f5a9f0","error":"tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-extmod-a-9981d2\" not found"}
{"level":"error","ts":"2026-11-02T22:11:38.540Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-autores-363e15","namespace":"openshift-ingress","uid":"2b016150-2fbf-46fd-8dd8-fcc820678b52","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-autores-363e15\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:11:38.708Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-autores-363e15-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-autores-363e15-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:11:39.195Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"maas-gateway-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"maas-gateway-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:11:39.255Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-a-w1-6689da-maas-auth","namespace":"openshift-ingress","error":"authpolicies.kuadrant.io \"e2e-shared-a-w1-6689da-maas-auth\" not found"}
{"level":"error","ts":"2026-11-02T22:11:39.314Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-extmod-a-9981d2-maas-auth","namespace":"openshift-ingress","error":"authpolicies.kuadrant.io \"e2e-extmod-a-9981d2-maas-auth\" not found"}
{"level":"error","ts":"2026-11-02T22:11:39.907Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-a-w1-6689da","namespace":"openshift-ingress","uid":"ef7c9ccc-2321-4db6-a8e9-5ce03089e75e","error":"tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-a-w1-6689da\" not found"}
{"level":"error","ts":"2026-11-02T22:11:40.026Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-extmod-b-6ba06f","namespace":"openshift-ingress","uid":"1aab7d25-e3c3-4c8a-a554-f16d607fd8db","error":"tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-extmod-b-6ba06f\" not found"}
{"level":"info","ts":"2026-11-02T22:11:40.148Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T22:11:40.148Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T22:11:40.878Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-extmod-a-9981d2","error":"gateways.gateway.networking.k8s.io \"e2e-extmod-a-9981d2\" not found"}
{"level":"error","ts":"2026-11-02T22:11:41.057Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-a-w1-6689da","error":"gateways.gateway.networking.k8s.io \"e2e-shared-a-w1-6689da\" not found"}
{"level":"error","ts":"2026-11-02T22:11:41.305Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-extmod-b-6ba06f","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-extmod-b-6ba06f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:11:41.421Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-extmod-a-8702a9","error":"gateways.gateway.networking.k8s.io \"e2e-extmod-a-8702a9\" not found"}
{"level":"info","ts":"2026-11-02T22:11:48.501Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway","AuthPolicy","EnvoyFilter","Kuadrant","ConfigMap","TokenRateLimitPolicy","Limitador","HTTPRoute","AuthConfig"],"eventTypes":{"create":1,"delete":26,"update":8}}
{"level":"info","ts":"2026-11-02T22:11:48.775Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:11:48.795Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T22:11:51.834Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T22:11:52.345Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T22:11:52.423Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:11:52.542Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:11:52.542Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T22:11:55.648Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:11:55.666Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T22:11:55.647Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:11:55.744Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:11:55.844Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:11:55.844Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T22:11:55.849Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T22:11:59.132Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T22:11:59.133Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T22:12:07.403Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthPolicy","Limitador","ConfigMap","Gateway","AuthConfig","EnvoyFilter"],"eventTypes":{"delete":21,"update":4}}
{"level":"info","ts":"2026-11-02T22:12:07.805Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T22:12:10.071Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T22:12:10.250Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:12:10.250Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T22:12:13.749Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:12:13.760Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:12:13.770Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-02T22:12:13.770Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T22:12:13.842Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:12:13.851Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:12:13.851Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T22:12:17.076Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T22:12:17.076Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T22:12:22.139Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","Limitador","ConfigMap"],"eventTypes":{"update":24}}
{"level":"info","ts":"2026-11-02T22:12:22.437Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T22:12:24Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-inf-a-065be7","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-a-065be7","reconcileID":"784a24f2-46a6-447e-89cd-88902543026f","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-inf-a-065be7","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T22:12:24Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-a-065be7","event":"CREATE"}
{"level":"info","ts":"2026-11-02T22:12:24Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T22:12:24.353Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T22:12:24.466Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:12:24.466Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T22:12:25Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-02T22:12:25Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-02T22:12:25Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T22:12:25Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-inf-a-065be7","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-a-065be7","reconcileID":"7d0e2fe5-d1d5-4b5a-a9cf-db1788a30449","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-inf-a-065be7","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T22:12:25Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-a-065be7","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T22:12:25Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T22:12:26Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-02T22:12:26Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-02T22:12:26Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-02T22:12:26Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T22:12:28.276Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:12:28.284Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-02T22:12:28.284Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T22:12:28.284Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:12:28.289Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:12:28.289Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T22:12:31.459Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T22:12:31.459Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T22:12:32.754Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-inf-a-065be7","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-inf-a-065be7\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:12:39.626Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Kuadrant","AuthPolicy","Gateway","HTTPRoute","TokenRateLimitPolicy","ConfigMap"],"eventTypes":{"create":3,"update":3}}
{"level":"info","ts":"2026-11-02T22:12:39.983Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:12:40.049Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T22:12:43.160Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T22:12:43.238Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T22:12:43.356Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:12:43.356Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T22:12:43.523Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:12:46.948Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:12:46.948Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:12:46.956Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T22:12:46.963Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:12:46.966Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:12:46.966Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T22:12:47.068Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T22:12:50.428Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T22:12:50.428Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T22:13:01.981Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","Gateway","AuthConfig","AuthPolicy","EnvoyFilter","HTTPRoute","ConfigMap","Limitador"],"eventTypes":{"create":9,"update":28}}
{"level":"info","ts":"2026-11-02T22:13:02.226Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T22:13:04.624Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T22:13:04.732Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:13:04.732Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T22:13:06Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-inf-a-4585ee","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-a-4585ee","reconcileID":"178c749c-abf3-4875-bfd6-a3cc8c9a7aa2","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-inf-a-4585ee","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T22:13:06Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-a-4585ee","event":"CREATE"}
{"level":"info","ts":"2026-11-02T22:13:06Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T22:13:08Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-02T22:13:08Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-02T22:13:08Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T22:13:08Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-autores-363e15","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-autores-363e15","reconcileID":"51398669-6731-47ac-ad52-98b4ad91a130","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-autores-363e15","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T22:13:08Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-autores-363e15","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T22:13:08Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T22:13:08Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-11-02T22:13:08Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T22:13:08Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-11-02T22:13:08Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-autores-363e15","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-autores-363e15","reconcileID":"51398669-6731-47ac-ad52-98b4ad91a130","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-autores-363e15","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T22:13:08Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-inf-a-4585ee","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-a-4585ee","reconcileID":"b3755191-f130-4304-ba5d-7ec275fcb50a","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-inf-a-4585ee","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T22:13:08Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-a-4585ee","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T22:13:08Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T22:13:08.867Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:13:08.884Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:13:08.884Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T22:13:08.884Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:13:08.885Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:13:08.891Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-02T22:13:08.891Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T22:13:09Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-02T22:13:09Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-02T22:13:09Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-02T22:13:09Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"error","ts":"2026-11-02T22:13:09Z","logger":"telemetry-policy-extension-controller","msg":"Reconciler error","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-autores-363e15","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-autores-363e15","reconcileID":"a7e0f094-92d4-4b3b-aab2-c4e6b9751eef","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-autores-363e15\" not found","stacktrace":"sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:353\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-02T22:13:09Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-autores-363e15","event":"DELETE"}
{"level":"info","ts":"2026-11-02T22:13:09Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-02T22:13:09Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-autores-363e15\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-02T22:13:09Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"error","ts":"2026-11-02T22:13:11.883Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-autores-363e15-maas-auth","namespace":"openshift-ingress","error":"authpolicies.kuadrant.io \"e2e-autores-363e15-maas-auth\" not found"}
{"level":"error","ts":"2026-11-02T22:13:12.511Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-autores-363e15","namespace":"openshift-ingress","uid":"2b016150-2fbf-46fd-8dd8-fcc820678b52","error":"tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-autores-363e15\" not found"}
{"level":"info","ts":"2026-11-02T22:13:12.638Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T22:13:12.638Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T22:13:13.124Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-autores-363e15","error":"gateways.gateway.networking.k8s.io \"e2e-autores-363e15\" not found"}
{"level":"error","ts":"2026-11-02T22:13:13.182Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-inf-a-72f279","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-inf-a-72f279\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:13:13.797Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-inf-a-4585ee","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-inf-a-4585ee\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:13:14.522Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway","AuthPolicy"],"eventTypes":{"create":1,"delete":2}}
{"level":"info","ts":"2026-11-02T22:13:20.450Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:13:20.455Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:13:20.531Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:13:20.541Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:13:20.541Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T22:13:20.545Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-02T22:13:20.545Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T22:13:21.398Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-autores-363e15","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T22:10:36Z","generation":1,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"b503c6f8-803e-4564-949f-2eb6fb6fd84d\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:10:36Z"}],"name":"kuadrant-e2e-autores-363e15","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-autores-363e15","uid":"b503c6f8-803e-4564-949f-2eb6fb6fd84d"}],"resourceVersion":"105890","uid":"52f1afd9-f7ae-42e5-a965-92eeb7d82be2"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e972c675546ea6af7d81cc5a73f2cdd49a66549d6da470ffb2560f70e0f57e7b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-autores-363e15-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__984ca63d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-autores-363e15\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-autores-363e15\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__984ca63d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-autores-363e15\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-autores-363e15\"]}],\"name\":\"163982789abdac20fc654f6dcfe2f62075ab17523b0b2413d3dfe3fa45a73a35\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4ab093bbd181f524f77e6add42b63b164c6fa1763796bec87d0c8b6ba5d1ee73\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-autores-363e15-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__984ca63d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-autores-363e15\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-autores-363e15\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__984ca63d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-autores-363e15\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-autores-363e15\"]}],\"name\":\"a1d1c73d9d2f66a7a60a50de6c42aa98c810c4acd51708f2021dff5714396119\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a5aed9501c7dea48c7bdcc613b6d3b3d62f185606c8b0360624970557c5f14c3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-autores-363e15-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__984ca63d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-autores-363e15\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-autores-363e15\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__984ca63d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-autores-363e15\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-autores-363e15\"]}],\"name\":\"aa42b86d8f3ca4d6b7ffe99ac916ddc3b112eb22c838cf59ac69f9143ed7ef05\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5cdab84016ac0cbdcdeefa51af6073e3b4b585224a1dc1fbb3d563f73cfa370a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-autores-363e15-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__984ca63d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-autores-363e15\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-autores-363e15\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__984ca63d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-autores-363e15\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-autores-363e15\"]}],\"name\":\"9312817ecd1f9dbb687598216efb9bd4ec6353aa83acb4d8159fb321c2de9fca\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d16a81ba9f403bee59919e44768171dccc31ac7576e0a1c39bd1c0d01193241d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-autores-363e15-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__984ca63d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-autores-363e15\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-autores-363e15\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__984ca63d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-autores-363e15\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-autores-363e15\"]}],\"name\":\"67576e6a6e3ac749bd7c9c3b0ce3473a26b5ae2f42ad617f5121b8b81010d497\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"36c387407442b9a646531f6110f864d6de1f0c2046bc6135607877328d6ae79e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-autores-363e15-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__984ca63d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-autores-363e15\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-autores-363e15\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__984ca63d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-autores-363e15\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-autores-363e15\"]}],\"name\":\"01d1f8bf80ffc68633c4f5eda1ea4b71cea7d2576cbbde0559d3de5d46d45b3b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}}],\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-autores-363e15"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-e2e-autores-363e15\" not found"}
{"level":"error","ts":"2026-11-02T22:13:22.299Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-b-w1-5ddbd0","namespace":"openshift-ingress","uid":"28ff41cd-229b-42ef-814d-297087985e9f","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-b-w1-5ddbd0\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:13:22.356Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-autores-363e15","namespace":"openshift-ingress","uid":"2b016150-2fbf-46fd-8dd8-fcc820678b52","error":"tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-autores-363e15\" not found"}
{"level":"error","ts":"2026-11-02T22:13:22.414Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w3-f51151","namespace":"e2e-models-e2e-worker-w3-f51151","uid":"c78aa03a-e3ca-4797-8a09-ab0d9cd88148","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w3-f51151\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:13:22.436Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-autores-363e15-maas-auth","namespace":"openshift-ingress","error":"authpolicies.kuadrant.io \"e2e-autores-363e15-maas-auth\" not found"}
{"level":"error","ts":"2026-11-02T22:13:22.532Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-a-w4-7cde84","namespace":"openshift-ingress","uid":"83e46bfa-f121-4136-adc9-a9e6690edeab","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-a-w4-7cde84\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:13:22.591Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w1-5f765a","namespace":"e2e-models-e2e-worker-w1-5f765a","uid":"7188eadc-9748-4be8-a5e2-d904cf5b6130","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w1-5f765a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:13:22.649Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-b-w3-a1d751","namespace":"openshift-ingress","uid":"2c7a0593-2f35-427a-b6f0-958582546c18","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-b-w3-a1d751\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:13:22.766Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-a-w2-06e461","namespace":"openshift-ingress","uid":"c459fc7a-4e41-4226-a9ad-15cf3c29611a","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-a-w2-06e461\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:13:22.824Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w4-d6cb38","namespace":"e2e-models-e2e-worker-w4-d6cb38","uid":"486176e6-7786-40c4-9ce0-6f4a68b408b2","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w4-d6cb38\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:13:22.882Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-facebook-opt-125m-simulated","namespace":"llm","uid":"da8edb1a-ed61-454d-939f-fc7cd235d9fb","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-facebook-opt-125m-simulated\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:13:22.941Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-a-w0-6e535d","namespace":"openshift-ingress","uid":"0eae774a-4032-4461-b2be-6f3edd911a80","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-a-w0-6e535d\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:13:23.000Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-a-w3-97995b","namespace":"openshift-ingress","uid":"9405e4ea-22ff-4c46-bbc0-f492e0e403dc","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-a-w3-97995b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:13:23.058Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w4-d6cb38","namespace":"e2e-models-e2e-worker-w4-d6cb38","uid":"0d3ebd35-5005-4ee4-a055-ff95546e3673","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w4-d6cb38\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:13:23.116Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w0-0c9014","namespace":"e2e-models-e2e-worker-w0-0c9014","uid":"dcb5a0e4-7049-4ddc-91de-e14d55b09789","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w0-0c9014\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:13:23.233Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w1-5f765a","namespace":"e2e-models-e2e-worker-w1-5f765a","uid":"9c852546-ee7c-4e72-855c-111315f7bf82","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w1-5f765a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:13:23.292Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-b-w0-0f0874","namespace":"openshift-ingress","uid":"8b4ec7cb-daa9-467a-b2f6-528aa3d837fc","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-b-w0-0f0874\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:13:23.324Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-inf-a-065be7-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-inf-a-065be7-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:13:23.352Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w0-0c9014","namespace":"e2e-models-e2e-worker-w0-0c9014","uid":"4f647df6-1d5b-433b-b4fc-1279ff1755f7","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w0-0c9014\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:13:23.410Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w2-6fa533","namespace":"e2e-models-e2e-worker-w2-6fa533","uid":"2ff73667-c2c3-4579-9503-b6ca098f1021","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w2-6fa533\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:13:23.469Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-simulated-simulated-premium","namespace":"llm","uid":"447993be-3c57-4e68-8ffa-6fc998a39c77","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-simulated-simulated-premium\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:13:23.527Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w2-6fa533","namespace":"e2e-models-e2e-worker-w2-6fa533","uid":"3a128bb2-de88-49aa-ab9e-c8626107a077","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w2-6fa533\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:13:23.645Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w3-f51151","namespace":"e2e-models-e2e-worker-w3-f51151","uid":"e3340067-224a-43ad-8020-ca9e00ead152","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w3-f51151\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:13:23.703Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-b-w4-58ca7f","namespace":"openshift-ingress","uid":"5187151d-dfe9-40c2-b03b-5e9a20a0d12c","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-b-w4-58ca7f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:13:23.880Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-b-w2-c7e71f","namespace":"openshift-ingress","uid":"6decd2e5-6aa1-451b-97e5-5dd8911def76","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-b-w2-c7e71f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:13:23.938Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-inf-a-065be7","namespace":"openshift-ingress","uid":"9e44ac8d-dd4e-48be-a732-2441d104f322","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-inf-a-065be7\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:13:23.938Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T22:13:23.938Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T22:13:24.352Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-inf-a-4585ee","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-inf-a-4585ee\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:13:24.655Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-inf-a-72f279","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-inf-a-72f279\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:13:25.260Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-autores-363e15","error":"gateways.gateway.networking.k8s.io \"e2e-autores-363e15\" not found"}
{"level":"info","ts":"2026-11-02T22:13:32.420Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthPolicy","TokenRateLimitPolicy","Gateway","Limitador","Kuadrant","ConfigMap","HTTPRoute","EnvoyFilter"],"eventTypes":{"create":4,"delete":7,"update":28}}
{"level":"info","ts":"2026-11-02T22:13:32.777Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:13:32.797Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T22:13:35.669Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T22:13:36.164Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:13:36.470Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T22:13:36.672Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:13:36.672Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T22:13:39.769Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:13:39.769Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:13:39.776Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T22:13:39.791Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:13:39.794Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:13:39.794Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T22:13:39.941Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T22:13:43.376Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T22:13:43.376Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T22:13:51.915Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","EnvoyFilter","AuthConfig","ConfigMap","AuthPolicy","Limitador","Gateway","HTTPRoute"],"eventTypes":{"create":9,"delete":6,"update":28}}
{"level":"info","ts":"2026-11-02T22:13:52.287Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T22:13:55.664Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T22:13:55.825Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:13:55.825Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T22:13:59.643Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:13:59.663Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:13:59.672Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-02T22:13:59.672Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T22:13:59.738Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:13:59.738Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T22:13:59.743Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:14:03.009Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T22:14:03.009Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T22:14:07.878Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","AuthPolicy","Limitador","ConfigMap"],"eventTypes":{"update":26}}
{"level":"info","ts":"2026-11-02T22:14:08.069Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T22:14:09.640Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T22:14:09.848Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:14:09.848Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T22:14:13.645Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:14:13.645Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:14:13.651Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-02T22:14:13.651Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T22:14:13.672Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:14:13.672Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T22:14:13.674Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:14:16.955Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T22:14:16.955Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T22:14:31Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-inf-a-72f279","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-a-72f279","reconcileID":"d4a86cd3-ca8d-4165-8f54-1299efd8e080","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-inf-a-72f279","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T22:14:31Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-a-72f279","event":"CREATE"}
{"level":"info","ts":"2026-11-02T22:14:31Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T22:14:31Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-02T22:14:31Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-02T22:14:31Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T22:14:31Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-inf-a-72f279","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-a-72f279","reconcileID":"4603d734-59e0-4ece-a931-4efdbfe2675d","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-inf-a-72f279","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T22:14:32Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-a-72f279","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T22:14:32Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T22:14:32Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-02T22:14:32Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-02T22:14:32Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-02T22:14:32Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T22:14:32Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-inf-a-72f279","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-a-72f279","reconcileID":"fabf6a71-038f-44f9-ae5d-30cbfffd5b5b","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-inf-a-72f279","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T22:14:32Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-a-72f279","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T22:14:32Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T22:14:33Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-02T22:14:33Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-02T22:14:33Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-02T22:14:33Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T22:14:37Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-shared-b-w1-5ddbd0","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-b-w1-5ddbd0","reconcileID":"a7d95c69-8808-4bdf-8f07-e073a39be8cf","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-shared-b-w1-5ddbd0","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T22:14:37Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-b-w1-5ddbd0","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T22:14:37Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T22:14:37Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-11-02T22:14:37Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T22:14:37Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-11-02T22:14:37Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-shared-b-w1-5ddbd0","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-b-w1-5ddbd0","reconcileID":"a7d95c69-8808-4bdf-8f07-e073a39be8cf","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-shared-b-w1-5ddbd0","namespace":"openshift-ingress"}
{"level":"error","ts":"2026-11-02T22:14:37Z","logger":"telemetry-policy-extension-controller","msg":"Reconciler error","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-shared-b-w1-5ddbd0","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-b-w1-5ddbd0","reconcileID":"8b03e775-3472-497a-9bc3-5c63fd637257","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-shared-b-w1-5ddbd0\" not found","stacktrace":"sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:353\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-02T22:14:37Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-b-w1-5ddbd0","event":"DELETE"}
{"level":"info","ts":"2026-11-02T22:14:37Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-02T22:14:37Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-shared-b-w1-5ddbd0\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-02T22:14:37Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T22:14:39.642Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["HTTPRoute","ConfigMap","Kuadrant","Gateway"],"eventTypes":{"create":1,"update":3}}
{"level":"info","ts":"2026-11-02T22:14:39.835Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:14:39.842Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T22:14:43.124Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T22:14:43.246Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T22:14:43.360Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:14:43.360Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T22:14:43.736Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:14:47.167Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:14:47.174Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T22:14:47.167Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:14:47.223Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:14:47.243Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:14:47.243Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-02T22:14:47.323Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to delete envoyfilter object","envoyfilter":"openshift-ingress/kuadrant-auth-e2e-shared-b-w1-5ddbd0","error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-shared-b-w1-5ddbd0\" not found"}
{"level":"info","ts":"2026-11-02T22:14:47.324Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T22:14:47.325Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to delete envoyfilter object","envoyfilter":"openshift-ingress/kuadrant-ratelimiting-e2e-shared-b-w1-5ddbd0","error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-shared-b-w1-5ddbd0\" not found"}
{"level":"error","ts":"2026-11-02T22:14:48.902Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to delete envoyfilter object","gateway":"openshift-ingress/e2e-shared-b-w1-5ddbd0","envoyfilter":"openshift-ingress/kuadrant-e2e-shared-b-w1-5ddbd0","error":"envoyfilters.networking.istio.io \"kuadrant-e2e-shared-b-w1-5ddbd0\" not found"}
{"level":"error","ts":"2026-11-02T22:14:49.239Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-b-w1-5ddbd0","namespace":"openshift-ingress","uid":"28ff41cd-229b-42ef-814d-297087985e9f","error":"tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-b-w1-5ddbd0\" not found"}
{"level":"error","ts":"2026-11-02T22:14:50.002Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-b-w1-5ddbd0-maas-auth","namespace":"openshift-ingress","error":"authpolicies.kuadrant.io \"e2e-shared-b-w1-5ddbd0-maas-auth\" not found"}
{"level":"info","ts":"2026-11-02T22:14:50.967Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T22:14:50.967Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T22:14:51.703Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-b-w1-5ddbd0","error":"gateways.gateway.networking.k8s.io \"e2e-shared-b-w1-5ddbd0\" not found"}
{"level":"info","ts":"2026-11-02T22:14:52.763Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Kuadrant","TokenRateLimitPolicy","AuthPolicy","Gateway","HTTPRoute"],"eventTypes":{"create":2,"delete":1,"update":2}}
{"level":"info","ts":"2026-11-02T22:14:52.908Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:14:52.929Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T22:14:54Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-extmod-a-d6b384","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-a-d6b384","reconcileID":"f14fbe25-9bc1-4025-b38d-572732233049","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-extmod-a-d6b384","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T22:14:54Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-a-d6b384","event":"CREATE"}
{"level":"info","ts":"2026-11-02T22:14:54Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T22:14:56.123Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:14:56.340Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T22:14:56Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-02T22:14:56Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-02T22:14:56Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T22:14:56Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-extmod-a-d6b384","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-a-d6b384","reconcileID":"10c33e9b-10c4-4863-9870-c57b689eab58","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-extmod-a-d6b384","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T22:14:56.548Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T22:14:56Z","logger":"telemetry-policy-extension-controller","msg":"Warning: Reconciler returned both a non-zero result and a non-nil error. The result will always be ignored if the error is non-nil and the non-nil error causes requeuing with exponential backoff. For more details, see: https://pkg.go.dev/sigs.k8s.io/controller-runtime/pkg/reconcile#Reconciler","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-extmod-a-d6b384","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-a-d6b384","reconcileID":"10c33e9b-10c4-4863-9870-c57b689eab58"}
{"level":"error","ts":"2026-11-02T22:14:56Z","logger":"telemetry-policy-extension-controller","msg":"Reconciler error","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-extmod-a-d6b384","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-a-d6b384","reconcileID":"10c33e9b-10c4-4863-9870-c57b689eab58","error":"Operation cannot be fulfilled on telemetrypolicies.extensions.kuadrant.io \"maas-telemetry-e2e-extmod-a-d6b384\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:353\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-02T22:14:56Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-extmod-a-d6b384","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-a-d6b384","reconcileID":"1ab5c3eb-6297-4371-8118-b446800a8303","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-extmod-a-d6b384","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T22:14:56Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-a-d6b384","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T22:14:56Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T22:14:56.743Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:14:56.743Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T22:14:57Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-02T22:14:57Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-02T22:14:57Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-02T22:14:57Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T22:14:57Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-a-d6b384","event":"UNKNOWN"}
{"level":"info","ts":"2026-11-02T22:14:57Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T22:14:59Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-02T22:14:59Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-02T22:14:59Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-02T22:14:59Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T22:15:00.262Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:15:00.263Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:15:00.270Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T22:15:00.323Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:15:00.345Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:15:00.345Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-02T22:15:00.376Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:15:00.376Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T22:15:00.376Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-inf-a-72f279","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/ratelimit":"true"},"name":"kuadrant-ratelimiting-e2e-inf-a-72f279","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-inf-a-72f279","uid":"86de6054-b8a7-44bd-8811-8891ead01c05"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"limitador-limitador.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-ratelimit-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"limitador-limitador.kuadrant-system.svc.cluster.local","port_value":8081}}}}]}]},"name":"kuadrant-ratelimit-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-inf-a-72f279"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-inf-a-72f279\" already exists"}
{"level":"error","ts":"2026-11-02T22:15:00.423Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-inf-a-72f279","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"kuadrant-auth-e2e-inf-a-72f279","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-inf-a-72f279","uid":"86de6054-b8a7-44bd-8811-8891ead01c05"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-auth-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local","port_value":50051}}}}]}]},"name":"kuadrant-auth-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-inf-a-72f279"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-inf-a-72f279\" already exists"}
{"level":"error","ts":"2026-11-02T22:15:00.424Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-72f279","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-inf-a-72f279#rule-5"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"0f045ee5bcfa76fccf818707f08da70f7997e3dcab44861f8ba72f46c548cff9","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["0f045ee5bcfa76fccf818707f08da70f7997e3dcab44861f8ba72f46c548cff9"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-72f279.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-72f279.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"0f045ee5bcfa76fccf818707f08da70f7997e3dcab44861f8ba72f46c548cff9\" already exists"}
{"level":"error","ts":"2026-11-02T22:15:00.432Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to delete envoyfilter object","envoyfilter":"openshift-ingress/kuadrant-ratelimiting-e2e-shared-b-w1-5ddbd0","error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-shared-b-w1-5ddbd0\" not found"}
{"level":"error","ts":"2026-11-02T22:15:00.482Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to delete envoyfilter object","envoyfilter":"openshift-ingress/kuadrant-auth-e2e-shared-b-w1-5ddbd0","error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-shared-b-w1-5ddbd0\" not found"}
{"level":"error","ts":"2026-11-02T22:15:00.492Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-72f279","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-inf-a-72f279#rule-2"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"3aa6865734f6d5a5b3ecb6aed2ade9be1ebe9bf0728be6a4dbd30330dd94c219","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["3aa6865734f6d5a5b3ecb6aed2ade9be1ebe9bf0728be6a4dbd30330dd94c219"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-72f279.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-72f279.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"3aa6865734f6d5a5b3ecb6aed2ade9be1ebe9bf0728be6a4dbd30330dd94c219\" already exists"}
{"level":"error","ts":"2026-11-02T22:15:00.568Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-72f279","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-inf-a-72f279#rule-1"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"f3255b398183380b1af1af7896d3f2108a40b397fc7d7f1fbbfa7f2d210dcdce","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f3255b398183380b1af1af7896d3f2108a40b397fc7d7f1fbbfa7f2d210dcdce"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-72f279.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-72f279.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"f3255b398183380b1af1af7896d3f2108a40b397fc7d7f1fbbfa7f2d210dcdce\" already exists"}
{"level":"error","ts":"2026-11-02T22:15:00.645Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-72f279","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-inf-a-72f279#rule-3"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"0d147fe9313680b4fb1ff5f05bc428e0537ac4c25eb847ccd92a30558d2f6628","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["0d147fe9313680b4fb1ff5f05bc428e0537ac4c25eb847ccd92a30558d2f6628"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-72f279.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-72f279.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"0d147fe9313680b4fb1ff5f05bc428e0537ac4c25eb847ccd92a30558d2f6628\" already exists"}
{"level":"error","ts":"2026-11-02T22:15:00.735Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-72f279","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-inf-a-72f279#rule-6"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"d46c84d7a4f4c67d985c060ac96365bc2296efc839ca0a629e15b7917ed34608","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d46c84d7a4f4c67d985c060ac96365bc2296efc839ca0a629e15b7917ed34608"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-72f279.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-72f279.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"d46c84d7a4f4c67d985c060ac96365bc2296efc839ca0a629e15b7917ed34608\" already exists"}
{"level":"error","ts":"2026-11-02T22:15:00.812Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-72f279","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-inf-a-72f279#rule-4"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"e03cb0845f90d6a18a9a9657441002b5cfe4f1a82ed60e1371a433c17c76081d","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["e03cb0845f90d6a18a9a9657441002b5cfe4f1a82ed60e1371a433c17c76081d"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-72f279.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-72f279.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"e03cb0845f90d6a18a9a9657441002b5cfe4f1a82ed60e1371a433c17c76081d\" already exists"}
{"level":"error","ts":"2026-11-02T22:15:00.869Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/e8f137b0904992809ff0816c3ae81cdcded0fec8647c0bbd344768817745bab4","error":"authconfigs.authorino.kuadrant.io \"e8f137b0904992809ff0816c3ae81cdcded0fec8647c0bbd344768817745bab4\" not found"}
{"level":"error","ts":"2026-11-02T22:15:00.924Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/08acf90ca1dfdc3f28c12b873c35eac596bff58cf8cd094148e0306d5002bd97","error":"authconfigs.authorino.kuadrant.io \"08acf90ca1dfdc3f28c12b873c35eac596bff58cf8cd094148e0306d5002bd97\" not found"}
{"level":"error","ts":"2026-11-02T22:15:00.980Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/666401b9a0a5e1174cfa0c4681f3f1927b5a7d40e7f71a3d91b9330f99d22df3","error":"authconfigs.authorino.kuadrant.io \"666401b9a0a5e1174cfa0c4681f3f1927b5a7d40e7f71a3d91b9330f99d22df3\" not found"}
{"level":"error","ts":"2026-11-02T22:15:01.035Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/5043aba91ea1e86ef28102e0a12fd8f6b74696726ac04dff8c09aade1111d349","error":"authconfigs.authorino.kuadrant.io \"5043aba91ea1e86ef28102e0a12fd8f6b74696726ac04dff8c09aade1111d349\" not found"}
{"level":"error","ts":"2026-11-02T22:15:01.090Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/d112a51a2dc86d1904013d6a9998063da84fcd6e462e3ba745f5e38f6e3f1abb","error":"authconfigs.authorino.kuadrant.io \"d112a51a2dc86d1904013d6a9998063da84fcd6e462e3ba745f5e38f6e3f1abb\" not found"}
{"level":"error","ts":"2026-11-02T22:15:01.144Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/db9e5c8d358afec43a74ebbd7828b9ef49b8dd0495a0fd503f63046556a95841","error":"authconfigs.authorino.kuadrant.io \"db9e5c8d358afec43a74ebbd7828b9ef49b8dd0495a0fd503f63046556a95841\" not found"}
{"level":"error","ts":"2026-11-02T22:15:01.572Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-inf-a-72f279","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"name":"kuadrant-e2e-inf-a-72f279","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-inf-a-72f279","uid":"86de6054-b8a7-44bd-8811-8891ead01c05"}]},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d46c84d7a4f4c67d985c060ac96365bc2296efc839ca0a629e15b7917ed34608\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-72f279-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__987a0ef3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-72f279\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-72f279\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__987a0ef3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-72f279\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-72f279\"]}],\"name\":\"2f35b1d99cb61ef64c107e3f19796b6a9f58eee44e66b79d5a3e24603d381eaf\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3aa6865734f6d5a5b3ecb6aed2ade9be1ebe9bf0728be6a4dbd30330dd94c219\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-72f279-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__987a0ef3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-72f279\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-72f279\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__987a0ef3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-72f279\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-72f279\"]}],\"name\":\"2107ec2f5bcb0e0e738cdb1373968cba1d279cb001eedb47577c153689341943\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0f045ee5bcfa76fccf818707f08da70f7997e3dcab44861f8ba72f46c548cff9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-72f279-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__987a0ef3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-72f279\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-72f279\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__987a0ef3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-72f279\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-72f279\"]}],\"name\":\"58d9a4fb8357e92a18850e0917e2406fd816a095e81df7fde244417d72bf2396\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0d147fe9313680b4fb1ff5f05bc428e0537ac4c25eb847ccd92a30558d2f6628\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-72f279-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__987a0ef3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-72f279\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-72f279\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__987a0ef3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-72f279\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-72f279\"]}],\"name\":\"8f9fbdb5203f036f10b7dbcf4541dc4f20d71f3b5d6d12178bded63408d6d803\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e03cb0845f90d6a18a9a9657441002b5cfe4f1a82ed60e1371a433c17c76081d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-72f279-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__987a0ef3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-72f279\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-72f279\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__987a0ef3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-72f279\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-72f279\"]}],\"name\":\"c6babb411e2a46a44730d520b548ab3ead367f0af975d89c8d1e22dc4c329860\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f3255b398183380b1af1af7896d3f2108a40b397fc7d7f1fbbfa7f2d210dcdce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-72f279-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__987a0ef3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-72f279\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-72f279\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__987a0ef3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-72f279\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-72f279\"]}],\"name\":\"59f52e68f31d47fd310c157b8cfc1793a66cc25b56a1c031a91f79f5a5d69fdc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-inf-a-72f279"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-e2e-inf-a-72f279\" already exists"}
{"level":"error","ts":"2026-11-02T22:15:01.995Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to delete envoyfilter object","gateway":"openshift-ingress/e2e-shared-b-w1-5ddbd0","envoyfilter":"openshift-ingress/kuadrant-e2e-shared-b-w1-5ddbd0","error":"envoyfilters.networking.istio.io \"kuadrant-e2e-shared-b-w1-5ddbd0\" not found"}
{"level":"error","ts":"2026-11-02T22:15:02.114Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w3-f51151","namespace":"e2e-models-e2e-worker-w3-f51151","uid":"e3340067-224a-43ad-8020-ca9e00ead152","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w3-f51151\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:15:02.172Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-a-w3-97995b","namespace":"openshift-ingress","uid":"9405e4ea-22ff-4c46-bbc0-f492e0e403dc","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-a-w3-97995b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:15:02.172Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-inf-a-72f279-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-inf-a-72f279-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:15:02.230Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w4-d6cb38","namespace":"e2e-models-e2e-worker-w4-d6cb38","uid":"486176e6-7786-40c4-9ce0-6f4a68b408b2","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w4-d6cb38\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:15:02.288Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-inf-a-4585ee","namespace":"openshift-ingress","uid":"2ccd9fc0-9408-42db-adf7-7a2445d16889","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-inf-a-4585ee\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:15:02.347Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-b-w0-0f0874","namespace":"openshift-ingress","uid":"8b4ec7cb-daa9-467a-b2f6-528aa3d837fc","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-b-w0-0f0874\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:15:02.405Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w1-5f765a","namespace":"e2e-models-e2e-worker-w1-5f765a","uid":"9c852546-ee7c-4e72-855c-111315f7bf82","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w1-5f765a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:15:02.464Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w3-f51151","namespace":"e2e-models-e2e-worker-w3-f51151","uid":"c78aa03a-e3ca-4797-8a09-ab0d9cd88148","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w3-f51151\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:15:02.520Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-b-w1-5ddbd0","namespace":"openshift-ingress","uid":"28ff41cd-229b-42ef-814d-297087985e9f","error":"tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-b-w1-5ddbd0\" not found"}
{"level":"error","ts":"2026-11-02T22:15:02.581Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w2-6fa533","namespace":"e2e-models-e2e-worker-w2-6fa533","uid":"2ff73667-c2c3-4579-9503-b6ca098f1021","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w2-6fa533\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:15:02.639Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-b-w4-58ca7f","namespace":"openshift-ingress","uid":"5187151d-dfe9-40c2-b03b-5e9a20a0d12c","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-b-w4-58ca7f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:15:02.697Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w4-d6cb38","namespace":"e2e-models-e2e-worker-w4-d6cb38","uid":"0d3ebd35-5005-4ee4-a055-ff95546e3673","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w4-d6cb38\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:15:02.756Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-simulated-simulated-premium","namespace":"llm","uid":"447993be-3c57-4e68-8ffa-6fc998a39c77","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-simulated-simulated-premium\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:15:02.814Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-inf-a-72f279","namespace":"openshift-ingress","uid":"adee33c2-f36f-4299-8573-4943c3d76145","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-inf-a-72f279\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:15:02.872Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-facebook-opt-125m-simulated","namespace":"llm","uid":"da8edb1a-ed61-454d-939f-fc7cd235d9fb","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-facebook-opt-125m-simulated\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:15:02.991Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-b-w3-a1d751","namespace":"openshift-ingress","uid":"2c7a0593-2f35-427a-b6f0-958582546c18","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-b-w3-a1d751\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:15:03.009Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-b-w1-5ddbd0-maas-auth","namespace":"openshift-ingress","error":"authpolicies.kuadrant.io \"e2e-shared-b-w1-5ddbd0-maas-auth\" not found"}
{"level":"error","ts":"2026-11-02T22:15:03.053Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w2-6fa533","namespace":"e2e-models-e2e-worker-w2-6fa533","uid":"3a128bb2-de88-49aa-ab9e-c8626107a077","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w2-6fa533\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:15:03.111Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-inf-a-065be7","namespace":"openshift-ingress","uid":"9e44ac8d-dd4e-48be-a732-2441d104f322","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-inf-a-065be7\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:15:03.227Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w0-0c9014","namespace":"e2e-models-e2e-worker-w0-0c9014","uid":"dcb5a0e4-7049-4ddc-91de-e14d55b09789","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w0-0c9014\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:15:03.352Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-b-w2-c7e71f","namespace":"openshift-ingress","uid":"6decd2e5-6aa1-451b-97e5-5dd8911def76","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-b-w2-c7e71f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:15:03.409Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w0-0c9014","namespace":"e2e-models-e2e-worker-w0-0c9014","uid":"4f647df6-1d5b-433b-b4fc-1279ff1755f7","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w0-0c9014\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:15:03.588Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w1-5f765a","namespace":"e2e-models-e2e-worker-w1-5f765a","uid":"7188eadc-9748-4be8-a5e2-d904cf5b6130","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w1-5f765a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:15:03.648Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-a-w2-06e461","namespace":"openshift-ingress","uid":"c459fc7a-4e41-4226-a9ad-15cf3c29611a","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-a-w2-06e461\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:15:03.706Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-a-w4-7cde84","namespace":"openshift-ingress","uid":"83e46bfa-f121-4136-adc9-a9e6690edeab","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-a-w4-7cde84\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:15:03.764Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-a-w0-6e535d","namespace":"openshift-ingress","uid":"0eae774a-4032-4461-b2be-6f3edd911a80","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-a-w0-6e535d\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:15:03.764Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T22:15:03.764Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T22:15:04.048Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-extmod-a-d6b384","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-extmod-a-d6b384\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:15:04.230Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-inf-a-72f279","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-inf-a-72f279\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:15:04.331Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"maas-api-route-e2e-inf-a-72f279","namespace":"odh-ai-gateway-infra","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"maas-api-route-e2e-inf-a-72f279\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:15:04.697Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-b-w1-5ddbd0","error":"gateways.gateway.networking.k8s.io \"e2e-shared-b-w1-5ddbd0\" not found"}
{"level":"info","ts":"2026-11-02T22:15:12.173Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway","EnvoyFilter","AuthPolicy","TokenRateLimitPolicy","AuthConfig","Kuadrant","ConfigMap","Limitador","HTTPRoute"],"eventTypes":{"create":13,"delete":12,"update":30}}
{"level":"info","ts":"2026-11-02T22:15:12.478Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:15:12.498Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T22:15:15.846Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T22:15:15.956Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:15:16.053Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T22:15:16.224Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:15:16.224Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T22:15:19.655Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:15:19.655Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:15:19.662Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T22:15:19.668Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:15:19.678Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:15:19.679Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T22:15:19.829Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T22:15:20Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-inf-a-065be7","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-a-065be7","reconcileID":"6ff9293e-ca5a-455d-815e-209550c7b388","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-inf-a-065be7","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T22:15:20Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-a-065be7","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T22:15:20Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T22:15:20Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-11-02T22:15:20Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T22:15:20Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-11-02T22:15:20Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-inf-a-065be7","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-a-065be7","reconcileID":"6ff9293e-ca5a-455d-815e-209550c7b388","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-inf-a-065be7","namespace":"openshift-ingress"}
{"level":"error","ts":"2026-11-02T22:15:20Z","logger":"telemetry-policy-extension-controller","msg":"Reconciler error","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-inf-a-065be7","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-a-065be7","reconcileID":"0a976bcf-f1b5-4bae-afcc-53035bc95d7f","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-inf-a-065be7\" not found","stacktrace":"sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:353\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-02T22:15:20Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-a-065be7","event":"DELETE"}
{"level":"info","ts":"2026-11-02T22:15:20Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-02T22:15:20Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-inf-a-065be7\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-02T22:15:20Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"error","ts":"2026-11-02T22:15:22.349Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-inf-a-065be7","namespace":"openshift-ingress","uid":"9e44ac8d-dd4e-48be-a732-2441d104f322","error":"tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-inf-a-065be7\" not found"}
{"level":"info","ts":"2026-11-02T22:15:23.434Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T22:15:23.434Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T22:15:23.882Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-inf-a-065be7","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-inf-a-065be7\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:15:34.852Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","AuthPolicy","EnvoyFilter","Kuadrant","Limitador","ConfigMap","HTTPRoute","TokenRateLimitPolicy","Gateway"],"eventTypes":{"create":9,"delete":7,"update":9}}
{"level":"info","ts":"2026-11-02T22:15:35.306Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:15:35.315Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T22:15:38.568Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T22:15:38.828Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T22:15:38.970Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:15:38.970Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T22:15:39.261Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:15:42.466Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:15:42.471Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:15:42.478Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T22:15:42.478Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:15:42.478Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T22:15:42.481Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-11-02T22:15:42.698Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:15:42.698Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T22:15:52.281Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T22:15:52.281Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T22:15:53.945Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthPolicy","TokenRateLimitPolicy"],"eventTypes":{"update":2}}
{"level":"info","ts":"2026-11-02T22:15:59.264Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:15:59.264Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:15:59.274Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T22:15:59.287Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:15:59.287Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-02T22:15:59.379Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route#rule-2"},"creationTimestamp":"2026-11-02T21:16:03Z","generation":6,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:10:35Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:10:43Z"}],"name":"5c6918972d1a7f8ad5201880b7d6d9c1191ca1f25376682f691def7868e3fd02","namespace":"kuadrant-system","resourceVersion":"106293","uid":"11d8aa0d-8ddd-4892-858b-e95eb780085e"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["5c6918972d1a7f8ad5201880b7d6d9c1191ca1f25376682f691def7868e3fd02"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:10:43Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:10:43Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["5c6918972d1a7f8ad5201880b7d6d9c1191ca1f25376682f691def7868e3fd02"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"5c6918972d1a7f8ad5201880b7d6d9c1191ca1f25376682f691def7868e3fd02\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:15:59.387Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:15:59.387Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T22:15:59.444Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-02T21:18:39Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:10:38Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:10:41Z"}],"name":"3386c5e86c72abcdab369776ccd7182024ab8681cbe497e81724868f101a3c0c","namespace":"kuadrant-system","resourceVersion":"106173","uid":"f21d9629-8bf6-47f9-85be-817ee7208229"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["3386c5e86c72abcdab369776ccd7182024ab8681cbe497e81724868f101a3c0c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:09:55Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:09:55Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["3386c5e86c72abcdab369776ccd7182024ab8681cbe497e81724868f101a3c0c"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"3386c5e86c72abcdab369776ccd7182024ab8681cbe497e81724868f101a3c0c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:15:59.537Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route#rule-4"},"creationTimestamp":"2026-11-02T21:16:03Z","generation":6,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:10:38Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:10:41Z"}],"name":"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e","namespace":"kuadrant-system","resourceVersion":"106203","uid":"92701ca2-3dfa-402d-8b2c-3e09ecb2ea11"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:09:53Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:09:53Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:15:59.626Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-02T21:18:21Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:10:41Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:10:46Z"}],"name":"bf65ad13397c94660867eb0205e06d1c9bebda4b019f632c0d0b8ef989930381","namespace":"kuadrant-system","resourceVersion":"106410","uid":"93912093-eaa2-4499-99a2-d89aa4b8d80d"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["bf65ad13397c94660867eb0205e06d1c9bebda4b019f632c0d0b8ef989930381"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:18:21Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:18:21Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["bf65ad13397c94660867eb0205e06d1c9bebda4b019f632c0d0b8ef989930381"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"bf65ad13397c94660867eb0205e06d1c9bebda4b019f632c0d0b8ef989930381\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:15:59.687Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route#rule-5"},"creationTimestamp":"2026-11-02T21:16:03Z","generation":6,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:10:41Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:10:48Z"}],"name":"a82769ff87473da04c27497e160e9b4b1a5dd93578e0cf2342be8b2f06845269","namespace":"kuadrant-system","resourceVersion":"106514","uid":"39cbf22a-c6ff-4ae7-8f94-107ee05355b1"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a82769ff87473da04c27497e160e9b4b1a5dd93578e0cf2342be8b2f06845269"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:10:48Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:10:48Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["a82769ff87473da04c27497e160e9b4b1a5dd93578e0cf2342be8b2f06845269"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a82769ff87473da04c27497e160e9b4b1a5dd93578e0cf2342be8b2f06845269\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:15:59.748Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-02T21:18:39Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:10:35Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:10:36Z"}],"name":"68502d1c1143a647ad56f2759ea89a4c5b3c74a8054739f7e7ea9ba6535e3b74","namespace":"kuadrant-system","resourceVersion":"105888","uid":"63709ab4-6be0-4e14-9268-69177159cc65"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["68502d1c1143a647ad56f2759ea89a4c5b3c74a8054739f7e7ea9ba6535e3b74"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:09:54Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:09:54Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["68502d1c1143a647ad56f2759ea89a4c5b3c74a8054739f7e7ea9ba6535e3b74"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"68502d1c1143a647ad56f2759ea89a4c5b3c74a8054739f7e7ea9ba6535e3b74\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:15:59.812Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-02T21:18:39Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:10:41Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:10:48Z"}],"name":"dc061bec60bd28b1c132bf30965b4810124429576337bcc4a6030617600d1714","namespace":"kuadrant-system","resourceVersion":"106528","uid":"5f74c226-33a3-4e04-adc3-a29cc8c718dd"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["dc061bec60bd28b1c132bf30965b4810124429576337bcc4a6030617600d1714"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:10:48Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:10:48Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["dc061bec60bd28b1c132bf30965b4810124429576337bcc4a6030617600d1714"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"dc061bec60bd28b1c132bf30965b4810124429576337bcc4a6030617600d1714\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:15:59.873Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-02T21:18:21Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:10:39Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:10:43Z"}],"name":"8d5571efc1d304f5bcfc2ffb4ac6819154ba5556c29ce33416d460b887427984","namespace":"kuadrant-system","resourceVersion":"106269","uid":"3149db6f-9137-40bb-ac0a-71328c3f9cee"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["8d5571efc1d304f5bcfc2ffb4ac6819154ba5556c29ce33416d460b887427984"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:18:22Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:18:22Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["8d5571efc1d304f5bcfc2ffb4ac6819154ba5556c29ce33416d460b887427984"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"8d5571efc1d304f5bcfc2ffb4ac6819154ba5556c29ce33416d460b887427984\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:15:59.935Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-02T21:18:38Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:10:38Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:10:41Z"}],"name":"5e4821ff903ad6ca2e1c42162432e34d8b0a2a78052961e753d36b742193432f","namespace":"kuadrant-system","resourceVersion":"106183","uid":"da957b52-9188-4192-a0f2-de72febcdd38"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["5e4821ff903ad6ca2e1c42162432e34d8b0a2a78052961e753d36b742193432f"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:19:19Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:19:19Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["5e4821ff903ad6ca2e1c42162432e34d8b0a2a78052961e753d36b742193432f"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"5e4821ff903ad6ca2e1c42162432e34d8b0a2a78052961e753d36b742193432f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:15:59.996Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-02T21:18:21Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:10:38Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:10:41Z"}],"name":"028a8b5bd5d4e690eebb2f20c5fd47cf0b3c6e2a3619ba9e55322bbca7b94cc3","namespace":"kuadrant-system","resourceVersion":"106199","uid":"9dc62010-cc65-401d-a4ad-ffc9902aab1a"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["028a8b5bd5d4e690eebb2f20c5fd47cf0b3c6e2a3619ba9e55322bbca7b94cc3"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:18:21Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:18:21Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["028a8b5bd5d4e690eebb2f20c5fd47cf0b3c6e2a3619ba9e55322bbca7b94cc3"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"028a8b5bd5d4e690eebb2f20c5fd47cf0b3c6e2a3619ba9e55322bbca7b94cc3\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:16:00.058Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-02T21:18:48Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:10:42Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:10:48Z"}],"name":"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c","namespace":"kuadrant-system","resourceVersion":"106530","uid":"bc14a61f-9404-4823-8949-3cba93b62894"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:10:48Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:10:48Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:16:00.121Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-02T21:18:21Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:10:40Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:10:44Z"}],"name":"4d18a96899c43d55ee63d2ae1a7a938c7e873d88b2fd95f06b2e3aae2c7f1c84","namespace":"kuadrant-system","resourceVersion":"106311","uid":"14a6542f-adae-4641-b133-a36e1c22c289"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["4d18a96899c43d55ee63d2ae1a7a938c7e873d88b2fd95f06b2e3aae2c7f1c84"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:09:49Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:09:49Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["4d18a96899c43d55ee63d2ae1a7a938c7e873d88b2fd95f06b2e3aae2c7f1c84"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"4d18a96899c43d55ee63d2ae1a7a938c7e873d88b2fd95f06b2e3aae2c7f1c84\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:16:00.182Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-02T21:18:31Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:10:39Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:10:44Z"}],"name":"7c924aa2b37ea38067b4e69052d541ea2e7c86fbdaa79b19f9ea09e87adbe4ff","namespace":"kuadrant-system","resourceVersion":"106299","uid":"70f5f392-3df1-43dd-b512-1367e63f2541"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["7c924aa2b37ea38067b4e69052d541ea2e7c86fbdaa79b19f9ea09e87adbe4ff"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:36:34Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:36:34Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["7c924aa2b37ea38067b4e69052d541ea2e7c86fbdaa79b19f9ea09e87adbe4ff"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"7c924aa2b37ea38067b4e69052d541ea2e7c86fbdaa79b19f9ea09e87adbe4ff\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:16:00.244Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-02T21:18:31Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:10:37Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:10:40Z"}],"name":"d303c788902ad4467c7ae545d65cbef45564d1c0d56396c93057df3909461aa1","namespace":"kuadrant-system","resourceVersion":"106136","uid":"7521f93f-4074-4748-8dfc-7b8329156ff3"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d303c788902ad4467c7ae545d65cbef45564d1c0d56396c93057df3909461aa1"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:34:11Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:34:11Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["d303c788902ad4467c7ae545d65cbef45564d1c0d56396c93057df3909461aa1"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"d303c788902ad4467c7ae545d65cbef45564d1c0d56396c93057df3909461aa1\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:16:00.307Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-02T21:18:31Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:10:34Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:10:34Z"}],"name":"0e042276580ed8976d8ad3afd87a71640025c28b9b48f5c88eb159ec9998209f","namespace":"kuadrant-system","resourceVersion":"105823","uid":"107c286d-68a8-4f57-846f-aa2ab62e698d"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["0e042276580ed8976d8ad3afd87a71640025c28b9b48f5c88eb159ec9998209f"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:18:31Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:18:31Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["0e042276580ed8976d8ad3afd87a71640025c28b9b48f5c88eb159ec9998209f"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"0e042276580ed8976d8ad3afd87a71640025c28b9b48f5c88eb159ec9998209f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:16:00.368Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-2-simulated-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-2-simulated-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-02T21:18:16Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:10:39Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:10:43Z"}],"name":"98ec9d74d07c88c1e6923ed1cbafd4c5b41bf1763b3a942282f964f72425ae57","namespace":"kuadrant-system","resourceVersion":"106259","uid":"e4861f95-ed6a-4e9b-a90e-286b8b37cd64"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["98ec9d74d07c88c1e6923ed1cbafd4c5b41bf1763b3a942282f964f72425ae57"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:19:19Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:19:19Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["98ec9d74d07c88c1e6923ed1cbafd4c5b41bf1763b3a942282f964f72425ae57"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"98ec9d74d07c88c1e6923ed1cbafd4c5b41bf1763b3a942282f964f72425ae57\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:16:00.531Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-embedding-simulated-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-embedding-simulated-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-02T21:18:27Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:10:40Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:10:44Z"}],"name":"eaeb360b41b3f9e0bd6b247d4dae3eef1ffc3355d6e9408df3f8f71bc7f033b5","namespace":"kuadrant-system","resourceVersion":"106348","uid":"81b7d841-b540-4e73-8c65-7c4e6612cbf9"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["eaeb360b41b3f9e0bd6b247d4dae3eef1ffc3355d6e9408df3f8f71bc7f033b5"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:18:27Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:18:27Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["eaeb360b41b3f9e0bd6b247d4dae3eef1ffc3355d6e9408df3f8f71bc7f033b5"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"eaeb360b41b3f9e0bd6b247d4dae3eef1ffc3355d6e9408df3f8f71bc7f033b5\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:16:00.593Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-02T21:18:40Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:10:37Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:10:41Z"}],"name":"d752a44ad8df3a50b5a1147110eb89039ed764e1fed197b1f77e0935c424a90b","namespace":"kuadrant-system","resourceVersion":"106161","uid":"ae9a13fe-d5e8-4fc6-b4ac-3d2d16f6c78b"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d752a44ad8df3a50b5a1147110eb89039ed764e1fed197b1f77e0935c424a90b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:36:31Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:36:31Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["d752a44ad8df3a50b5a1147110eb89039ed764e1fed197b1f77e0935c424a90b"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"d752a44ad8df3a50b5a1147110eb89039ed764e1fed197b1f77e0935c424a90b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:16:00.593Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/maas-default-gateway","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T21:16:03Z","generation":20,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"371b36ef-c4b7-499a-87db-1bdf4e8f92de\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:10:35Z"}],"name":"kuadrant-maas-default-gateway","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"maas-default-gateway","uid":"371b36ef-c4b7-499a-87db-1bdf4e8f92de"}],"resourceVersion":"105840","uid":"86b5bad7-2bb7-41c9-b2c7-bb4c8f13292a"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"61b044087f8d56658ae99d15d4fab3cf1ad74e6636795c133e054a5aace0540d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e511d90f2140d9cde0b2100a0a488dacadd8f510bb901601d5e6fd25343a0f1c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"1e42d143d6033a677e2aa0de97c78600094e515d7c0d3f86b4925ef8be636163\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"26b7799af8a40e8b9585c255ec018a63b0074c27282d4dccebed45f14e703b5e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"ce74c295ef1588342c7308478a1dc6f6aa2cefc063e489a124e536ac32ecfdba\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"fbe95a07558afcf05ef68ff5beb293f527d6ab93dfe79956b5406dc463d78363\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"65f916a3e7ab9584\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"65f916a3e7ab9584\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"40a29ce438b5ca497e4389ce52025a9b91c0cf3177b1bd5c8519b041cfdcf75f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"845137604829fbc62550504d7bbe5ae8d55ea1cf474160cd789a72e811000e4b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5322619ef71b1d1ea3204f9014d0341d4402275b6ca23fca69d61cfc9a61e883\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"16b86e50920afda06ca195a717436238f5fca7f2e1bbe0939875bcb7d559cf31\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5da9070dfa3a5637213b5443376170dda26f57f381af542891ff3b19cc7a9d06\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"00ac1aeee65e93fab2ccfd89c11167f4d954e1cfb3e8b09ad3371a4fab4b6369\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"55c23b9552cb66c175ed2202220df6480eae89be2cda2e925458acf31c5bdbce\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"99f16470bd82ba57465b128d1c0fe73ef189001d77c6ead3fc34c98ad3ce27a2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"65f916a3e7ab9584\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"65f916a3e7ab9584\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"a6d134df42d4d90d93840f63dc770cadabd22dc22af01f991b6c067e96733c95\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"0be74a5083c4760789001949965ce7020664f6347b769f9f20735f95f9d34989\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4902f5a84509d49ec2fb75275af9692b524b1334f7c919eff1d9f33957acd5c4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4f0e9d14c4d1857d5415458306310b00d6a94ce68179c717917d13d30ede9b87\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"29d1c55f30b76c66bfb15588c297271fac7d5e9ca415f0c938d63e524a8187e5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"df729ecdaa88f0abfee16b94ea7be9c5aa7ccdfe91fbe0676e22ca4bfae35f29\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"69baf76a5f2e8f4f8d3e40025586b942794274a22455dc40e0b7c0116f0d2297\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"8199294e302361a6898546d62809d67d522e9c2b375c8b8727f0d966f7ad4d39\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"65f916a3e7ab9584\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"65f916a3e7ab9584\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"61ef91ec2e76cc107813a7351d7e38bb32d1ebbff452efa771b01f8a512fb99e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"f2d9c20918355999f92bc489c836e0d17ed8acb713739da4b73fc8ee019fc8a4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"c19d17a63dc280a83fa4dce8ef0f825a16118c6817d3126d095473335018edd0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"05aa8311318e9111c5925f4be454406e209ab832bc6e8ddf01725ebe4f1ffdcc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e680857c19914d59f115788ea93836704a1ddab04f5e495bf863d62ad8a5aa8e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"96b761d418352e3f8d172aa80bfb5542df670414bec97704e615f2e3e665c8aa\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4a199d441e37ffe8d62509ae7048cfd055df0de5619e9be81a8f47f9a64a7051\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"f17cbb57db714a7faf03a7e4ef3921069096709486e13c6b84b4b75ded84ca96\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"65f916a3e7ab9584\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"65f916a3e7ab9584\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"d8631ed26c63871d1138b31e9c971d72ad1152273309b27ee33862700ff4fb0c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"67a5fec0fb2398a03579a732c5e4640c9f9c5db5385b91db90ffb49522369904\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e5b5be5a42ead835fa1a13840fda21cf5afb14b8226da9a3008a321db777f685\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"a01c6bf1aa626b04ec6a9fc85abb6ced9b4a9c4cafe81d2176013cf3b0b4c4aa\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"0eb9568cf0385cf054d8f3ebcce089d8b225a9fe1b6061e3689f7bd26415f872\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"633e4cdca29207ccc8220565a86635db5bf3f227ef564ee1a0da6a5d6076231e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"ecaead2c94524df89be70a7c961f93dee41ef96545655d22914542a89dffe341\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b9f3d06eb6a92218fa1757dab6cb8e66e42102d46c94e6c0db854f694d6d855c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"65f916a3e7ab9584\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"65f916a3e7ab9584\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"7054423a069def7a36dcb993faa1143223d985021782b2552d55a522caf2eba9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"deac1d64e5b84f2fc26848a49153d512090eb1e2bffb72dd7091fd21a1234e18\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"3dbcd4467449162cad999d40988202fafebe535215351d004f1bf05937c76508\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"534f6056dec477fad33defb3049c84dc5497dacd9f6e3f2061b13ba089ed1cbd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"fa823b540319ebed6b9b488f79dda81b66933f7e616cfdaebe3543ae31b33b13\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"fb6ca2eee2169356e662d36e92b2b679a1235a86d976f9807297ad56386f6e2a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"0427c8054235bfb15b63a5a467ab470ce1cca867b5a232117e73059a4ec8891c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4aa2417057e81c2889811e45d786ab1591e3dfafc889b838aad26a3ec2cbfe9b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"acb4b8def068bc86711642e3242fd621a66a54452bf86a82586fc6bf69e8192b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"66831c252eeacbf3e19995c48be4a005b1726766550076c58cb47b979bece639\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"a80090acc18b7b092f5e9f2d49fd8643f16514df89a716f8f69afe4a7afebb76\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"f85e753996f9e90384b461c5504814ca0cada63ea0f44d6630a619ab36edbe08\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b72a3d2d64d0ddc05f076a7fcf59d924552b45080846c09e1084e67867a76e9c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"cd58d9e2c4a744adbc8ab336cd016f27bc1f14a1de2e975afa26b7f5113d1bfe\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"65f916a3e7ab9584\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"65f916a3e7ab9584\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"29c80f1787fdadd41eb24cbda56972d49e35d261e06b4f4fcd5851c7e2de3068\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"65f916a3e7ab9584\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"65f916a3e7ab9584\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"277489d8f3c2c5149e18b965c81958774efa7e81299a66265853d6af2e16037b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"7c211141c74fe1e91cc494ac860a81616dc49e2a5d1951dc70bf0f42824d53e5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"17df13edb14ef5c49ef0cc29deaea97728695c57b5ccad8feb2b23589083e083\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"014f0c5a15872002db778e7e40dfcf7dede4ab2db05bb6a08641f5d523cb3afc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"bdac37244e7b891cd2973e74c7b0db5110c344505a09a86e51fc6486ba35139d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"ea8a88726b68ceff7de514d89e12df024a67856b697e02c26b6e762395fdaf0d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"81df9bef1abee093a91a2eaab4b1a53122eb16d4150f27c879439ca5d99112f3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b3be2474c46178c0c39839b29d8d7c87b103574b042bb23175ac0e9786fde158\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"13fe2d56bb22ec9a1307da7bad05cdda8724fe788533352aa581ffdc96874c78\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"65f916a3e7ab9584\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"65f916a3e7ab9584\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"fbd262e90a5eaaf98d72db889488cbe13bdac9381f78343ea46c402679569fb2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"9794c132b0cd770efeb9723db862265df6a3584117821e44e2a5660a971c59eb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7def4ca304ff3869be64c2c02523fd9d2ff43465099dcd1124399f293eb4480f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"a86375603000eab9b808785894e0e63f3e53024a46681e97c41a06c4e0c67023\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"54eea38241838159e47386cb814ad20fc30631ee8c42d57f0ff8da80fbbf62a0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"d5b69938a04a8020c8a8d10df4921f2989326ca4811c3843a7201bdb1d5cb848\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-unconfigured-model/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c5a685f2a5ebdef5f1dee488990c0798a45ddce399cf99e7d0c505a5f46c69ac\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"0fcfc87f76b773c6a38375e46d76e569a372370e3ae2e7003932ed8ef776f5bd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fac07f302f653115fda3d376325a268abaf66025ed0e4af73e88bea3f41fe933\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"aa28eac51fc5e37c385a11a534759b09fb7998ba74bb01195dd8ff89d9e9ec43\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model-2/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"06165835c4461c0b16a2bc5bae936aff3c2f351edbef8aa378f1110874acedfc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"17390f436804c5d305f1dcb9ea78a72032310736cf630bb9589448f605bd1fd6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m-premium/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ad8714d3b8aed2a9ffd68fbcf0288557e9c1c059c1b59ad3e9a09910b37fd61b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"c4353817d988db43a8dd6b0d5c29305f9dcda76e19c9ef2c820808b0384a0bf4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-embedding-model/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"726a74c13fee356e859d9317271facbb60b066acbc5571de22d056f13c60878f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"1415e0d2aa117656e44a7d6aeaaf16aa87f18bdeee129f7e6757b2e1c7f996d3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-trlp-test-model/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cad6ab5a81a65fd4cb03a0fefdab5de82aa18c30a5b95078b1d05214b0606f40\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"0629facd48a81e3c82281be4a3f8566f55e61d1a30a8516b23bbb63c58e8f6f8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e5f81c7f7812462ebef000c68dc043013159f22201d2eeecf05c220e809f96ed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"2e292ccc99f990aa723c04a99267923f5b62fb8f3e0ab1a978e8334b9397ada0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-unconfigured-model/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"68502d1c1143a647ad56f2759ea89a4c5b3c74a8054739f7e7ea9ba6535e3b74\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"2b69b629cb2b5224adc61a8925f43333ba0b52ab39260c124057e9e82898937f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"74b47f1aa1203aad58596cbaab10ae46e8fddd08ac49eb57a26bdba532d88e72\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"d1e427bebfc099de9df176c73ee76d5dbd6f77919e840913d3a10818678c7394\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model-2/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3167d3bf853032a93e8569019dcd3e5aa33af9cb580cf9ca138990567fc9d857\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"482d2a79771eafe7f8d177701f43a13c6c4916251440ca00830042e050247443\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-unconfigured-model/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"99606c4eac496429be47144db9f3f48867815df12eb99d7be8073b767d7e44de\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"e635ba9dc59ae1e09b34ee6e0f2718b1c31e6f6b6ff2bc6d05c094fedc42c40b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m-premium/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5d590119308c6f848b12dd3ecdfb1b06cc2fe172af702455c342075944a045ff\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"caf1a50009b65f25df3a996283d38ada17bb57a2ebed842a552f137f6121c63a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-embedding-model/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0e042276580ed8976d8ad3afd87a71640025c28b9b48f5c88eb159ec9998209f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e17697b7e023603155a06feebe0602591826e794ee2f5189abf795c259be1b37\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-trlp-test-model/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0829dbf2b5dc0900de272826295adf351de381b46fa6fba00b896213530780f6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"1e772a79f4b1660c75cf3493e21c9ddb58d2de640363115c57dac03a10f22c33\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cc1ffc2ee4e05618c28c108cac668c0c02eb8e658953439e47a733edab44a1a0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4fe1d1c6df78a26f30e2392ae9da7fc67b0845dfda48a89e247bee6aa536d8e1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-unconfigured-model/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"486615827938fa99814e929fe7dc62bc16f7563179fef855074eb73dc7ce4724\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"ee2f6a8baeba450552a3e168b9df1808bba4e2c59106ad0881ae78aee4fcbd40\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-echo-model/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"98ec9d74d07c88c1e6923ed1cbafd4c5b41bf1763b3a942282f964f72425ae57\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"653f23106eb8a10791805e2f9355c750c56aa6873ef311fe707e76083d93d55d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model-2/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2ddbced6f2f51d410743da1d9db1257d0006d99f38986dd7cc7efd26620791ad\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"1e776cd43733621e16ebc27c91dbdeea062f73e4dde2f494701c85a6843faeed\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d752a44ad8df3a50b5a1147110eb89039ed764e1fed197b1f77e0935c424a90b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"62f67bf9885222d9a86a95e02ed17ae26ad7cf71e15aae0a7517e647c29618ca\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3083301b5359be118f04faaefcd72fd127f2297a3374ef7231b59a59a31b405c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"e85460469045801c3e6927ab49333ff01612a4899d5a7c29ec27824b9942f3b9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m-premium/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"67c67ce733de50e7b3d797bb248036b01badfe02e958f5f76af05b58a504989c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"f9b414e31cae5d16cc1ad22ba2462b8816d9369a97316f40f32a6e7912fc4f78\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model-2/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2d4a2275e6cbab5c26d5c3cf2d75aa2776066390e5b66f5498b16b26bc596af7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e33110b3dae1dd80b2bfa573def0b488a6fd4f1243962fe81d58e1853ed2d3f5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-embedding-model/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"23672b974f0dbc05100a34c78d2b029e41f1d5a3752f3fcb52915f56db360e25\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"a6183db94e49e3ba0149a19f4e52ff19aebb55d6261b0cacec0656136bd2adf4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-trlp-test-model/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8274337fc3f0de48e5213819aeb4a46559c4f8b3428c1bae43c0d75207ef5264\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"65f916a3e7ab9584\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"65f916a3e7ab9584\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"efcdf81b8f74d74207beb897f447376d1f950ae12e8a330f1ae67b0d9dc6a545\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0e89fc4b75d3a5dd95fca2c4d8ae33c7826f05a8016c44eb39e28c3c1860fcfb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"7f0f599e497ae797f3b5922614ceddb3375c007237412d01b520bb7498ef288d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/premium-simulated-simulated-premium/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ab505bdf28287fe00099987c1bde2c2f297c40c792a7f6cb5fbfa5adc44754d3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"06c1aa31be81b1f5c6266514c955712865b30117291a39dd749994f4ce931145\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m-premium/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1704c6bc15d6f547acca888061680f2275f690cb79e5af6fee44747bcf278b95\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"6a8319194e2c2fc998268cdbab03a5aae2d83019f5ac30c316c4e548895b7c63\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"eaeb360b41b3f9e0bd6b247d4dae3eef1ffc3355d6e9408df3f8f71bc7f033b5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"32cfee4e66c307d5ebed6a406d2260f4374553d184b5486fc53cb64bc6ffcd8d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-embedding-model/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"135ffad9bbcd33779a0b9a1c0dc5d5f547356be21489762803640aca855c728a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"3194cef788c3fa9898599a57480aeaed07c6eac2edf957788235b37d22918588\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-trlp-test-model/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"17002b7f0c8e62582ad262d9c2b8b038ee7f2a9327fe34f21fd4f47134b7b8cf\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5acde2b886749c1c54f99db5c33887e6fc5ed0caf412daacfb5df0f329882c66\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a6a6232fd5656520e75d100c41add5f1637dde9705a4ec608bbb90b724c258a5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"37a71c27032e51fdbc7ca688064a47abb86230a8138af6eb55e8069fad975a93\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-echo-model/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"92917da87eaba4f2684cd45947a3698434b99ff4ca6d3ddde51d6573aecb1600\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b2b26e0af9ad7defb486e5d1db19af6bbdd0998559d16f3776651669aeb4d067\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-echo-model/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aa7038625b8f43b0c002f79637065e5ab90468f50f998759d08f2c4640c07c04\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"65f916a3e7ab9584\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"65f916a3e7ab9584\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"2a62f0614f6526bc3f195f838aebd1abe29514f2707db40d9ef738d645ccf001\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"de97dd5d45c6eb12b4a1112ed1f362d8544427428d2249a399e26ba069d6aadb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"22b2ec7ec96ee09c9e07a84cd3d313c2223af42433bbb28c5846401f64d5e3c1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/premium-simulated-simulated-premium/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"dc061bec60bd28b1c132bf30965b4810124429576337bcc4a6030617600d1714\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b188b939a496049e47b8ef664d7c7c490722f1753404a08d89ccec1dcb87b8fa\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-echo-model/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"75612d85af2bae456dadd78163b2d2f9015c0a0bf4e20bcb8a555e6a5ab3b8c0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"65f916a3e7ab9584\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"65f916a3e7ab9584\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"96bc4fc13cb63707a942ca33034f78d2b39476a10860398523789db3990584d1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a4493fc88328eba553ef36791fbf4706bffae04a1ac501d099b12309ebc85c6b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"d84e45c7a3e370ea510e8e0294e009b29bc2f2ea789c47559293007b6c4410d2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/premium-simulated-simulated-premium/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2d953f7313807988e63546aa32431d96f77e6989c672f8ab42827c1c21918630\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"65f916a3e7ab9584\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"65f916a3e7ab9584\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"dd2f15d9a08862ab664dadf9bf5da25828d327a11a07849fa919713f034c2b0d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/facebook-opt-125m-simulated/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d69b9c128f599c9ea1af84bb3e783ed71688baf6b3ad2b86f2b7183f9a4208b9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"65f916a3e7ab9584\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"65f916a3e7ab9584\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"4dfeb9ff2318af8f84e70b11545800bb83948c080a97ae1ece5780d4022bb383\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"dd89509e97b96670685602ae2d08749226db8693944d2c6f868af9d3e0a5feb5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"1025db78adc8b9c9592b692cc227b1a306a99ac5502300d9ed4ed7615f5e3ef8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/premium-simulated-simulated-premium/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3386c5e86c72abcdab369776ccd7182024ab8681cbe497e81724868f101a3c0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"58e90354179740b1af406b2911c9997f3f3283475aeb77ce7918f3b3239a293f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9e75e9fd02f51c2f043b145c5d6b82e95f1447b388ee529262aea27a6a2774ef\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b89d1075a79c93acaa097e4e6db4d6a4b23bf3ffe5e964409e29b258ed725a99\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-2-simulated/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0913a452a02695c6681f1037232199b40b64236fed4d29cdbb41561695826340\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5c0b495d1a10c1cf1548ef17998cb18c0ca25371ad42d5ffe1aed42bd55e31ad\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-unconfigured-facebook-opt-125m-simulated')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"010adf02b2e7deb40c572f4729b6dd4619847c8e6344137326b72df28772fc1a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"c04f8a7c7387e6794115c41161cb001d8a07340d2878cb8f36774a8f6a200ba4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"105cf4dd91a8abf4a93abd65b255521c3d37b560b5d23f3ec59757b5b362fae6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"7e7d1a0ec6d957a4d4de94f93078f10e836b23442c9cfa90f11c8520cca12e87\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-embedding-simulated/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"75fd86e2a4870af5fd78f2ad7aa2a9d79aff977b3678d81954b1e207a9315f2c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"c3cfc634a11046a837448628e2f17db0ed3466194da289a808544d874ecf6451\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-trlp-test-simulated/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"54cd0149b818480305f3d0024b3c95629cafb641b48195d003b2b7006d5c6bcd\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"f5bc618bde549671e84473b23ef3632426f8606e2045744a860c603f2a7675d3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bf65ad13397c94660867eb0205e06d1c9bebda4b019f632c0d0b8ef989930381\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"d8d67afd40f17474755bd3f6b00e265761bf5154febca129bc3f2b0bcd749c41\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-simulated/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f9fa9cfc2b4e701183573419a92c79384cd30210289602f0115c75c5029d55aa\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"ac2105eead12bb02dd7d1691cc77fc8a580b903f98564a8fd585dfa345dec1dd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"596921ddc7ba8523386263c5cffcbd6ad9b6a385318ed7e24f72be06f36fc398\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"f4ae34c5c82a0969651301a535f404653a60a5d75f20c7ea56ad9bb89b67e9fb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f95805f0e9b755664735d898c1d644d571943be553204d3f86136bc35719ff13\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"65f916a3e7ab9584\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"65f916a3e7ab9584\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"95c39f44eae69bd53f57e5ff93243887dafd591c9b8cf2e736f0ab034e67021d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/facebook-opt-125m-simulated/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8d5571efc1d304f5bcfc2ffb4ac6819154ba5556c29ce33416d460b887427984\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5d6b359055267732253f201a1fe48f0abe6d5e22b011c70e1cb006eea672f535\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e91aceffc2d4f6d6b120625bd3ca23781b74a1cae6cf1da26bda310bbed0ef07\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"65f916a3e7ab9584\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"65f916a3e7ab9584\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"c8475d27649a649c955538ff79eb001372050ff4f1d4ad295b01dc6fcc69ba2a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/facebook-opt-125m-simulated/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a402d1681ab35bace735c19b1d084a86eb3d741d4e1c14371cfdaa55d22c3ebe\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"7320c049419b863194fd55db5ebd887462dd24e1289e6308d79f047431f2bed9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-2-simulated/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f9b535aed6243496a67741936e53a0d303bea1b872a06fb62f1f9c27150edc40\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"65f916a3e7ab9584\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"65f916a3e7ab9584\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"5eeab80447ec6c71797517b4d94c6623353e89097743360eadd7f31115976dfe\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/facebook-opt-125m-simulated/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a9800464506c58f005016df354e160757732171ff4d19747202524955329b998\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4984a24eb707d1b965a79974a98ed4afc271f2ca356b150cbc8943de1ddcfef8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-embedding-simulated/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c82a1a3dc2ce54c0b664f79a2cd895a3c40f774b3694999badae8cedd328292e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"276f5d5d67b2bd83c05c2b39e4a262885498e6807e3129a866eff0651b3604a9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-trlp-test-simulated/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"669658556fba0f45c2a82def2f57614416614ddf154ed8dc5f4f9188f10130f2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"692f39321f892929348fe56801dc14c8a35eaf749609a3a5f4b5e684edddf17c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-2-simulated/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c4399a95e89654e5b2bb5fabe45bc947d11ccd1448ebf64c30b195b34f239d58\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5b273834f06c6341dd07bba6c809b3297ba2514e6d3b9b5d0f4f8211c68ccf8b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-simulated/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5e4821ff903ad6ca2e1c42162432e34d8b0a2a78052961e753d36b742193432f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"f35ed2fb168a3a608435006c8c1b103242765d7d37f41bf1dbdb7bbc0331da89\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a91faccafad197e2a4065ce3d12a052ac484d2e8fb2fc9265ee48f02b28e6dce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"fbfd0ada86117ffb0a134e591bf8b8390012983d25496ef188c6da73fef5eaec\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-2-simulated/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0020c64019ffd1a0bdcc75e6441e6a30e6d8bb08f463f67bd2408a1e82b95b2a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e78a4964c93ec23890e62f7f50201f5b832b4c714066a914dc734d8ef60e8213\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-embedding-simulated/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7c924aa2b37ea38067b4e69052d541ea2e7c86fbdaa79b19f9ea09e87adbe4ff\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"d5cf96eeeaa56bb891ea0cba28f7beabf17a8c0f061ea01c768ed842dd26334f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-trlp-test-simulated/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"028a8b5bd5d4e690eebb2f20c5fd47cf0b3c6e2a3619ba9e55322bbca7b94cc3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"8fe4100eab1f023f5b06dd8e19bcc80109b82503466d49576acc234cdda9bf0e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-simulated/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"80056c658070f49140955cb6eabdbd252857a614af6b0f2f2de7a1ab1cd47949\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"53aad0199369eb8c8f787ea099e93092089c04344e8f910dcff366f54bc831cb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-embedding-simulated/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2416d7b42d11a09d7152746be0e114f8fdc87d0fbd0efa9dec5b52b011082194\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e0cfec53d1f17771317082d9a7d69806ae3468971bac79a1135f2b0d51ecdc07\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-trlp-test-simulated/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"50c2058cf11e07a931b06ac4446a56eee86855f00badf26618abe486a7bdcfd7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"65f916a3e7ab9584\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"65f916a3e7ab9584\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"f3b6e6c38a521fae8ef5c7fddf3b3178baba88effb4e5338e0b387e28ecc468d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"134a7a790ba665547ca14f80f917549f66ee5063fc41096471c0778399db6dd5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"4ddd3fa1f54c642a57a48737e710ec0116705776084d8cebd8134dfa49accdde\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/premium-simulated-simulated-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4d18a96899c43d55ee63d2ae1a7a938c7e873d88b2fd95f06b2e3aae2c7f1c84\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"44e38055536c3f0d49cb81abb42bfefcf2c78faf963a6160afbe459bbc04db39\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-simulated/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8d34bd12ba2030284fcb69127f53b8158bbdd4a1432bfe619165b4c2c96cc061\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"c9dd9c233e43b53241ee27e937246e51b8f3331f30a7fba22640617c1b0bf47a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/echo-simulator/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"319e246831bdaf5e765e63d5511b516594fd2b64527850e2ddabd2a4a85532ea\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"7cfd2ed5cb8a5913fa5f55b92b02805c6778991c01c80eb14a0962cc710a56ff\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/echo-simulator/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a8c8220ad6f1387002e262ace5db78a2c4bb39e5953306702a228215174f6796\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"87e1712d02794c6d66ec1a932f02901d7a4369f46d0f041178cd3efadb7f59b7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/echo-simulator/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1e077a716d89a43572a3c16e8d0b0436816baa48a2ea227603701f10cad6d6f4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"65f916a3e7ab9584\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"65f916a3e7ab9584\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"ae9eac2a2b8c8311bb8c6ea82ab445a5d6f50d2d51c3f79962be9d82007097ad\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/facebook-opt-125m-simulated')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3f23315aacd6e16f4ab41f96aeedc9549d1abdfc9476577a47d45d12875dec5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"165d3b8e224f71685dee07aadd133117aeeed097eae99437d561d5bfa2d22233\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/echo-simulator/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6687eb3cec74c6c51428ce3f3d22d50ba269f59015d1bc8f185da49eb095534e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"05ac0e89d0298398d3996609d7c22b514bdf08bfa3787653bc739995c5942441\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-2-simulated')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bfd36c5ed73eb81df97258ffa1aa36d8cbf6f3e7a8096c33ca4ff417be59d002\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"d5ac583036f3821c88111dd82571eab1fc94aa4e9fcd045b27336f798e26075d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-embedding-simulated')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d303c788902ad4467c7ae545d65cbef45564d1c0d56396c93057df3909461aa1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4a6b0d84cc35c0f532405eea81056481fd54e7ad71284a97ce8f6a2424eac819\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-trlp-test-simulated')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2f53b030326b8e1f5908c601aecd3fffcb6d08a8337d0bdc53ee1fc699a4cd71\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5c3bcd9fb119b0fd45f3b4ba5de5f905cacbb4963fec309a0961a40f76a7a7a9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-simulated')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"94ddc5e77f082c32bebc7a36bcebf621518ebf303e83b9c540da1352d04e620b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"50057c9a2acf4ae7152e8c97f7778cb04340d1470974e5272422d0bf244a4e5c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/echo-simulator')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c6918972d1a7f8ad5201880b7d6d9c1191ca1f25376682f691def7868e3fd02\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"01cc37113b4d6c301e355f63decf46a21e93a023494bdfeaeed2890c97ec1f57\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a82769ff87473da04c27497e160e9b4b1a5dd93578e0cf2342be8b2f06845269\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e747b72d92315b743934153588614b27670cf0c9d9dc4fb380ea4965def7f235\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"06b05a8e4dd69bdc4f333ad9509ee8cad3c5c0f5dd48edbe94c1158b60f79ed3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"661962837510c6dc6d1faa64e61ec3086efa9e0a2e7315c6ded616c1879e5ba8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b4bfec1b33959dd0ebfc5cd6fb410688e820d4b55c7f149cb4acc4353f30a9b2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a7740f6e77d024a437502c023fb1d8939cb3cc2b9ed7f4073af7d779e19459eb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"f82564e076ea3e672592bab71e048537faba17a5e909884c2a0204e235905a69\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a908063c86927e6bf07b7d793aad9f277ac3c2a8f5f5d468b116cb9e07929b14\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"fbdfff5b213f506d78434055d011cf63d616653e502ee04408a43578986e1e5c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d1d232e06f90d479cd9b802f24889e83af58c51cf54ba273d5e24dcb8a297688\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b49f2d7e152d4de959577465d2494ee11771b4c439cb6eae71c90bff26224fb4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"810f299b76daf089b33c92cfbe0445ab5cc89a48d38e36df0cc89ed6cd1fe8df\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b27d6255cac73fc039120e157e1f3ce0e99e86995ac5a66974d5e8744df6c64d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4f800155f293f82eeaf5fd6a9553c0a1bee90f47a295bba8d7a04b3f11faea33\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b1ccc7ca46f6a14e90afe1dddfab8763f07f30549ce1cda0bae985581f063098\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ce7d381faee9ff949d68d825ffa1dcb9247dad19667ec59a8e91847320dacbe0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5d72fc7cc241ffd60d83142a900be014cc5d57320142e013493b21ecc86cb534\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6565c4085b3917d5390fe1b0194fb3d8319f1d56b45867e3c68ff740b5c16ef3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"be1ccea8a4cc19c7190600de6631fcb661b63db81e2862348a6ef4f90bf33fa3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8d8c8aae1332bb0300ac2d65be9b8708fbfde6d4b5599ec52380cf1f70956045\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"65f916a3e7ab9584\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"(auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" || auth.identity.selected_subscription_id == \\\"65f916a3e7ab9584\\\") && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"ca48ea5d9ee701ac5383800306378d945e66ca5427eba33396e6805ebbdc1ea7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f6df6bc14432fdc346191db86ee06e75c8090ed87a32c984493c837e97a10be6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"fc54a1d4f18d4d59e58b6a3aa31dbfaddda2b89e5c28dc9eacf14ff38a414021\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"maas-default-gateway"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-maas-default-gateway\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:16:00.655Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-02T21:18:38Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:10:41Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:10:48Z"}],"name":"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce","namespace":"kuadrant-system","resourceVersion":"106515","uid":"214d0d20-7d9b-4385-aa4a-c6a227088314"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:10:48Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:10:48Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:16:00.716Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-02T21:18:49Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:10:41Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:10:45Z"}],"name":"de97dd5d45c6eb12b4a1112ed1f362d8544427428d2249a399e26ba069d6aadb","namespace":"kuadrant-system","resourceVersion":"106395","uid":"947a2dde-5efe-4b41-a559-c49149ecb7ff"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["de97dd5d45c6eb12b4a1112ed1f362d8544427428d2249a399e26ba069d6aadb"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:18:49Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:18:49Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["de97dd5d45c6eb12b4a1112ed1f362d8544427428d2249a399e26ba069d6aadb"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"de97dd5d45c6eb12b4a1112ed1f362d8544427428d2249a399e26ba069d6aadb\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:16:00.779Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-2-simulated-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-2-simulated-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-02T21:18:17Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:10:40Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:10:44Z"}],"name":"fac07f302f653115fda3d376325a268abaf66025ed0e4af73e88bea3f41fe933","namespace":"kuadrant-system","resourceVersion":"106357","uid":"fb8da4ca-ef70-459f-9cee-d8db6b6c7404"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["fac07f302f653115fda3d376325a268abaf66025ed0e4af73e88bea3f41fe933"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:09:53Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:09:53Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["fac07f302f653115fda3d376325a268abaf66025ed0e4af73e88bea3f41fe933"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"fac07f302f653115fda3d376325a268abaf66025ed0e4af73e88bea3f41fe933\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:16:00.840Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-embedding-simulated-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-embedding-simulated-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-02T21:18:26Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:10:37Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:10:41Z"}],"name":"80056c658070f49140955cb6eabdbd252857a614af6b0f2f2de7a1ab1cd47949","namespace":"kuadrant-system","resourceVersion":"106157","uid":"c5c390bf-e2ba-4432-9294-bc1e1d24c250"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["80056c658070f49140955cb6eabdbd252857a614af6b0f2f2de7a1ab1cd47949"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:19:19Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:19:19Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["80056c658070f49140955cb6eabdbd252857a614af6b0f2f2de7a1ab1cd47949"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"80056c658070f49140955cb6eabdbd252857a614af6b0f2f2de7a1ab1cd47949\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:16:00.902Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-02T21:18:21Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:10:35Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:10:36Z"}],"name":"17002b7f0c8e62582ad262d9c2b8b038ee7f2a9327fe34f21fd4f47134b7b8cf","namespace":"kuadrant-system","resourceVersion":"105896","uid":"ca2e1742-8adc-44a1-8d25-bd844ad1bcab"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["17002b7f0c8e62582ad262d9c2b8b038ee7f2a9327fe34f21fd4f47134b7b8cf"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:36:33Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:36:33Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["17002b7f0c8e62582ad262d9c2b8b038ee7f2a9327fe34f21fd4f47134b7b8cf"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"17002b7f0c8e62582ad262d9c2b8b038ee7f2a9327fe34f21fd4f47134b7b8cf\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:16:00.964Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-02T21:18:31Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:10:36Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:10:36Z"}],"name":"4f800155f293f82eeaf5fd6a9553c0a1bee90f47a295bba8d7a04b3f11faea33","namespace":"kuadrant-system","resourceVersion":"105920","uid":"2c4af3f9-f598-4a6c-a301-b71e2082acaa"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["4f800155f293f82eeaf5fd6a9553c0a1bee90f47a295bba8d7a04b3f11faea33"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:09:48Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:09:48Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["4f800155f293f82eeaf5fd6a9553c0a1bee90f47a295bba8d7a04b3f11faea33"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"4f800155f293f82eeaf5fd6a9553c0a1bee90f47a295bba8d7a04b3f11faea33\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:16:01.025Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-02T21:18:49Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:10:35Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:10:35Z"}],"name":"dd89509e97b96670685602ae2d08749226db8693944d2c6f868af9d3e0a5feb5","namespace":"kuadrant-system","resourceVersion":"105859","uid":"a26fa170-07c3-485e-a718-34a17e58d302"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["dd89509e97b96670685602ae2d08749226db8693944d2c6f868af9d3e0a5feb5"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:34:10Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:34:10Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["dd89509e97b96670685602ae2d08749226db8693944d2c6f868af9d3e0a5feb5"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"dd89509e97b96670685602ae2d08749226db8693944d2c6f868af9d3e0a5feb5\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:16:01.087Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-02T21:18:49Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:10:38Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:10:42Z"}],"name":"0e89fc4b75d3a5dd95fca2c4d8ae33c7826f05a8016c44eb39e28c3c1860fcfb","namespace":"kuadrant-system","resourceVersion":"106239","uid":"fb6659c8-fd81-45b1-ae33-089f73dc2054"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["0e89fc4b75d3a5dd95fca2c4d8ae33c7826f05a8016c44eb39e28c3c1860fcfb"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:19:19Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:19:19Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["0e89fc4b75d3a5dd95fca2c4d8ae33c7826f05a8016c44eb39e28c3c1860fcfb"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"0e89fc4b75d3a5dd95fca2c4d8ae33c7826f05a8016c44eb39e28c3c1860fcfb\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:16:01.148Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-02T21:18:48Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:10:40Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:10:48Z"}],"name":"06165835c4461c0b16a2bc5bae936aff3c2f351edbef8aa378f1110874acedfc","namespace":"kuadrant-system","resourceVersion":"106510","uid":"af7b4f34-b762-421c-8955-bf4dad876336"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["06165835c4461c0b16a2bc5bae936aff3c2f351edbef8aa378f1110874acedfc"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:10:48Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:10:48Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["06165835c4461c0b16a2bc5bae936aff3c2f351edbef8aa378f1110874acedfc"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"06165835c4461c0b16a2bc5bae936aff3c2f351edbef8aa378f1110874acedfc\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:16:01.209Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-02T21:18:21Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:10:34Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:10:35Z"}],"name":"d1d232e06f90d479cd9b802f24889e83af58c51cf54ba273d5e24dcb8a297688","namespace":"kuadrant-system","resourceVersion":"105844","uid":"58700c89-42ff-439b-b31f-db7a33d76650"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d1d232e06f90d479cd9b802f24889e83af58c51cf54ba273d5e24dcb8a297688"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:18:21Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:18:21Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["d1d232e06f90d479cd9b802f24889e83af58c51cf54ba273d5e24dcb8a297688"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"d1d232e06f90d479cd9b802f24889e83af58c51cf54ba273d5e24dcb8a297688\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:16:01.271Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-02T21:18:49Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:10:41Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:10:48Z"}],"name":"8274337fc3f0de48e5213819aeb4a46559c4f8b3428c1bae43c0d75207ef5264","namespace":"kuadrant-system","resourceVersion":"106518","uid":"c327b713-1cdf-45d8-a6fb-af24dc0f9100"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["8274337fc3f0de48e5213819aeb4a46559c4f8b3428c1bae43c0d75207ef5264"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:10:48Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:10:48Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["8274337fc3f0de48e5213819aeb4a46559c4f8b3428c1bae43c0d75207ef5264"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"8274337fc3f0de48e5213819aeb4a46559c4f8b3428c1bae43c0d75207ef5264\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:16:01.332Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-02T21:18:39Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:10:37Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:10:40Z"}],"name":"cc1ffc2ee4e05618c28c108cac668c0c02eb8e658953439e47a733edab44a1a0","namespace":"kuadrant-system","resourceVersion":"106100","uid":"4dbe387c-9a2c-477c-8e7b-adf4e1e2c366"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["cc1ffc2ee4e05618c28c108cac668c0c02eb8e658953439e47a733edab44a1a0"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:18:39Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:18:39Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["cc1ffc2ee4e05618c28c108cac668c0c02eb8e658953439e47a733edab44a1a0"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"cc1ffc2ee4e05618c28c108cac668c0c02eb8e658953439e47a733edab44a1a0\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:16:01.394Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-02T21:18:21Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:10:39Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:10:46Z"}],"name":"c4399a95e89654e5b2bb5fabe45bc947d11ccd1448ebf64c30b195b34f239d58","namespace":"kuadrant-system","resourceVersion":"106450","uid":"00dd952d-c2f0-4d46-ae0d-3a90b1246f0f"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["c4399a95e89654e5b2bb5fabe45bc947d11ccd1448ebf64c30b195b34f239d58"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:10:46Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:10:46Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["c4399a95e89654e5b2bb5fabe45bc947d11ccd1448ebf64c30b195b34f239d58"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"c4399a95e89654e5b2bb5fabe45bc947d11ccd1448ebf64c30b195b34f239d58\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:16:01.456Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-02T21:18:48Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:10:39Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:10:43Z"}],"name":"f9b535aed6243496a67741936e53a0d303bea1b872a06fb62f1f9c27150edc40","namespace":"kuadrant-system","resourceVersion":"106290","uid":"11fbb3b6-813e-42ac-8b1e-a16e089db4f5"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f9b535aed6243496a67741936e53a0d303bea1b872a06fb62f1f9c27150edc40"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:09:53Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:09:53Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["f9b535aed6243496a67741936e53a0d303bea1b872a06fb62f1f9c27150edc40"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"f9b535aed6243496a67741936e53a0d303bea1b872a06fb62f1f9c27150edc40\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:16:01.517Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-2-simulated-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-2-simulated-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-02T21:18:17Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:10:39Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:10:43Z"}],"name":"9e75e9fd02f51c2f043b145c5d6b82e95f1447b388ee529262aea27a6a2774ef","namespace":"kuadrant-system","resourceVersion":"106271","uid":"b93d340e-64c4-40b2-8396-2392e938aa5f"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["9e75e9fd02f51c2f043b145c5d6b82e95f1447b388ee529262aea27a6a2774ef"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:09:54Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:09:54Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["9e75e9fd02f51c2f043b145c5d6b82e95f1447b388ee529262aea27a6a2774ef"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"9e75e9fd02f51c2f043b145c5d6b82e95f1447b388ee529262aea27a6a2774ef\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:16:01.579Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-02T21:18:21Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:10:35Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:10:36Z"}],"name":"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668","namespace":"kuadrant-system","resourceVersion":"105876","uid":"1ea3e25e-e6b5-4d08-a5f2-d4913a2e97a5"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:19:19Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:19:19Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:16:01.641Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-02T21:18:31Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:10:35Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:10:36Z"}],"name":"135ffad9bbcd33779a0b9a1c0dc5d5f547356be21489762803640aca855c728a","namespace":"kuadrant-system","resourceVersion":"105907","uid":"c3780164-c9ad-4e6a-b0c2-52b22bced4f7"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["135ffad9bbcd33779a0b9a1c0dc5d5f547356be21489762803640aca855c728a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:09:54Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:09:54Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["135ffad9bbcd33779a0b9a1c0dc5d5f547356be21489762803640aca855c728a"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"135ffad9bbcd33779a0b9a1c0dc5d5f547356be21489762803640aca855c728a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:16:01.702Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-embedding-simulated-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-embedding-simulated-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-02T21:18:27Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:10:39Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:10:51Z"}],"name":"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e","namespace":"kuadrant-system","resourceVersion":"106668","uid":"5c8c5582-a46f-48f1-bd3c-8ecdbc99ff42"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:10:51Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:10:51Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:16:01.763Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-02T21:18:48Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:10:39Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:10:42Z"}],"name":"e91aceffc2d4f6d6b120625bd3ca23781b74a1cae6cf1da26bda310bbed0ef07","namespace":"kuadrant-system","resourceVersion":"106243","uid":"65d58591-7795-4c35-af85-1b2c814c21e7"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["e91aceffc2d4f6d6b120625bd3ca23781b74a1cae6cf1da26bda310bbed0ef07"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:09:48Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:09:48Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["e91aceffc2d4f6d6b120625bd3ca23781b74a1cae6cf1da26bda310bbed0ef07"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"e91aceffc2d4f6d6b120625bd3ca23781b74a1cae6cf1da26bda310bbed0ef07\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:16:01.826Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-02T21:18:38Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:10:37Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:10:40Z"}],"name":"92917da87eaba4f2684cd45947a3698434b99ff4ca6d3ddde51d6573aecb1600","namespace":"kuadrant-system","resourceVersion":"106147","uid":"f089c98c-5867-4541-b602-9c8b8b3f94b4"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["92917da87eaba4f2684cd45947a3698434b99ff4ca6d3ddde51d6573aecb1600"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:18:39Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:18:39Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["92917da87eaba4f2684cd45947a3698434b99ff4ca6d3ddde51d6573aecb1600"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"92917da87eaba4f2684cd45947a3698434b99ff4ca6d3ddde51d6573aecb1600\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:16:01.888Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-02T21:18:48Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:10:36Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:10:40Z"}],"name":"134a7a790ba665547ca14f80f917549f66ee5063fc41096471c0778399db6dd5","namespace":"kuadrant-system","resourceVersion":"106093","uid":"1b27e6b9-ccc6-4e12-8a61-c671706271cd"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["134a7a790ba665547ca14f80f917549f66ee5063fc41096471c0778399db6dd5"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:09:45Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:09:45Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["134a7a790ba665547ca14f80f917549f66ee5063fc41096471c0778399db6dd5"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"134a7a790ba665547ca14f80f917549f66ee5063fc41096471c0778399db6dd5\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:16:01.949Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-02T21:18:40Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:10:39Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:10:43Z"}],"name":"3f23315aacd6e16f4ab41f96aeedc9549d1abdfc9476577a47d45d12875dec5a","namespace":"kuadrant-system","resourceVersion":"106280","uid":"f5e32c57-1a0d-435d-92aa-0ee98e8baeba"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["3f23315aacd6e16f4ab41f96aeedc9549d1abdfc9476577a47d45d12875dec5a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:18:40Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:18:40Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["3f23315aacd6e16f4ab41f96aeedc9549d1abdfc9476577a47d45d12875dec5a"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"3f23315aacd6e16f4ab41f96aeedc9549d1abdfc9476577a47d45d12875dec5a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:16:02.011Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-02T21:18:49Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:10:35Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:10:35Z"}],"name":"ab505bdf28287fe00099987c1bde2c2f297c40c792a7f6cb5fbfa5adc44754d3","namespace":"kuadrant-system","resourceVersion":"105850","uid":"08a412f0-c481-428d-b90b-d528efffcf47"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["ab505bdf28287fe00099987c1bde2c2f297c40c792a7f6cb5fbfa5adc44754d3"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:19:18Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:19:18Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["ab505bdf28287fe00099987c1bde2c2f297c40c792a7f6cb5fbfa5adc44754d3"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"ab505bdf28287fe00099987c1bde2c2f297c40c792a7f6cb5fbfa5adc44754d3\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:16:02.072Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-02T21:18:38Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:10:41Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:10:48Z"}],"name":"486615827938fa99814e929fe7dc62bc16f7563179fef855074eb73dc7ce4724","namespace":"kuadrant-system","resourceVersion":"106525","uid":"214125ca-42ba-4094-b605-6ce561e537ca"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["486615827938fa99814e929fe7dc62bc16f7563179fef855074eb73dc7ce4724"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:10:48Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:10:48Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["486615827938fa99814e929fe7dc62bc16f7563179fef855074eb73dc7ce4724"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"486615827938fa99814e929fe7dc62bc16f7563179fef855074eb73dc7ce4724\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:16:02.133Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-embedding-simulated-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-embedding-simulated-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-02T21:18:26Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:10:37Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:10:40Z"}],"name":"f9fa9cfc2b4e701183573419a92c79384cd30210289602f0115c75c5029d55aa","namespace":"kuadrant-system","resourceVersion":"106143","uid":"34368a78-ce64-4c38-a3d7-caaf25e6b83b"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f9fa9cfc2b4e701183573419a92c79384cd30210289602f0115c75c5029d55aa"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:18:27Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:18:27Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["f9fa9cfc2b4e701183573419a92c79384cd30210289602f0115c75c5029d55aa"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"f9fa9cfc2b4e701183573419a92c79384cd30210289602f0115c75c5029d55aa\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:16:02.194Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-02T21:18:48Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:10:38Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:10:41Z"}],"name":"50c2058cf11e07a931b06ac4446a56eee86855f00badf26618abe486a7bdcfd7","namespace":"kuadrant-system","resourceVersion":"106196","uid":"de9d1cc9-14b7-409e-bb3a-aa08103ae0bc"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["50c2058cf11e07a931b06ac4446a56eee86855f00badf26618abe486a7bdcfd7"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:19:18Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:19:18Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["50c2058cf11e07a931b06ac4446a56eee86855f00badf26618abe486a7bdcfd7"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"50c2058cf11e07a931b06ac4446a56eee86855f00badf26618abe486a7bdcfd7\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:16:02.256Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-2-simulated-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-2-simulated-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-02T21:18:16Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:10:35Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:10:36Z"}],"name":"67c67ce733de50e7b3d797bb248036b01badfe02e958f5f76af05b58a504989c","namespace":"kuadrant-system","resourceVersion":"105880","uid":"e420c302-9915-4089-bfe2-7a898cce5fa1"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["67c67ce733de50e7b3d797bb248036b01badfe02e958f5f76af05b58a504989c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:18:16Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:18:16Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["67c67ce733de50e7b3d797bb248036b01badfe02e958f5f76af05b58a504989c"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"67c67ce733de50e7b3d797bb248036b01badfe02e958f5f76af05b58a504989c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:16:02.319Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-02T21:18:49Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:10:35Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:10:36Z"}],"name":"f95805f0e9b755664735d898c1d644d571943be553204d3f86136bc35719ff13","namespace":"kuadrant-system","resourceVersion":"105909","uid":"25d13ab5-6706-4293-baf5-d681d17b9688"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f95805f0e9b755664735d898c1d644d571943be553204d3f86136bc35719ff13"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:34:13Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:34:13Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["f95805f0e9b755664735d898c1d644d571943be553204d3f86136bc35719ff13"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"f95805f0e9b755664735d898c1d644d571943be553204d3f86136bc35719ff13\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:16:02.390Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-02T21:18:39Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:10:42Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:10:46Z"}],"name":"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455","namespace":"kuadrant-system","resourceVersion":"106439","uid":"59609df0-6834-4465-9d51-ef3cc66016e4"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:09:54Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:09:54Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:16:02.463Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-02T21:18:39Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:10:41Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:10:48Z"}],"name":"0829dbf2b5dc0900de272826295adf351de381b46fa6fba00b896213530780f6","namespace":"kuadrant-system","resourceVersion":"106526","uid":"0b814b73-0e6c-457e-b018-77f53c7fc590"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["0829dbf2b5dc0900de272826295adf351de381b46fa6fba00b896213530780f6"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:10:48Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:10:48Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["0829dbf2b5dc0900de272826295adf351de381b46fa6fba00b896213530780f6"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"0829dbf2b5dc0900de272826295adf351de381b46fa6fba00b896213530780f6\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:16:02.525Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-02T21:18:31Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:10:41Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:10:46Z"}],"name":"c82a1a3dc2ce54c0b664f79a2cd895a3c40f774b3694999badae8cedd328292e","namespace":"kuadrant-system","resourceVersion":"106401","uid":"c7a1b1d3-cccd-4fb1-8b6f-709e5202e78a"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["c82a1a3dc2ce54c0b664f79a2cd895a3c40f774b3694999badae8cedd328292e"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:09:53Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:09:53Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["c82a1a3dc2ce54c0b664f79a2cd895a3c40f774b3694999badae8cedd328292e"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"c82a1a3dc2ce54c0b664f79a2cd895a3c40f774b3694999badae8cedd328292e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:16:02.587Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-02T21:18:48Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:10:39Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:10:43Z"}],"name":"1e077a716d89a43572a3c16e8d0b0436816baa48a2ea227603701f10cad6d6f4","namespace":"kuadrant-system","resourceVersion":"106253","uid":"13421850-0cba-4578-882d-5e70335a29e6"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["1e077a716d89a43572a3c16e8d0b0436816baa48a2ea227603701f10cad6d6f4"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:09:47Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:09:47Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["1e077a716d89a43572a3c16e8d0b0436816baa48a2ea227603701f10cad6d6f4"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"1e077a716d89a43572a3c16e8d0b0436816baa48a2ea227603701f10cad6d6f4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:16:02.652Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-02T21:18:49Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:10:38Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:10:42Z"}],"name":"d69b9c128f599c9ea1af84bb3e783ed71688baf6b3ad2b86f2b7183f9a4208b9","namespace":"kuadrant-system","resourceVersion":"106216","uid":"13bee5e7-c8df-4c6f-a232-b3a081875254"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d69b9c128f599c9ea1af84bb3e783ed71688baf6b3ad2b86f2b7183f9a4208b9"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:34:13Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:34:13Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["d69b9c128f599c9ea1af84bb3e783ed71688baf6b3ad2b86f2b7183f9a4208b9"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"d69b9c128f599c9ea1af84bb3e783ed71688baf6b3ad2b86f2b7183f9a4208b9\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:16:02Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-inf-a-4585ee","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-a-4585ee","reconcileID":"1c740a7d-1cc0-4985-8e03-7001f5d5ab19","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-inf-a-4585ee","namespace":"openshift-ingress"}
{"level":"error","ts":"2026-11-02T22:16:02.714Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-embedding-simulated-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-embedding-simulated-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-02T21:18:27Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:10:36Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:10:39Z"}],"name":"5d590119308c6f848b12dd3ecdfb1b06cc2fe172af702455c342075944a045ff","namespace":"kuadrant-system","resourceVersion":"106060","uid":"7dfcd152-bda8-4fc5-bf20-c55f443cef33"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["5d590119308c6f848b12dd3ecdfb1b06cc2fe172af702455c342075944a045ff"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:36:35Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:36:35Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["5d590119308c6f848b12dd3ecdfb1b06cc2fe172af702455c342075944a045ff"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"5d590119308c6f848b12dd3ecdfb1b06cc2fe172af702455c342075944a045ff\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:16:02Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-a-4585ee","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T22:16:02Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T22:16:02Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-11-02T22:16:02Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"error","ts":"2026-11-02T22:16:02.779Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-02T21:18:49Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:10:41Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:10:48Z"}],"name":"2d953f7313807988e63546aa32431d96f77e6989c672f8ab42827c1c21918630","namespace":"kuadrant-system","resourceVersion":"106523","uid":"b738046d-ab13-49cc-aed5-7c740b8a58fd"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["2d953f7313807988e63546aa32431d96f77e6989c672f8ab42827c1c21918630"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:10:48Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:10:48Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["2d953f7313807988e63546aa32431d96f77e6989c672f8ab42827c1c21918630"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"2d953f7313807988e63546aa32431d96f77e6989c672f8ab42827c1c21918630\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:16:02.842Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-02T21:18:31Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:10:37Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:10:40Z"}],"name":"2416d7b42d11a09d7152746be0e114f8fdc87d0fbd0efa9dec5b52b011082194","namespace":"kuadrant-system","resourceVersion":"106119","uid":"dca4432d-1e71-4b9a-b327-da52977476c8"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["2416d7b42d11a09d7152746be0e114f8fdc87d0fbd0efa9dec5b52b011082194"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:19:19Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:19:19Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["2416d7b42d11a09d7152746be0e114f8fdc87d0fbd0efa9dec5b52b011082194"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"2416d7b42d11a09d7152746be0e114f8fdc87d0fbd0efa9dec5b52b011082194\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:16:02Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-11-02T22:16:02Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-inf-a-4585ee","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-a-4585ee","reconcileID":"1c740a7d-1cc0-4985-8e03-7001f5d5ab19","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-inf-a-4585ee","namespace":"openshift-ingress"}
{"level":"error","ts":"2026-11-02T22:16:02Z","logger":"telemetry-policy-extension-controller","msg":"Reconciler error","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-inf-a-4585ee","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-a-4585ee","reconcileID":"3d127cc8-1f1a-4644-ac1e-746e4ca14843","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-inf-a-4585ee\" not found","stacktrace":"sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:353\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"error","ts":"2026-11-02T22:16:02.903Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-02T21:18:39Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:10:40Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:10:44Z"}],"name":"c5a685f2a5ebdef5f1dee488990c0798a45ddce399cf99e7d0c505a5f46c69ac","namespace":"kuadrant-system","resourceVersion":"106323","uid":"dfe561d7-5924-4cb8-8b77-3e8dc714e323"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["c5a685f2a5ebdef5f1dee488990c0798a45ddce399cf99e7d0c505a5f46c69ac"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:09:52Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:09:52Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["c5a685f2a5ebdef5f1dee488990c0798a45ddce399cf99e7d0c505a5f46c69ac"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"c5a685f2a5ebdef5f1dee488990c0798a45ddce399cf99e7d0c505a5f46c69ac\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:16:02Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-a-4585ee","event":"DELETE"}
{"level":"info","ts":"2026-11-02T22:16:02Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-02T22:16:02Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-inf-a-4585ee\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-02T22:16:02Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"error","ts":"2026-11-02T22:16:02.966Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-02T21:18:38Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:10:36Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:10:37Z"}],"name":"6565c4085b3917d5390fe1b0194fb3d8319f1d56b45867e3c68ff740b5c16ef3","namespace":"kuadrant-system","resourceVersion":"105923","uid":"f82393c1-5f1c-4802-b1a2-9277da9f1c19"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["6565c4085b3917d5390fe1b0194fb3d8319f1d56b45867e3c68ff740b5c16ef3"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:18:38Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:18:38Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["6565c4085b3917d5390fe1b0194fb3d8319f1d56b45867e3c68ff740b5c16ef3"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"6565c4085b3917d5390fe1b0194fb3d8319f1d56b45867e3c68ff740b5c16ef3\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:16:03.027Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-02T21:18:21Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:10:39Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:10:43Z"}],"name":"cad6ab5a81a65fd4cb03a0fefdab5de82aa18c30a5b95078b1d05214b0606f40","namespace":"kuadrant-system","resourceVersion":"106288","uid":"ad7a5c7a-3f09-47be-8d53-f79bcd3bfd41"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["cad6ab5a81a65fd4cb03a0fefdab5de82aa18c30a5b95078b1d05214b0606f40"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:09:46Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:09:46Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["cad6ab5a81a65fd4cb03a0fefdab5de82aa18c30a5b95078b1d05214b0606f40"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"cad6ab5a81a65fd4cb03a0fefdab5de82aa18c30a5b95078b1d05214b0606f40\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:16:03.088Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route#rule-3"},"creationTimestamp":"2026-11-02T21:16:03Z","generation":6,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:10:38Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:10:41Z"}],"name":"06b05a8e4dd69bdc4f333ad9509ee8cad3c5c0f5dd48edbe94c1158b60f79ed3","namespace":"kuadrant-system","resourceVersion":"106169","uid":"0a3fd9fd-cbf8-4e06-8178-b81d7348efd7"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["06b05a8e4dd69bdc4f333ad9509ee8cad3c5c0f5dd48edbe94c1158b60f79ed3"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:16:16Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:16:16Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["06b05a8e4dd69bdc4f333ad9509ee8cad3c5c0f5dd48edbe94c1158b60f79ed3"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"06b05a8e4dd69bdc4f333ad9509ee8cad3c5c0f5dd48edbe94c1158b60f79ed3\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:16:03.152Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-02T21:18:49Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:10:36Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:10:39Z"}],"name":"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0","namespace":"kuadrant-system","resourceVersion":"106074","uid":"8c9443c9-f182-4677-85bf-323ad47fe3c9"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:09:50Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:09:50Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:16:03.215Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-02T21:18:31Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:10:37Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:10:40Z"}],"name":"23672b974f0dbc05100a34c78d2b029e41f1d5a3752f3fcb52915f56db360e25","namespace":"kuadrant-system","resourceVersion":"106131","uid":"8464ab4b-fcc7-4b42-8fc7-5c7330242a1c"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["23672b974f0dbc05100a34c78d2b029e41f1d5a3752f3fcb52915f56db360e25"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:18:31Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:18:31Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["23672b974f0dbc05100a34c78d2b029e41f1d5a3752f3fcb52915f56db360e25"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"23672b974f0dbc05100a34c78d2b029e41f1d5a3752f3fcb52915f56db360e25\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:16:03.277Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-02T21:18:48Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:10:34Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:10:34Z"}],"name":"a4493fc88328eba553ef36791fbf4706bffae04a1ac501d099b12309ebc85c6b","namespace":"kuadrant-system","resourceVersion":"105815","uid":"58f8e417-4e4e-42bc-a88d-38b8b56a4c80"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a4493fc88328eba553ef36791fbf4706bffae04a1ac501d099b12309ebc85c6b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:10:34Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:10:34Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["a4493fc88328eba553ef36791fbf4706bffae04a1ac501d099b12309ebc85c6b"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a4493fc88328eba553ef36791fbf4706bffae04a1ac501d099b12309ebc85c6b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:16:03.344Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-02T21:18:31Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:10:34Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:10:35Z"}],"name":"596921ddc7ba8523386263c5cffcbd6ad9b6a385318ed7e24f72be06f36fc398","namespace":"kuadrant-system","resourceVersion":"105847","uid":"e8225d03-0c84-4de9-b550-3d9f9f1ec089"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["596921ddc7ba8523386263c5cffcbd6ad9b6a385318ed7e24f72be06f36fc398"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:09:48Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:09:48Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["596921ddc7ba8523386263c5cffcbd6ad9b6a385318ed7e24f72be06f36fc398"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"596921ddc7ba8523386263c5cffcbd6ad9b6a385318ed7e24f72be06f36fc398\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:16:03.406Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-02T21:18:49Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:10:36Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:10:39Z"}],"name":"54cd0149b818480305f3d0024b3c95629cafb641b48195d003b2b7006d5c6bcd","namespace":"kuadrant-system","resourceVersion":"106065","uid":"0502152b-1d9d-492f-bb61-0a9806d87310"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["54cd0149b818480305f3d0024b3c95629cafb641b48195d003b2b7006d5c6bcd"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:09:54Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:09:54Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["54cd0149b818480305f3d0024b3c95629cafb641b48195d003b2b7006d5c6bcd"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"54cd0149b818480305f3d0024b3c95629cafb641b48195d003b2b7006d5c6bcd\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:16:03.467Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-02T21:18:21Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:10:34Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:10:35Z"}],"name":"2f53b030326b8e1f5908c601aecd3fffcb6d08a8337d0bdc53ee1fc699a4cd71","namespace":"kuadrant-system","resourceVersion":"105831","uid":"3aaf392c-3146-4f82-b8e9-519ccf02d326"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["2f53b030326b8e1f5908c601aecd3fffcb6d08a8337d0bdc53ee1fc699a4cd71"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:10:35Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:10:35Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["2f53b030326b8e1f5908c601aecd3fffcb6d08a8337d0bdc53ee1fc699a4cd71"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"2f53b030326b8e1f5908c601aecd3fffcb6d08a8337d0bdc53ee1fc699a4cd71\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:16:03.529Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-2-simulated-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-2-simulated-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-02T21:18:17Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:10:36Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:10:39Z"}],"name":"010adf02b2e7deb40c572f4729b6dd4619847c8e6344137326b72df28772fc1a","namespace":"kuadrant-system","resourceVersion":"106067","uid":"d59bd379-de22-4260-a63f-ca258b3bd69f"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["010adf02b2e7deb40c572f4729b6dd4619847c8e6344137326b72df28772fc1a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:09:46Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:09:46Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["010adf02b2e7deb40c572f4729b6dd4619847c8e6344137326b72df28772fc1a"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"010adf02b2e7deb40c572f4729b6dd4619847c8e6344137326b72df28772fc1a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:16:03.628Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-02T21:18:39Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:10:38Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:10:41Z"}],"name":"8d34bd12ba2030284fcb69127f53b8158bbdd4a1432bfe619165b4c2c96cc061","namespace":"kuadrant-system","resourceVersion":"106175","uid":"972c5e7d-6947-4552-85a1-5a6c0ed21173"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["8d34bd12ba2030284fcb69127f53b8158bbdd4a1432bfe619165b4c2c96cc061"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:19:18Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:19:18Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["8d34bd12ba2030284fcb69127f53b8158bbdd4a1432bfe619165b4c2c96cc061"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"8d34bd12ba2030284fcb69127f53b8158bbdd4a1432bfe619165b4c2c96cc061\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:16:03.692Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-02T21:18:39Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:10:39Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:10:43Z"}],"name":"ce7d381faee9ff949d68d825ffa1dcb9247dad19667ec59a8e91847320dacbe0","namespace":"kuadrant-system","resourceVersion":"106261","uid":"3282c010-eba7-4069-b458-e4a81b773586"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["ce7d381faee9ff949d68d825ffa1dcb9247dad19667ec59a8e91847320dacbe0"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:36:34Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:36:34Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["ce7d381faee9ff949d68d825ffa1dcb9247dad19667ec59a8e91847320dacbe0"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"ce7d381faee9ff949d68d825ffa1dcb9247dad19667ec59a8e91847320dacbe0\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:16:03.755Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-02T21:18:48Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:10:34Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:10:35Z"}],"name":"99606c4eac496429be47144db9f3f48867815df12eb99d7be8073b767d7e44de","namespace":"kuadrant-system","resourceVersion":"105843","uid":"d6cb47d1-1dc7-42b6-8504-7d432068f40a"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["99606c4eac496429be47144db9f3f48867815df12eb99d7be8073b767d7e44de"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:34:17Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:34:17Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["99606c4eac496429be47144db9f3f48867815df12eb99d7be8073b767d7e44de"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"99606c4eac496429be47144db9f3f48867815df12eb99d7be8073b767d7e44de\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:16:03.817Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-02T21:18:38Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:10:37Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:10:40Z"}],"name":"e5f81c7f7812462ebef000c68dc043013159f22201d2eeecf05c220e809f96ed","namespace":"kuadrant-system","resourceVersion":"106126","uid":"817bb8d6-da9d-4dd2-bd9e-34b731410642"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["e5f81c7f7812462ebef000c68dc043013159f22201d2eeecf05c220e809f96ed"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:18:39Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:18:39Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["e5f81c7f7812462ebef000c68dc043013159f22201d2eeecf05c220e809f96ed"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"e5f81c7f7812462ebef000c68dc043013159f22201d2eeecf05c220e809f96ed\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:16:03.879Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-embedding-simulated-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-embedding-simulated-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-02T21:18:27Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:10:40Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:10:47Z"}],"name":"0020c64019ffd1a0bdcc75e6441e6a30e6d8bb08f463f67bd2408a1e82b95b2a","namespace":"kuadrant-system","resourceVersion":"106503","uid":"9c300a5f-b9bf-4a8d-9e83-93143f3748ed"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["0020c64019ffd1a0bdcc75e6441e6a30e6d8bb08f463f67bd2408a1e82b95b2a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:10:47Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:10:47Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["0020c64019ffd1a0bdcc75e6441e6a30e6d8bb08f463f67bd2408a1e82b95b2a"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"0020c64019ffd1a0bdcc75e6441e6a30e6d8bb08f463f67bd2408a1e82b95b2a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:16:03.941Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-02T21:18:31Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:10:40Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:10:44Z"}],"name":"75fd86e2a4870af5fd78f2ad7aa2a9d79aff977b3678d81954b1e207a9315f2c","namespace":"kuadrant-system","resourceVersion":"106316","uid":"e083d534-231a-42e3-b214-9a8de2773576"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["75fd86e2a4870af5fd78f2ad7aa2a9d79aff977b3678d81954b1e207a9315f2c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:19:19Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:19:19Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["75fd86e2a4870af5fd78f2ad7aa2a9d79aff977b3678d81954b1e207a9315f2c"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"75fd86e2a4870af5fd78f2ad7aa2a9d79aff977b3678d81954b1e207a9315f2c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:16:04.003Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-embedding-simulated-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-embedding-simulated-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-02T21:18:26Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:10:41Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:10:45Z"}],"name":"105cf4dd91a8abf4a93abd65b255521c3d37b560b5d23f3ec59757b5b362fae6","namespace":"kuadrant-system","resourceVersion":"106398","uid":"e721320b-b0dd-48bb-9d6b-9a3cf2c2dc7a"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["105cf4dd91a8abf4a93abd65b255521c3d37b560b5d23f3ec59757b5b362fae6"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:19:19Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:19:19Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["105cf4dd91a8abf4a93abd65b255521c3d37b560b5d23f3ec59757b5b362fae6"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"105cf4dd91a8abf4a93abd65b255521c3d37b560b5d23f3ec59757b5b362fae6\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:16:04.065Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route#rule-6"},"creationTimestamp":"2026-11-02T21:16:03Z","generation":6,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:10:35Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:10:35Z"}],"name":"7def4ca304ff3869be64c2c02523fd9d2ff43465099dcd1124399f293eb4480f","namespace":"kuadrant-system","resourceVersion":"105868","uid":"a4896849-289b-4300-9ee8-e13530534d2a"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["7def4ca304ff3869be64c2c02523fd9d2ff43465099dcd1124399f293eb4480f"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:36:28Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:36:28Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["7def4ca304ff3869be64c2c02523fd9d2ff43465099dcd1124399f293eb4480f"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"7def4ca304ff3869be64c2c02523fd9d2ff43465099dcd1124399f293eb4480f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:16:04.127Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-02T21:18:21Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:10:38Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:10:41Z"}],"name":"1704c6bc15d6f547acca888061680f2275f690cb79e5af6fee44747bcf278b95","namespace":"kuadrant-system","resourceVersion":"106186","uid":"0c1e6b62-dc00-4c2d-acdb-49434ea56239"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["1704c6bc15d6f547acca888061680f2275f690cb79e5af6fee44747bcf278b95"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:18:21Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:18:21Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["1704c6bc15d6f547acca888061680f2275f690cb79e5af6fee44747bcf278b95"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"1704c6bc15d6f547acca888061680f2275f690cb79e5af6fee44747bcf278b95\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:16:04.190Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-2-simulated-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-2-simulated-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-02T21:18:16Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:10:37Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:10:40Z"}],"name":"669658556fba0f45c2a82def2f57614416614ddf154ed8dc5f4f9188f10130f2","namespace":"kuadrant-system","resourceVersion":"106121","uid":"51e387c8-3ff5-4593-8714-ca56441125ed"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["669658556fba0f45c2a82def2f57614416614ddf154ed8dc5f4f9188f10130f2"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:18:17Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:18:17Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["669658556fba0f45c2a82def2f57614416614ddf154ed8dc5f4f9188f10130f2"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"669658556fba0f45c2a82def2f57614416614ddf154ed8dc5f4f9188f10130f2\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:16:04.252Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-embedding-simulated-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-embedding-simulated-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-02T21:18:27Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:10:40Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:10:44Z"}],"name":"a9800464506c58f005016df354e160757732171ff4d19747202524955329b998","namespace":"kuadrant-system","resourceVersion":"106370","uid":"f6f9e98f-7883-4e00-aa33-65bc8f401c6b"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a9800464506c58f005016df354e160757732171ff4d19747202524955329b998"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:09:55Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:09:55Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["a9800464506c58f005016df354e160757732171ff4d19747202524955329b998"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a9800464506c58f005016df354e160757732171ff4d19747202524955329b998\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:16:04.315Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-2-simulated-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-2-simulated-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-02T21:18:17Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:10:38Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:10:42Z"}],"name":"a402d1681ab35bace735c19b1d084a86eb3d741d4e1c14371cfdaa55d22c3ebe","namespace":"kuadrant-system","resourceVersion":"106228","uid":"52b71f16-5b7b-4195-a89e-cd6a461067dc"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a402d1681ab35bace735c19b1d084a86eb3d741d4e1c14371cfdaa55d22c3ebe"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:36:28Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:36:28Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["a402d1681ab35bace735c19b1d084a86eb3d741d4e1c14371cfdaa55d22c3ebe"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a402d1681ab35bace735c19b1d084a86eb3d741d4e1c14371cfdaa55d22c3ebe\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:16:04.377Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-02T21:18:48Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:10:36Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:10:39Z"}],"name":"3083301b5359be118f04faaefcd72fd127f2297a3374ef7231b59a59a31b405c","namespace":"kuadrant-system","resourceVersion":"106084","uid":"5afbfc99-d75d-4a37-b31c-c7756d5bc7ac"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["3083301b5359be118f04faaefcd72fd127f2297a3374ef7231b59a59a31b405c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:19:19Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:19:19Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["3083301b5359be118f04faaefcd72fd127f2297a3374ef7231b59a59a31b405c"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"3083301b5359be118f04faaefcd72fd127f2297a3374ef7231b59a59a31b405c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:16:04.440Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-02T21:18:39Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:10:36Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:10:39Z"}],"name":"319e246831bdaf5e765e63d5511b516594fd2b64527850e2ddabd2a4a85532ea","namespace":"kuadrant-system","resourceVersion":"106079","uid":"f1da8ca3-152e-476b-a1bb-96a91bcea0e3"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["319e246831bdaf5e765e63d5511b516594fd2b64527850e2ddabd2a4a85532ea"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:18:40Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:18:40Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["319e246831bdaf5e765e63d5511b516594fd2b64527850e2ddabd2a4a85532ea"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"319e246831bdaf5e765e63d5511b516594fd2b64527850e2ddabd2a4a85532ea\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:16:04.502Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-02T21:18:39Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:10:40Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:10:48Z"}],"name":"a6a6232fd5656520e75d100c41add5f1637dde9705a4ec608bbb90b724c258a5","namespace":"kuadrant-system","resourceVersion":"106504","uid":"f1cd9b56-4a31-4ce1-b740-613be7e0159c"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a6a6232fd5656520e75d100c41add5f1637dde9705a4ec608bbb90b724c258a5"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:10:48Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:10:48Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["a6a6232fd5656520e75d100c41add5f1637dde9705a4ec608bbb90b724c258a5"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a6a6232fd5656520e75d100c41add5f1637dde9705a4ec608bbb90b724c258a5\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:16:04.567Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/premium-simulated-simulated-premium-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/premium-simulated-simulated-premium-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-02T21:18:49Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:10:36Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:10:37Z"}],"name":"f6df6bc14432fdc346191db86ee06e75c8090ed87a32c984493c837e97a10be6","namespace":"kuadrant-system","resourceVersion":"105930","uid":"d71ee8ab-248f-46ed-a17b-96ad3cd4cee8"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f6df6bc14432fdc346191db86ee06e75c8090ed87a32c984493c837e97a10be6"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:09:52Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:09:52Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["f6df6bc14432fdc346191db86ee06e75c8090ed87a32c984493c837e97a10be6"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"f6df6bc14432fdc346191db86ee06e75c8090ed87a32c984493c837e97a10be6\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:16:04.629Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-2-simulated-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-2-simulated-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-02T21:18:16Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:10:35Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:10:35Z"}],"name":"a91faccafad197e2a4065ce3d12a052ac484d2e8fb2fc9265ee48f02b28e6dce","namespace":"kuadrant-system","resourceVersion":"105872","uid":"4cc5ed8f-00de-4c7e-be3a-12c0a62618f8"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a91faccafad197e2a4065ce3d12a052ac484d2e8fb2fc9265ee48f02b28e6dce"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:36:27Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:36:27Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["a91faccafad197e2a4065ce3d12a052ac484d2e8fb2fc9265ee48f02b28e6dce"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a91faccafad197e2a4065ce3d12a052ac484d2e8fb2fc9265ee48f02b28e6dce\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:16:04.698Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-02T21:18:48Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:10:36Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:10:37Z"}],"name":"8d8c8aae1332bb0300ac2d65be9b8708fbfde6d4b5599ec52380cf1f70956045","namespace":"kuadrant-system","resourceVersion":"105945","uid":"0c073bfe-3acf-43c3-938f-7f8117dea42f"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["8d8c8aae1332bb0300ac2d65be9b8708fbfde6d4b5599ec52380cf1f70956045"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:18:49Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:18:49Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["8d8c8aae1332bb0300ac2d65be9b8708fbfde6d4b5599ec52380cf1f70956045"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"8d8c8aae1332bb0300ac2d65be9b8708fbfde6d4b5599ec52380cf1f70956045\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:16:04.768Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-embedding-simulated-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-embedding-simulated-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-02T21:18:26Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:10:42Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:10:49Z"}],"name":"810f299b76daf089b33c92cfbe0445ab5cc89a48d38e36df0cc89ed6cd1fe8df","namespace":"kuadrant-system","resourceVersion":"106583","uid":"dafc8b3f-2b7d-4454-82b8-a2a6d3d92763"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["810f299b76daf089b33c92cfbe0445ab5cc89a48d38e36df0cc89ed6cd1fe8df"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:10:49Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:10:49Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["810f299b76daf089b33c92cfbe0445ab5cc89a48d38e36df0cc89ed6cd1fe8df"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"810f299b76daf089b33c92cfbe0445ab5cc89a48d38e36df0cc89ed6cd1fe8df\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:16:04.835Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-02T21:18:48Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:10:38Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:10:42Z"}],"name":"aa7038625b8f43b0c002f79637065e5ab90468f50f998759d08f2c4640c07c04","namespace":"kuadrant-system","resourceVersion":"106223","uid":"bbed2434-8880-494c-80c3-f3902b031a86"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["aa7038625b8f43b0c002f79637065e5ab90468f50f998759d08f2c4640c07c04"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:18:48Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:18:48Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["aa7038625b8f43b0c002f79637065e5ab90468f50f998759d08f2c4640c07c04"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"aa7038625b8f43b0c002f79637065e5ab90468f50f998759d08f2c4640c07c04\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:16:04.900Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-02T21:18:31Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:10:40Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:10:45Z"}],"name":"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec","namespace":"kuadrant-system","resourceVersion":"106379","uid":"b970691b-aeab-4ab1-8c26-716a1d192d99"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:09:47Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:09:47Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:16:04.963Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-02T21:18:38Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:10:35Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:10:36Z"}],"name":"3167d3bf853032a93e8569019dcd3e5aa33af9cb580cf9ca138990567fc9d857","namespace":"kuadrant-system","resourceVersion":"105891","uid":"de8437b4-29c6-42d1-bbfa-ad2e23016891"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["3167d3bf853032a93e8569019dcd3e5aa33af9cb580cf9ca138990567fc9d857"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:18:39Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:18:39Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["3167d3bf853032a93e8569019dcd3e5aa33af9cb580cf9ca138990567fc9d857"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"3167d3bf853032a93e8569019dcd3e5aa33af9cb580cf9ca138990567fc9d857\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:16:05.027Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-02T21:18:38Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:10:35Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:10:35Z"}],"name":"0913a452a02695c6681f1037232199b40b64236fed4d29cdbb41561695826340","namespace":"kuadrant-system","resourceVersion":"105855","uid":"233e732a-3129-4d24-a654-aa4a94b616ec"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["0913a452a02695c6681f1037232199b40b64236fed4d29cdbb41561695826340"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:09:55Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:09:55Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["0913a452a02695c6681f1037232199b40b64236fed4d29cdbb41561695826340"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"0913a452a02695c6681f1037232199b40b64236fed4d29cdbb41561695826340\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:16:05.088Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-embedding-simulated-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-embedding-simulated-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-02T21:18:27Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:10:39Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:10:43Z"}],"name":"bfd36c5ed73eb81df97258ffa1aa36d8cbf6f3e7a8096c33ca4ff417be59d002","namespace":"kuadrant-system","resourceVersion":"106279","uid":"33d0d859-f2a7-4b2b-a6fb-da332a727697"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["bfd36c5ed73eb81df97258ffa1aa36d8cbf6f3e7a8096c33ca4ff417be59d002"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:18:27Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:18:27Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["bfd36c5ed73eb81df97258ffa1aa36d8cbf6f3e7a8096c33ca4ff417be59d002"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"bfd36c5ed73eb81df97258ffa1aa36d8cbf6f3e7a8096c33ca4ff417be59d002\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:16:05.150Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-02T21:18:39Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:10:38Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:10:41Z"}],"name":"54eea38241838159e47386cb814ad20fc30631ee8c42d57f0ff8da80fbbf62a0","namespace":"kuadrant-system","resourceVersion":"106201","uid":"d9223dea-d924-4405-9e2c-4f57e5726de8"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["54eea38241838159e47386cb814ad20fc30631ee8c42d57f0ff8da80fbbf62a0"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:18:39Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:18:39Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["54eea38241838159e47386cb814ad20fc30631ee8c42d57f0ff8da80fbbf62a0"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"54eea38241838159e47386cb814ad20fc30631ee8c42d57f0ff8da80fbbf62a0\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:16:05.213Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-simulated-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-simulated-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-02T21:18:21Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:10:40Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:10:48Z"}],"name":"2ddbced6f2f51d410743da1d9db1257d0006d99f38986dd7cc7efd26620791ad","namespace":"kuadrant-system","resourceVersion":"106513","uid":"cd4dbfde-d07e-4a14-91a9-0670da25429a"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["2ddbced6f2f51d410743da1d9db1257d0006d99f38986dd7cc7efd26620791ad"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:10:48Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:10:48Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["2ddbced6f2f51d410743da1d9db1257d0006d99f38986dd7cc7efd26620791ad"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"2ddbced6f2f51d410743da1d9db1257d0006d99f38986dd7cc7efd26620791ad\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:16:05.275Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-2-simulated-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-2-simulated-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-02T21:18:17Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:10:40Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:10:45Z"}],"name":"6687eb3cec74c6c51428ce3f3d22d50ba269f59015d1bc8f185da49eb095534e","namespace":"kuadrant-system","resourceVersion":"106375","uid":"3da539ac-ddf5-4993-bbec-cea1d8e0b607"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["6687eb3cec74c6c51428ce3f3d22d50ba269f59015d1bc8f185da49eb095534e"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:09:55Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:09:55Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["6687eb3cec74c6c51428ce3f3d22d50ba269f59015d1bc8f185da49eb095534e"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"6687eb3cec74c6c51428ce3f3d22d50ba269f59015d1bc8f185da49eb095534e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:16:05.337Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-2-simulated-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-2-simulated-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-02T21:18:17Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:10:41Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:10:45Z"}],"name":"74b47f1aa1203aad58596cbaab10ae46e8fddd08ac49eb57a26bdba532d88e72","namespace":"kuadrant-system","resourceVersion":"106389","uid":"9a36249e-7376-46a4-b2d3-242b00d8f143"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["74b47f1aa1203aad58596cbaab10ae46e8fddd08ac49eb57a26bdba532d88e72"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:09:45Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:09:45Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["74b47f1aa1203aad58596cbaab10ae46e8fddd08ac49eb57a26bdba532d88e72"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"74b47f1aa1203aad58596cbaab10ae46e8fddd08ac49eb57a26bdba532d88e72\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:16:05.398Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-embedding-simulated-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-embedding-simulated-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-02T21:18:26Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:10:39Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:10:43Z"}],"name":"2d4a2275e6cbab5c26d5c3cf2d75aa2776066390e5b66f5498b16b26bc596af7","namespace":"kuadrant-system","resourceVersion":"106263","uid":"c3ac65e6-4145-4da0-b26f-278381d5074b"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["2d4a2275e6cbab5c26d5c3cf2d75aa2776066390e5b66f5498b16b26bc596af7"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:09:54Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:09:54Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["2d4a2275e6cbab5c26d5c3cf2d75aa2776066390e5b66f5498b16b26bc596af7"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"2d4a2275e6cbab5c26d5c3cf2d75aa2776066390e5b66f5498b16b26bc596af7\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:16:05.459Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-2-simulated-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-2-simulated-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-02T21:18:16Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:10:34Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:10:35Z"}],"name":"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96","namespace":"kuadrant-system","resourceVersion":"105827","uid":"3bd7e588-b2c0-4f88-ad6c-92c4a4f5a345"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:09:52Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:09:52Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:16:05.521Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/facebook-opt-125m-simulated-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/facebook-opt-125m-simulated-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-02T21:18:48Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:10:34Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:10:35Z"}],"name":"75612d85af2bae456dadd78163b2d2f9015c0a0bf4e20bcb8a555e6a5ab3b8c0","namespace":"kuadrant-system","resourceVersion":"105835","uid":"f4654ece-9841-4e26-a8a9-f3ec6fdc7a00"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["75612d85af2bae456dadd78163b2d2f9015c0a0bf4e20bcb8a555e6a5ab3b8c0"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:09:54Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:09:54Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["75612d85af2bae456dadd78163b2d2f9015c0a0bf4e20bcb8a555e6a5ab3b8c0"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"75612d85af2bae456dadd78163b2d2f9015c0a0bf4e20bcb8a555e6a5ab3b8c0\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:16:05.584Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-distinct-2-simulated-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-distinct-2-simulated-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-02T21:18:17Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:10:37Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:10:41Z"}],"name":"a908063c86927e6bf07b7d793aad9f277ac3c2a8f5f5d468b116cb9e07929b14","namespace":"kuadrant-system","resourceVersion":"106163","uid":"957a9438-ed77-444c-a333-1526b1b744d3"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a908063c86927e6bf07b7d793aad9f277ac3c2a8f5f5d468b116cb9e07929b14"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:19:17Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:19:17Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["a908063c86927e6bf07b7d793aad9f277ac3c2a8f5f5d468b116cb9e07929b14"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a908063c86927e6bf07b7d793aad9f277ac3c2a8f5f5d468b116cb9e07929b14\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:16:05.646Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-trlp-test-simulated-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-trlp-test-simulated-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-02T21:18:31Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:10:37Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:10:41Z"}],"name":"726a74c13fee356e859d9317271facbb60b066acbc5571de22d056f13c60878f","namespace":"kuadrant-system","resourceVersion":"106151","uid":"d0b642c8-7a95-495a-b0d2-9191c7bbc9eb"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["726a74c13fee356e859d9317271facbb60b066acbc5571de22d056f13c60878f"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:19:18Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:19:18Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["726a74c13fee356e859d9317271facbb60b066acbc5571de22d056f13c60878f"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"726a74c13fee356e859d9317271facbb60b066acbc5571de22d056f13c60878f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:16:05.708Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/e2e-embedding-simulated-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/e2e-embedding-simulated-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-02T21:18:27Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:10:34Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:10:34Z"}],"name":"ad8714d3b8aed2a9ffd68fbcf0288557e9c1c059c1b59ad3e9a09910b37fd61b","namespace":"kuadrant-system","resourceVersion":"105811","uid":"67233c6f-12ee-408b-9d10-e95973c9e911"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["ad8714d3b8aed2a9ffd68fbcf0288557e9c1c059c1b59ad3e9a09910b37fd61b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:18:28Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:18:28Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["ad8714d3b8aed2a9ffd68fbcf0288557e9c1c059c1b59ad3e9a09910b37fd61b"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"ad8714d3b8aed2a9ffd68fbcf0288557e9c1c059c1b59ad3e9a09910b37fd61b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:16:05.770Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-02T21:18:39Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:10:41Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:10:48Z"}],"name":"94ddc5e77f082c32bebc7a36bcebf621518ebf303e83b9c540da1352d04e620b","namespace":"kuadrant-system","resourceVersion":"106517","uid":"a58039fc-701c-47fe-b574-32560eabeba1"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["94ddc5e77f082c32bebc7a36bcebf621518ebf303e83b9c540da1352d04e620b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:10:48Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:10:48Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["94ddc5e77f082c32bebc7a36bcebf621518ebf303e83b9c540da1352d04e620b"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"94ddc5e77f082c32bebc7a36bcebf621518ebf303e83b9c540da1352d04e620b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:16:05.832Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"llm/echo-simulator-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:llm/echo-simulator-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-02T21:18:39Z","generation":5,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:10:40Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:10:44Z"}],"name":"a8c8220ad6f1387002e262ace5db78a2c4bb39e5953306702a228215174f6796","namespace":"kuadrant-system","resourceVersion":"106334","uid":"7c5acab6-424a-4637-b109-0053b2a76119"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a8c8220ad6f1387002e262ace5db78a2c4bb39e5953306702a228215174f6796"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:19:17Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:19:17Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["a8c8220ad6f1387002e262ace5db78a2c4bb39e5953306702a228215174f6796"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a8c8220ad6f1387002e262ace5db78a2c4bb39e5953306702a228215174f6796\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:16:05.893Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route#rule-1"},"creationTimestamp":"2026-11-02T21:16:03Z","generation":6,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:10:37Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:10:40Z"}],"name":"a7740f6e77d024a437502c023fb1d8939cb3cc2b9ed7f4073af7d779e19459eb","namespace":"kuadrant-system","resourceVersion":"106107","uid":"b27e2780-f07b-43fa-84a9-edcc72049032"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a7740f6e77d024a437502c023fb1d8939cb3cc2b9ed7f4073af7d779e19459eb"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:36:27Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:36:27Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["a7740f6e77d024a437502c023fb1d8939cb3cc2b9ed7f4073af7d779e19459eb"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a7740f6e77d024a437502c023fb1d8939cb3cc2b9ed7f4073af7d779e19459eb\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:16:05.950Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/64c07ad7265a7de81e7c5bea7835be2261db15e03818cf83be7408b1e9367af5","error":"authconfigs.authorino.kuadrant.io \"64c07ad7265a7de81e7c5bea7835be2261db15e03818cf83be7408b1e9367af5\" not found"}
{"level":"error","ts":"2026-11-02T22:16:06.004Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/812f878812ea6a6dbe4906e69118050b03bcfa1d1316bb89e668a6da5353f399","error":"authconfigs.authorino.kuadrant.io \"812f878812ea6a6dbe4906e69118050b03bcfa1d1316bb89e668a6da5353f399\" not found"}
{"level":"error","ts":"2026-11-02T22:16:06.059Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/21669cb0a2d09d29fe684b3855920bdb58c0320813f0155c8d9a5d12982f8337","error":"authconfigs.authorino.kuadrant.io \"21669cb0a2d09d29fe684b3855920bdb58c0320813f0155c8d9a5d12982f8337\" not found"}
{"level":"error","ts":"2026-11-02T22:16:06.114Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/09c499c877bdb00da2eb81703e1cea8473b75d287df73d1166c80a940f8060f6","error":"authconfigs.authorino.kuadrant.io \"09c499c877bdb00da2eb81703e1cea8473b75d287df73d1166c80a940f8060f6\" not found"}
{"level":"error","ts":"2026-11-02T22:16:06.171Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/b2e35f795926b66b8f7a0f318873786afd9afecea81d7d5ccd4fecee4209f83c","error":"authconfigs.authorino.kuadrant.io \"b2e35f795926b66b8f7a0f318873786afd9afecea81d7d5ccd4fecee4209f83c\" not found"}
{"level":"error","ts":"2026-11-02T22:16:06.226Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/cdcab91a2476da47a7d91b7946953ef25fe82b9f1b96d7009eb6e36ae9aacc5c","error":"authconfigs.authorino.kuadrant.io \"cdcab91a2476da47a7d91b7946953ef25fe82b9f1b96d7009eb6e36ae9aacc5c\" not found"}
{"level":"error","ts":"2026-11-02T22:16:06.349Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-facebook-opt-125m-simulated","namespace":"llm","uid":"da8edb1a-ed61-454d-939f-fc7cd235d9fb","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-facebook-opt-125m-simulated\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:16:06.502Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-extmod-a-d6b384-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-extmod-a-d6b384-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:16:06.909Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"maas-gateway-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"maas-gateway-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:16:07.296Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-extmod-a-d6b384","namespace":"openshift-ingress","uid":"257056bc-db5f-4bc1-a9af-1a8374d5db59","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-extmod-a-d6b384\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:16:07.453Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-inf-a-4585ee-maas-auth","namespace":"openshift-ingress","error":"authpolicies.kuadrant.io \"e2e-inf-a-4585ee-maas-auth\" not found"}
{"level":"error","ts":"2026-11-02T22:16:07.591Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-inf-a-4585ee","namespace":"openshift-ingress","uid":"2ccd9fc0-9408-42db-adf7-7a2445d16889","error":"tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-inf-a-4585ee\" not found"}
{"level":"error","ts":"2026-11-02T22:16:08.006Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-inf-a-4585ee","error":"gateways.gateway.networking.k8s.io \"e2e-inf-a-4585ee\" not found"}
{"level":"info","ts":"2026-11-02T22:16:14Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-inf-a-dd28e6","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-a-dd28e6","reconcileID":"3ffb70ac-dc39-4276-a422-3727fa505300","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-inf-a-dd28e6","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T22:16:14Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-a-dd28e6","event":"CREATE"}
{"level":"info","ts":"2026-11-02T22:16:14Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T22:16:14Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-02T22:16:14Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-02T22:16:14Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T22:16:14Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-inf-a-dd28e6","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-a-dd28e6","reconcileID":"e8b4bef0-5825-424b-a3ee-d962a1e1b8d3","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-inf-a-dd28e6","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T22:16:14Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-a-dd28e6","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T22:16:14Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T22:16:15Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-02T22:16:15Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-02T22:16:15Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-02T22:16:15Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T22:16:15Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-inf-a-dd28e6","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-a-dd28e6","reconcileID":"388912d2-e2e2-45b7-8ffe-604104442941","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-inf-a-dd28e6","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T22:16:15Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-a-dd28e6","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T22:16:15Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T22:16:15Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-02T22:16:15Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-02T22:16:15Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-02T22:16:15Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T22:16:19.983Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","AuthPolicy","Limitador","TokenRateLimitPolicy","Kuadrant","ConfigMap","HTTPRoute","EnvoyFilter","Gateway"],"eventTypes":{"create":1,"delete":13,"update":110}}
{"level":"info","ts":"2026-11-02T22:16:20.379Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:16:20.399Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T22:16:23.059Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T22:16:23.460Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T22:16:23.656Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:16:23.656Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T22:16:23.857Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:16:27.094Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:16:27.099Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:16:27.148Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T22:16:27.152Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:16:27.152Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T22:16:27.165Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:16:27.377Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T22:16:30.629Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T22:16:30.629Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T22:16:32.335Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Kuadrant","Gateway","TokenRateLimitPolicy","AuthPolicy"],"eventTypes":{"create":2,"update":2}}
{"level":"info","ts":"2026-11-02T22:16:32.631Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:16:32.638Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T22:16:36.042Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T22:16:36.043Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:16:36.130Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T22:16:36.226Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:16:36.226Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T22:16:39.805Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:16:39.805Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:16:39.839Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:16:39.839Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T22:16:39.845Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:16:39.845Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"error","ts":"2026-11-02T22:16:39.883Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-inf-a-dd28e6","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/ratelimit":"true"},"name":"kuadrant-ratelimiting-e2e-inf-a-dd28e6","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-inf-a-dd28e6","uid":"d3a82459-b6d7-4a13-9725-ba2076fa17d6"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"limitador-limitador.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-ratelimit-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"limitador-limitador.kuadrant-system.svc.cluster.local","port_value":8081}}}}]}]},"name":"kuadrant-ratelimit-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-inf-a-dd28e6"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-inf-a-dd28e6\" already exists"}
{"level":"error","ts":"2026-11-02T22:16:39.953Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:16:39.953Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T22:16:39.960Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-dd28e6","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-inf-a-dd28e6#rule-2"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"40e0cb771c648ceb2a0ee3a2669e598e6360431b7118a681dc3e080f465910f4","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["40e0cb771c648ceb2a0ee3a2669e598e6360431b7118a681dc3e080f465910f4"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-dd28e6.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-dd28e6.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"40e0cb771c648ceb2a0ee3a2669e598e6360431b7118a681dc3e080f465910f4\" already exists"}
{"level":"error","ts":"2026-11-02T22:16:40.003Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-inf-a-dd28e6","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"kuadrant-auth-e2e-inf-a-dd28e6","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-inf-a-dd28e6","uid":"d3a82459-b6d7-4a13-9725-ba2076fa17d6"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-auth-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local","port_value":50051}}}}]}]},"name":"kuadrant-auth-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-inf-a-dd28e6"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-inf-a-dd28e6\" already exists"}
{"level":"error","ts":"2026-11-02T22:16:40.029Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-dd28e6","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-inf-a-dd28e6#rule-4"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"f13a0da8b101fb07b97a431dc942f81dd0bbdc060a1ab841eabf8a35d08378d6","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f13a0da8b101fb07b97a431dc942f81dd0bbdc060a1ab841eabf8a35d08378d6"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-dd28e6.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-dd28e6.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"f13a0da8b101fb07b97a431dc942f81dd0bbdc060a1ab841eabf8a35d08378d6\" already exists"}
{"level":"error","ts":"2026-11-02T22:16:40.123Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-dd28e6","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-inf-a-dd28e6#rule-3"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"cadecb3d2ef581770e646697462759b8615722ad8d0b026b89324f6cb5d392aa","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["cadecb3d2ef581770e646697462759b8615722ad8d0b026b89324f6cb5d392aa"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-dd28e6.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-dd28e6.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"cadecb3d2ef581770e646697462759b8615722ad8d0b026b89324f6cb5d392aa\" already exists"}
{"level":"error","ts":"2026-11-02T22:16:40.262Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-dd28e6","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-inf-a-dd28e6#rule-5"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"6b8c2c1d0ad8500090d8712218e9f2ad0ae4868196347013ad6b1112fc30c004","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["6b8c2c1d0ad8500090d8712218e9f2ad0ae4868196347013ad6b1112fc30c004"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-dd28e6.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-dd28e6.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"6b8c2c1d0ad8500090d8712218e9f2ad0ae4868196347013ad6b1112fc30c004\" already exists"}
{"level":"error","ts":"2026-11-02T22:16:40.335Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-dd28e6","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-inf-a-dd28e6#rule-6"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"367523cfb64ff15643874e12a833388388fc16133685d340da1773f6658b212b","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["367523cfb64ff15643874e12a833388388fc16133685d340da1773f6658b212b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-dd28e6.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-dd28e6.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"367523cfb64ff15643874e12a833388388fc16133685d340da1773f6658b212b\" already exists"}
{"level":"error","ts":"2026-11-02T22:16:40.410Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-dd28e6","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-inf-a-dd28e6#rule-1"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"72caf46dae9fe0088c1f779cd468b7fb66ba49af22df0324b40b892b7c857043","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["72caf46dae9fe0088c1f779cd468b7fb66ba49af22df0324b40b892b7c857043"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-dd28e6.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-dd28e6.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"72caf46dae9fe0088c1f779cd468b7fb66ba49af22df0324b40b892b7c857043\" already exists"}
{"level":"error","ts":"2026-11-02T22:16:40.468Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/83347b22b39f90dc1745fda92c1f54225231fdb6a74d2d1c1fd6796a0ed80948","error":"authconfigs.authorino.kuadrant.io \"83347b22b39f90dc1745fda92c1f54225231fdb6a74d2d1c1fd6796a0ed80948\" not found"}
{"level":"error","ts":"2026-11-02T22:16:40.524Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/4f0a0c87e5d7ed369aec83ed2882eaa5080f1041a5f0aea4dc5cb61ec8c5db62","error":"authconfigs.authorino.kuadrant.io \"4f0a0c87e5d7ed369aec83ed2882eaa5080f1041a5f0aea4dc5cb61ec8c5db62\" not found"}
{"level":"error","ts":"2026-11-02T22:16:40.579Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/7d8554a477717c664cbf12161848dc09b9865d6817e4ccae5ddcb881fe6b1096","error":"authconfigs.authorino.kuadrant.io \"7d8554a477717c664cbf12161848dc09b9865d6817e4ccae5ddcb881fe6b1096\" not found"}
{"level":"error","ts":"2026-11-02T22:16:40.633Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/3a150d98fb33bbd01d70d3d5a52cf1c36308b4c93bae34d7b87e1f96a993db09","error":"authconfigs.authorino.kuadrant.io \"3a150d98fb33bbd01d70d3d5a52cf1c36308b4c93bae34d7b87e1f96a993db09\" not found"}
{"level":"error","ts":"2026-11-02T22:16:40.688Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/4a1bb86a884be98d485b1ae1b657f862b37796a9406359b3d8c1f53d0d297c9c","error":"authconfigs.authorino.kuadrant.io \"4a1bb86a884be98d485b1ae1b657f862b37796a9406359b3d8c1f53d0d297c9c\" not found"}
{"level":"error","ts":"2026-11-02T22:16:40.743Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/b9c4422b0ac623be5c1841c30cf66ef2cf600040ece866a9dd815005b7a5552f","error":"authconfigs.authorino.kuadrant.io \"b9c4422b0ac623be5c1841c30cf66ef2cf600040ece866a9dd815005b7a5552f\" not found"}
{"level":"error","ts":"2026-11-02T22:16:41.835Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-inf-a-dd28e6","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"name":"kuadrant-e2e-inf-a-dd28e6","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-inf-a-dd28e6","uid":"d3a82459-b6d7-4a13-9725-ba2076fa17d6"}]},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"367523cfb64ff15643874e12a833388388fc16133685d340da1773f6658b212b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-dd28e6-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8b2b2edb\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-dd28e6\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-dd28e6\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8b2b2edb\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-dd28e6\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-dd28e6\"]}],\"name\":\"62009a3036ccd2e3fc17419ea09a53834e74ac23b54e2c90f0198174822fd6b6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"40e0cb771c648ceb2a0ee3a2669e598e6360431b7118a681dc3e080f465910f4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-dd28e6-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8b2b2edb\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-dd28e6\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-dd28e6\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8b2b2edb\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-dd28e6\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-dd28e6\"]}],\"name\":\"3e06face95a3104520fabfbb961ac6057d7b735b2b119828aa2143a59176eee2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6b8c2c1d0ad8500090d8712218e9f2ad0ae4868196347013ad6b1112fc30c004\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-dd28e6-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8b2b2edb\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-dd28e6\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-dd28e6\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8b2b2edb\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-dd28e6\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-dd28e6\"]}],\"name\":\"572f1bc9de1dda317bcae85e83039cf9b7b9e6c3b552c4792a105b2a6d3ecf8d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cadecb3d2ef581770e646697462759b8615722ad8d0b026b89324f6cb5d392aa\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-dd28e6-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8b2b2edb\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-dd28e6\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-dd28e6\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8b2b2edb\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-dd28e6\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-dd28e6\"]}],\"name\":\"a74ee860acb79956147d33c68c446602b7940bb0c29ab5b899f0fb77ec5bb798\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f13a0da8b101fb07b97a431dc942f81dd0bbdc060a1ab841eabf8a35d08378d6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-dd28e6-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8b2b2edb\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-dd28e6\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-dd28e6\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8b2b2edb\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-dd28e6\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-dd28e6\"]}],\"name\":\"5ea4337f87ea79f791f25977c2241de7c7630c1d1d781e0587e10fbf5a618ac3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"72caf46dae9fe0088c1f779cd468b7fb66ba49af22df0324b40b892b7c857043\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-dd28e6-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8b2b2edb\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-dd28e6\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-dd28e6\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8b2b2edb\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-dd28e6\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-dd28e6\"]}],\"name\":\"1ec3b60448f2ca1f1bbfb6b6ee9fba8482844197c73f520ed258ca9fb534e4b1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-inf-a-dd28e6"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-e2e-inf-a-dd28e6\" already exists"}
{"level":"error","ts":"2026-11-02T22:16:41.997Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-inf-a-dd28e6","namespace":"openshift-ingress","uid":"3e1bdf60-4177-43d9-b7db-08f5d5d2b75d","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-inf-a-dd28e6\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:16:42.762Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-inf-a-dd28e6-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-inf-a-dd28e6-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:16:42.897Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"maas-gateway-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"maas-gateway-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:16:43.597Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T22:16:43.597Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T22:16:43.911Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"maas-api-route-e2e-inf-a-dd28e6","namespace":"odh-ai-gateway-infra","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"maas-api-route-e2e-inf-a-dd28e6\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:16:44.281Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-inf-a-dd28e6","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-inf-a-dd28e6\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:16:51.773Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["EnvoyFilter","AuthConfig","Gateway","HTTPRoute","AuthPolicy","Limitador","TokenRateLimitPolicy","ConfigMap"],"eventTypes":{"create":9,"delete":6,"update":7}}
{"level":"info","ts":"2026-11-02T22:16:52.215Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T22:16:54.333Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T22:16:54.524Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:16:54.524Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T22:16:58.139Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:16:58.156Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:16:58.163Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-02T22:16:58.163Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T22:16:58.223Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:16:58.229Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:16:58.229Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T22:17:02.325Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T22:17:02.326Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T22:17:03.952Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy"],"eventTypes":{"update":1}}
{"level":"info","ts":"2026-11-02T22:17:09.337Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:17:09.347Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-02T22:17:09.347Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T22:17:09.357Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:17:09.357Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-02T22:17:11.247Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/maas-default-gateway","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T21:16:03Z","generation":21,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"371b36ef-c4b7-499a-87db-1bdf4e8f92de\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:15:43Z"}],"name":"kuadrant-maas-default-gateway","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"maas-default-gateway","uid":"371b36ef-c4b7-499a-87db-1bdf4e8f92de"}],"resourceVersion":"114625","uid":"86b5bad7-2bb7-41c9-b2c7-bb4c8f13292a"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"61b044087f8d56658ae99d15d4fab3cf1ad74e6636795c133e054a5aace0540d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e511d90f2140d9cde0b2100a0a488dacadd8f510bb901601d5e6fd25343a0f1c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"1e42d143d6033a677e2aa0de97c78600094e515d7c0d3f86b4925ef8be636163\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"26b7799af8a40e8b9585c255ec018a63b0074c27282d4dccebed45f14e703b5e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"ce74c295ef1588342c7308478a1dc6f6aa2cefc063e489a124e536ac32ecfdba\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"fbe95a07558afcf05ef68ff5beb293f527d6ab93dfe79956b5406dc463d78363\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"40a29ce438b5ca497e4389ce52025a9b91c0cf3177b1bd5c8519b041cfdcf75f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"845137604829fbc62550504d7bbe5ae8d55ea1cf474160cd789a72e811000e4b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5322619ef71b1d1ea3204f9014d0341d4402275b6ca23fca69d61cfc9a61e883\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"16b86e50920afda06ca195a717436238f5fca7f2e1bbe0939875bcb7d559cf31\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5da9070dfa3a5637213b5443376170dda26f57f381af542891ff3b19cc7a9d06\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"00ac1aeee65e93fab2ccfd89c11167f4d954e1cfb3e8b09ad3371a4fab4b6369\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"55c23b9552cb66c175ed2202220df6480eae89be2cda2e925458acf31c5bdbce\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"99f16470bd82ba57465b128d1c0fe73ef189001d77c6ead3fc34c98ad3ce27a2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"a6d134df42d4d90d93840f63dc770cadabd22dc22af01f991b6c067e96733c95\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"0be74a5083c4760789001949965ce7020664f6347b769f9f20735f95f9d34989\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4902f5a84509d49ec2fb75275af9692b524b1334f7c919eff1d9f33957acd5c4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4f0e9d14c4d1857d5415458306310b00d6a94ce68179c717917d13d30ede9b87\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"29d1c55f30b76c66bfb15588c297271fac7d5e9ca415f0c938d63e524a8187e5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"df729ecdaa88f0abfee16b94ea7be9c5aa7ccdfe91fbe0676e22ca4bfae35f29\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"69baf76a5f2e8f4f8d3e40025586b942794274a22455dc40e0b7c0116f0d2297\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"8199294e302361a6898546d62809d67d522e9c2b375c8b8727f0d966f7ad4d39\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"61ef91ec2e76cc107813a7351d7e38bb32d1ebbff452efa771b01f8a512fb99e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"f2d9c20918355999f92bc489c836e0d17ed8acb713739da4b73fc8ee019fc8a4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"c19d17a63dc280a83fa4dce8ef0f825a16118c6817d3126d095473335018edd0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"05aa8311318e9111c5925f4be454406e209ab832bc6e8ddf01725ebe4f1ffdcc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e680857c19914d59f115788ea93836704a1ddab04f5e495bf863d62ad8a5aa8e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"96b761d418352e3f8d172aa80bfb5542df670414bec97704e615f2e3e665c8aa\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4a199d441e37ffe8d62509ae7048cfd055df0de5619e9be81a8f47f9a64a7051\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"f17cbb57db714a7faf03a7e4ef3921069096709486e13c6b84b4b75ded84ca96\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"d8631ed26c63871d1138b31e9c971d72ad1152273309b27ee33862700ff4fb0c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"67a5fec0fb2398a03579a732c5e4640c9f9c5db5385b91db90ffb49522369904\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e5b5be5a42ead835fa1a13840fda21cf5afb14b8226da9a3008a321db777f685\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"a01c6bf1aa626b04ec6a9fc85abb6ced9b4a9c4cafe81d2176013cf3b0b4c4aa\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"0eb9568cf0385cf054d8f3ebcce089d8b225a9fe1b6061e3689f7bd26415f872\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"633e4cdca29207ccc8220565a86635db5bf3f227ef564ee1a0da6a5d6076231e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"ecaead2c94524df89be70a7c961f93dee41ef96545655d22914542a89dffe341\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b9f3d06eb6a92218fa1757dab6cb8e66e42102d46c94e6c0db854f694d6d855c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"7054423a069def7a36dcb993faa1143223d985021782b2552d55a522caf2eba9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"deac1d64e5b84f2fc26848a49153d512090eb1e2bffb72dd7091fd21a1234e18\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"3dbcd4467449162cad999d40988202fafebe535215351d004f1bf05937c76508\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"534f6056dec477fad33defb3049c84dc5497dacd9f6e3f2061b13ba089ed1cbd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"fa823b540319ebed6b9b488f79dda81b66933f7e616cfdaebe3543ae31b33b13\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"fb6ca2eee2169356e662d36e92b2b679a1235a86d976f9807297ad56386f6e2a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"0427c8054235bfb15b63a5a467ab470ce1cca867b5a232117e73059a4ec8891c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4aa2417057e81c2889811e45d786ab1591e3dfafc889b838aad26a3ec2cbfe9b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"acb4b8def068bc86711642e3242fd621a66a54452bf86a82586fc6bf69e8192b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"66831c252eeacbf3e19995c48be4a005b1726766550076c58cb47b979bece639\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"a80090acc18b7b092f5e9f2d49fd8643f16514df89a716f8f69afe4a7afebb76\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"f85e753996f9e90384b461c5504814ca0cada63ea0f44d6630a619ab36edbe08\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b72a3d2d64d0ddc05f076a7fcf59d924552b45080846c09e1084e67867a76e9c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"cd58d9e2c4a744adbc8ab336cd016f27bc1f14a1de2e975afa26b7f5113d1bfe\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"29c80f1787fdadd41eb24cbda56972d49e35d261e06b4f4fcd5851c7e2de3068\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"277489d8f3c2c5149e18b965c81958774efa7e81299a66265853d6af2e16037b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"7c211141c74fe1e91cc494ac860a81616dc49e2a5d1951dc70bf0f42824d53e5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"17df13edb14ef5c49ef0cc29deaea97728695c57b5ccad8feb2b23589083e083\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4e5c1437f299959e62fd8c200a351f13f27078882a4684be54f26facece20f96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"014f0c5a15872002db778e7e40dfcf7dede4ab2db05bb6a08641f5d523cb3afc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b9c6946adb079822c7b75166f990a8c6505dbb8a6487fa707e670ff65560e668\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"bdac37244e7b891cd2973e74c7b0db5110c344505a09a86e51fc6486ba35139d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c92635c142b3184e91a78fe113800dddc971eed3a8849837afdf52df706aa5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"ea8a88726b68ceff7de514d89e12df024a67856b697e02c26b6e762395fdaf0d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"362c4db530a1f2b250b39b0b7388869d8386a8e10d881cefc4c02ca9e97590ec\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"81df9bef1abee093a91a2eaab4b1a53122eb16d4150f27c879439ca5d99112f3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"efc66033da0da4dfd829f59f79b4f7de512c24b6b150aa338f2a963b5d74b7ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b3be2474c46178c0c39839b29d8d7c87b103574b042bb23175ac0e9786fde158\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d3dc05ddf6e7ba7b9f9979bea25d3874196895f35b8f4cdf2a9ecdec10126455\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"13fe2d56bb22ec9a1307da7bad05cdda8724fe788533352aa581ffdc96874c78\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05112428ba8242e3d6eb64227c365ab9f0e9e873d13761ea2e2a4738ccab4a0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"fbd262e90a5eaaf98d72db889488cbe13bdac9381f78343ea46c402679569fb2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"100022a5906a36e4db6527195deaa1f3eba3fada253c82ce0002a171c3d2c1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"9794c132b0cd770efeb9723db862265df6a3584117821e44e2a5660a971c59eb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7def4ca304ff3869be64c2c02523fd9d2ff43465099dcd1124399f293eb4480f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"a86375603000eab9b808785894e0e63f3e53024a46681e97c41a06c4e0c67023\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"54eea38241838159e47386cb814ad20fc30631ee8c42d57f0ff8da80fbbf62a0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"d5b69938a04a8020c8a8d10df4921f2989326ca4811c3843a7201bdb1d5cb848\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-unconfigured-model/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c5a685f2a5ebdef5f1dee488990c0798a45ddce399cf99e7d0c505a5f46c69ac\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"0fcfc87f76b773c6a38375e46d76e569a372370e3ae2e7003932ed8ef776f5bd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fac07f302f653115fda3d376325a268abaf66025ed0e4af73e88bea3f41fe933\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"aa28eac51fc5e37c385a11a534759b09fb7998ba74bb01195dd8ff89d9e9ec43\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model-2/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"06165835c4461c0b16a2bc5bae936aff3c2f351edbef8aa378f1110874acedfc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"17390f436804c5d305f1dcb9ea78a72032310736cf630bb9589448f605bd1fd6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m-premium/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ad8714d3b8aed2a9ffd68fbcf0288557e9c1c059c1b59ad3e9a09910b37fd61b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"c4353817d988db43a8dd6b0d5c29305f9dcda76e19c9ef2c820808b0384a0bf4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-embedding-model/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"726a74c13fee356e859d9317271facbb60b066acbc5571de22d056f13c60878f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"1415e0d2aa117656e44a7d6aeaaf16aa87f18bdeee129f7e6757b2e1c7f996d3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-trlp-test-model/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cad6ab5a81a65fd4cb03a0fefdab5de82aa18c30a5b95078b1d05214b0606f40\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"0629facd48a81e3c82281be4a3f8566f55e61d1a30a8516b23bbb63c58e8f6f8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e5f81c7f7812462ebef000c68dc043013159f22201d2eeecf05c220e809f96ed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"2e292ccc99f990aa723c04a99267923f5b62fb8f3e0ab1a978e8334b9397ada0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-unconfigured-model/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"68502d1c1143a647ad56f2759ea89a4c5b3c74a8054739f7e7ea9ba6535e3b74\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"2b69b629cb2b5224adc61a8925f43333ba0b52ab39260c124057e9e82898937f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"74b47f1aa1203aad58596cbaab10ae46e8fddd08ac49eb57a26bdba532d88e72\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"d1e427bebfc099de9df176c73ee76d5dbd6f77919e840913d3a10818678c7394\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model-2/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3167d3bf853032a93e8569019dcd3e5aa33af9cb580cf9ca138990567fc9d857\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"482d2a79771eafe7f8d177701f43a13c6c4916251440ca00830042e050247443\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-unconfigured-model/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"99606c4eac496429be47144db9f3f48867815df12eb99d7be8073b767d7e44de\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"e635ba9dc59ae1e09b34ee6e0f2718b1c31e6f6b6ff2bc6d05c094fedc42c40b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m-premium/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5d590119308c6f848b12dd3ecdfb1b06cc2fe172af702455c342075944a045ff\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"caf1a50009b65f25df3a996283d38ada17bb57a2ebed842a552f137f6121c63a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-embedding-model/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0e042276580ed8976d8ad3afd87a71640025c28b9b48f5c88eb159ec9998209f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e17697b7e023603155a06feebe0602591826e794ee2f5189abf795c259be1b37\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-trlp-test-model/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0829dbf2b5dc0900de272826295adf351de381b46fa6fba00b896213530780f6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"1e772a79f4b1660c75cf3493e21c9ddb58d2de640363115c57dac03a10f22c33\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cc1ffc2ee4e05618c28c108cac668c0c02eb8e658953439e47a733edab44a1a0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4fe1d1c6df78a26f30e2392ae9da7fc67b0845dfda48a89e247bee6aa536d8e1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-unconfigured-model/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"486615827938fa99814e929fe7dc62bc16f7563179fef855074eb73dc7ce4724\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"ee2f6a8baeba450552a3e168b9df1808bba4e2c59106ad0881ae78aee4fcbd40\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-echo-model/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"98ec9d74d07c88c1e6923ed1cbafd4c5b41bf1763b3a942282f964f72425ae57\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"653f23106eb8a10791805e2f9355c750c56aa6873ef311fe707e76083d93d55d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model-2/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2ddbced6f2f51d410743da1d9db1257d0006d99f38986dd7cc7efd26620791ad\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"1e776cd43733621e16ebc27c91dbdeea062f73e4dde2f494701c85a6843faeed\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d752a44ad8df3a50b5a1147110eb89039ed764e1fed197b1f77e0935c424a90b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"62f67bf9885222d9a86a95e02ed17ae26ad7cf71e15aae0a7517e647c29618ca\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-unconfigured-facebook-opt-125m-simulated/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3083301b5359be118f04faaefcd72fd127f2297a3374ef7231b59a59a31b405c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"e85460469045801c3e6927ab49333ff01612a4899d5a7c29ec27824b9942f3b9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m-premium/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"67c67ce733de50e7b3d797bb248036b01badfe02e958f5f76af05b58a504989c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"f9b414e31cae5d16cc1ad22ba2462b8816d9369a97316f40f32a6e7912fc4f78\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model-2/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2d4a2275e6cbab5c26d5c3cf2d75aa2776066390e5b66f5498b16b26bc596af7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e33110b3dae1dd80b2bfa573def0b488a6fd4f1243962fe81d58e1853ed2d3f5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-embedding-model/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"23672b974f0dbc05100a34c78d2b029e41f1d5a3752f3fcb52915f56db360e25\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"a6183db94e49e3ba0149a19f4e52ff19aebb55d6261b0cacec0656136bd2adf4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-trlp-test-model/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8274337fc3f0de48e5213819aeb4a46559c4f8b3428c1bae43c0d75207ef5264\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"efcdf81b8f74d74207beb897f447376d1f950ae12e8a330f1ae67b0d9dc6a545\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0e89fc4b75d3a5dd95fca2c4d8ae33c7826f05a8016c44eb39e28c3c1860fcfb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"7f0f599e497ae797f3b5922614ceddb3375c007237412d01b520bb7498ef288d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/premium-simulated-simulated-premium/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ab505bdf28287fe00099987c1bde2c2f297c40c792a7f6cb5fbfa5adc44754d3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"06c1aa31be81b1f5c6266514c955712865b30117291a39dd749994f4ce931145\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m-premium/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1704c6bc15d6f547acca888061680f2275f690cb79e5af6fee44747bcf278b95\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"6a8319194e2c2fc998268cdbab03a5aae2d83019f5ac30c316c4e548895b7c63\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"eaeb360b41b3f9e0bd6b247d4dae3eef1ffc3355d6e9408df3f8f71bc7f033b5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"32cfee4e66c307d5ebed6a406d2260f4374553d184b5486fc53cb64bc6ffcd8d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-embedding-model/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"135ffad9bbcd33779a0b9a1c0dc5d5f547356be21489762803640aca855c728a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"3194cef788c3fa9898599a57480aeaed07c6eac2edf957788235b37d22918588\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-trlp-test-model/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"17002b7f0c8e62582ad262d9c2b8b038ee7f2a9327fe34f21fd4f47134b7b8cf\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5acde2b886749c1c54f99db5c33887e6fc5ed0caf412daacfb5df0f329882c66\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a6a6232fd5656520e75d100c41add5f1637dde9705a4ec608bbb90b724c258a5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"37a71c27032e51fdbc7ca688064a47abb86230a8138af6eb55e8069fad975a93\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-echo-model/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"92917da87eaba4f2684cd45947a3698434b99ff4ca6d3ddde51d6573aecb1600\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b2b26e0af9ad7defb486e5d1db19af6bbdd0998559d16f3776651669aeb4d067\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-echo-model/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aa7038625b8f43b0c002f79637065e5ab90468f50f998759d08f2c4640c07c04\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"2a62f0614f6526bc3f195f838aebd1abe29514f2707db40d9ef738d645ccf001\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"de97dd5d45c6eb12b4a1112ed1f362d8544427428d2249a399e26ba069d6aadb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"22b2ec7ec96ee09c9e07a84cd3d313c2223af42433bbb28c5846401f64d5e3c1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/premium-simulated-simulated-premium/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"dc061bec60bd28b1c132bf30965b4810124429576337bcc4a6030617600d1714\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b188b939a496049e47b8ef664d7c7c490722f1753404a08d89ccec1dcb87b8fa\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-echo-model/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"75612d85af2bae456dadd78163b2d2f9015c0a0bf4e20bcb8a555e6a5ab3b8c0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"96bc4fc13cb63707a942ca33034f78d2b39476a10860398523789db3990584d1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a4493fc88328eba553ef36791fbf4706bffae04a1ac501d099b12309ebc85c6b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"d84e45c7a3e370ea510e8e0294e009b29bc2f2ea789c47559293007b6c4410d2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/premium-simulated-simulated-premium/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2d953f7313807988e63546aa32431d96f77e6989c672f8ab42827c1c21918630\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"dd2f15d9a08862ab664dadf9bf5da25828d327a11a07849fa919713f034c2b0d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/facebook-opt-125m-simulated/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d69b9c128f599c9ea1af84bb3e783ed71688baf6b3ad2b86f2b7183f9a4208b9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"4dfeb9ff2318af8f84e70b11545800bb83948c080a97ae1ece5780d4022bb383\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"dd89509e97b96670685602ae2d08749226db8693944d2c6f868af9d3e0a5feb5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"1025db78adc8b9c9592b692cc227b1a306a99ac5502300d9ed4ed7615f5e3ef8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/premium-simulated-simulated-premium/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3386c5e86c72abcdab369776ccd7182024ab8681cbe497e81724868f101a3c0c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"58e90354179740b1af406b2911c9997f3f3283475aeb77ce7918f3b3239a293f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9e75e9fd02f51c2f043b145c5d6b82e95f1447b388ee529262aea27a6a2774ef\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b89d1075a79c93acaa097e4e6db4d6a4b23bf3ffe5e964409e29b258ed725a99\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-2-simulated/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0913a452a02695c6681f1037232199b40b64236fed4d29cdbb41561695826340\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5c0b495d1a10c1cf1548ef17998cb18c0ca25371ad42d5ffe1aed42bd55e31ad\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-unconfigured-facebook-opt-125m-simulated')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"010adf02b2e7deb40c572f4729b6dd4619847c8e6344137326b72df28772fc1a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"c04f8a7c7387e6794115c41161cb001d8a07340d2878cb8f36774a8f6a200ba4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"105cf4dd91a8abf4a93abd65b255521c3d37b560b5d23f3ec59757b5b362fae6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"7e7d1a0ec6d957a4d4de94f93078f10e836b23442c9cfa90f11c8520cca12e87\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-embedding-simulated/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"75fd86e2a4870af5fd78f2ad7aa2a9d79aff977b3678d81954b1e207a9315f2c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"c3cfc634a11046a837448628e2f17db0ed3466194da289a808544d874ecf6451\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-trlp-test-simulated/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"54cd0149b818480305f3d0024b3c95629cafb641b48195d003b2b7006d5c6bcd\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"f5bc618bde549671e84473b23ef3632426f8606e2045744a860c603f2a7675d3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bf65ad13397c94660867eb0205e06d1c9bebda4b019f632c0d0b8ef989930381\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"d8d67afd40f17474755bd3f6b00e265761bf5154febca129bc3f2b0bcd749c41\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-simulated/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f9fa9cfc2b4e701183573419a92c79384cd30210289602f0115c75c5029d55aa\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"ac2105eead12bb02dd7d1691cc77fc8a580b903f98564a8fd585dfa345dec1dd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"596921ddc7ba8523386263c5cffcbd6ad9b6a385318ed7e24f72be06f36fc398\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"f4ae34c5c82a0969651301a535f404653a60a5d75f20c7ea56ad9bb89b67e9fb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f95805f0e9b755664735d898c1d644d571943be553204d3f86136bc35719ff13\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"95c39f44eae69bd53f57e5ff93243887dafd591c9b8cf2e736f0ab034e67021d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/facebook-opt-125m-simulated/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8d5571efc1d304f5bcfc2ffb4ac6819154ba5556c29ce33416d460b887427984\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5d6b359055267732253f201a1fe48f0abe6d5e22b011c70e1cb006eea672f535\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e91aceffc2d4f6d6b120625bd3ca23781b74a1cae6cf1da26bda310bbed0ef07\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"c8475d27649a649c955538ff79eb001372050ff4f1d4ad295b01dc6fcc69ba2a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/facebook-opt-125m-simulated/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a402d1681ab35bace735c19b1d084a86eb3d741d4e1c14371cfdaa55d22c3ebe\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"7320c049419b863194fd55db5ebd887462dd24e1289e6308d79f047431f2bed9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-2-simulated/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f9b535aed6243496a67741936e53a0d303bea1b872a06fb62f1f9c27150edc40\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"5eeab80447ec6c71797517b4d94c6623353e89097743360eadd7f31115976dfe\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/facebook-opt-125m-simulated/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a9800464506c58f005016df354e160757732171ff4d19747202524955329b998\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4984a24eb707d1b965a79974a98ed4afc271f2ca356b150cbc8943de1ddcfef8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-embedding-simulated/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c82a1a3dc2ce54c0b664f79a2cd895a3c40f774b3694999badae8cedd328292e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"276f5d5d67b2bd83c05c2b39e4a262885498e6807e3129a866eff0651b3604a9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-trlp-test-simulated/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"669658556fba0f45c2a82def2f57614416614ddf154ed8dc5f4f9188f10130f2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"692f39321f892929348fe56801dc14c8a35eaf749609a3a5f4b5e684edddf17c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-2-simulated/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c4399a95e89654e5b2bb5fabe45bc947d11ccd1448ebf64c30b195b34f239d58\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5b273834f06c6341dd07bba6c809b3297ba2514e6d3b9b5d0f4f8211c68ccf8b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-simulated/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5e4821ff903ad6ca2e1c42162432e34d8b0a2a78052961e753d36b742193432f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"f35ed2fb168a3a608435006c8c1b103242765d7d37f41bf1dbdb7bbc0331da89\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a91faccafad197e2a4065ce3d12a052ac484d2e8fb2fc9265ee48f02b28e6dce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"fbfd0ada86117ffb0a134e591bf8b8390012983d25496ef188c6da73fef5eaec\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-2-simulated/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0020c64019ffd1a0bdcc75e6441e6a30e6d8bb08f463f67bd2408a1e82b95b2a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e78a4964c93ec23890e62f7f50201f5b832b4c714066a914dc734d8ef60e8213\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-embedding-simulated/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7c924aa2b37ea38067b4e69052d541ea2e7c86fbdaa79b19f9ea09e87adbe4ff\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"d5cf96eeeaa56bb891ea0cba28f7beabf17a8c0f061ea01c768ed842dd26334f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-trlp-test-simulated/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"028a8b5bd5d4e690eebb2f20c5fd47cf0b3c6e2a3619ba9e55322bbca7b94cc3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"8fe4100eab1f023f5b06dd8e19bcc80109b82503466d49576acc234cdda9bf0e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-simulated/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"80056c658070f49140955cb6eabdbd252857a614af6b0f2f2de7a1ab1cd47949\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"53aad0199369eb8c8f787ea099e93092089c04344e8f910dcff366f54bc831cb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-embedding-simulated/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2416d7b42d11a09d7152746be0e114f8fdc87d0fbd0efa9dec5b52b011082194\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e0cfec53d1f17771317082d9a7d69806ae3468971bac79a1135f2b0d51ecdc07\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-trlp-test-simulated/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"50c2058cf11e07a931b06ac4446a56eee86855f00badf26618abe486a7bdcfd7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"f3b6e6c38a521fae8ef5c7fddf3b3178baba88effb4e5338e0b387e28ecc468d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"134a7a790ba665547ca14f80f917549f66ee5063fc41096471c0778399db6dd5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"4ddd3fa1f54c642a57a48737e710ec0116705776084d8cebd8134dfa49accdde\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/premium-simulated-simulated-premium')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4d18a96899c43d55ee63d2ae1a7a938c7e873d88b2fd95f06b2e3aae2c7f1c84\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"44e38055536c3f0d49cb81abb42bfefcf2c78faf963a6160afbe459bbc04db39\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-simulated/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8d34bd12ba2030284fcb69127f53b8158bbdd4a1432bfe619165b4c2c96cc061\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"c9dd9c233e43b53241ee27e937246e51b8f3331f30a7fba22640617c1b0bf47a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/echo-simulator/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"319e246831bdaf5e765e63d5511b516594fd2b64527850e2ddabd2a4a85532ea\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"7cfd2ed5cb8a5913fa5f55b92b02805c6778991c01c80eb14a0962cc710a56ff\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/echo-simulator/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a8c8220ad6f1387002e262ace5db78a2c4bb39e5953306702a228215174f6796\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"87e1712d02794c6d66ec1a932f02901d7a4369f46d0f041178cd3efadb7f59b7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/echo-simulator/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1e077a716d89a43572a3c16e8d0b0436816baa48a2ea227603701f10cad6d6f4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"ae9eac2a2b8c8311bb8c6ea82ab445a5d6f50d2d51c3f79962be9d82007097ad\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/facebook-opt-125m-simulated')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3f23315aacd6e16f4ab41f96aeedc9549d1abdfc9476577a47d45d12875dec5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"165d3b8e224f71685dee07aadd133117aeeed097eae99437d561d5bfa2d22233\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/echo-simulator/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6687eb3cec74c6c51428ce3f3d22d50ba269f59015d1bc8f185da49eb095534e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"05ac0e89d0298398d3996609d7c22b514bdf08bfa3787653bc739995c5942441\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-2-simulated')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bfd36c5ed73eb81df97258ffa1aa36d8cbf6f3e7a8096c33ca4ff417be59d002\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"d5ac583036f3821c88111dd82571eab1fc94aa4e9fcd045b27336f798e26075d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-embedding-simulated')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d303c788902ad4467c7ae545d65cbef45564d1c0d56396c93057df3909461aa1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"4a6b0d84cc35c0f532405eea81056481fd54e7ad71284a97ce8f6a2424eac819\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-trlp-test-simulated')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2f53b030326b8e1f5908c601aecd3fffcb6d08a8337d0bdc53ee1fc699a4cd71\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5c3bcd9fb119b0fd45f3b4ba5de5f905cacbb4963fec309a0961a40f76a7a7a9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/e2e-distinct-simulated')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"94ddc5e77f082c32bebc7a36bcebf621518ebf303e83b9c540da1352d04e620b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"50057c9a2acf4ae7152e8c97f7778cb04340d1470974e5272422d0bf244a4e5c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/llm/echo-simulator')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5c6918972d1a7f8ad5201880b7d6d9c1191ca1f25376682f691def7868e3fd02\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"01cc37113b4d6c301e355f63decf46a21e93a023494bdfeaeed2890c97ec1f57\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a82769ff87473da04c27497e160e9b4b1a5dd93578e0cf2342be8b2f06845269\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"e747b72d92315b743934153588614b27670cf0c9d9dc4fb380ea4965def7f235\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"06b05a8e4dd69bdc4f333ad9509ee8cad3c5c0f5dd48edbe94c1158b60f79ed3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"661962837510c6dc6d1faa64e61ec3086efa9e0a2e7315c6ded616c1879e5ba8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b4bfec1b33959dd0ebfc5cd6fb410688e820d4b55c7f149cb4acc4353f30a9b2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a7740f6e77d024a437502c023fb1d8939cb3cc2b9ed7f4073af7d779e19459eb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"f82564e076ea3e672592bab71e048537faba17a5e909884c2a0204e235905a69\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a908063c86927e6bf07b7d793aad9f277ac3c2a8f5f5d468b116cb9e07929b14\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-2-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"fbdfff5b213f506d78434055d011cf63d616653e502ee04408a43578986e1e5c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model-2')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d1d232e06f90d479cd9b802f24889e83af58c51cf54ba273d5e24dcb8a297688\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-distinct-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b49f2d7e152d4de959577465d2494ee11771b4c439cb6eae71c90bff26224fb4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-distinct-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"810f299b76daf089b33c92cfbe0445ab5cc89a48d38e36df0cc89ed6cd1fe8df\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-embedding-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b27d6255cac73fc039120e157e1f3ce0e99e86995ac5a66974d5e8744df6c64d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-embedding-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4f800155f293f82eeaf5fd6a9553c0a1bee90f47a295bba8d7a04b3f11faea33\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-trlp-test-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"b1ccc7ca46f6a14e90afe1dddfab8763f07f30549ce1cda0bae985581f063098\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-trlp-test-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ce7d381faee9ff949d68d825ffa1dcb9247dad19667ec59a8e91847320dacbe0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/e2e-unconfigured-facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"5d72fc7cc241ffd60d83142a900be014cc5d57320142e013493b21ecc86cb534\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-unconfigured-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6565c4085b3917d5390fe1b0194fb3d8319f1d56b45867e3c68ff740b5c16ef3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6d45535f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"llm/echo-simulator-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny\"]}],\"name\":\"be1ccea8a4cc19c7190600de6631fcb661b63db81e2862348a6ef4f90bf33fa3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/test/e2e-echo-model')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8d8c8aae1332bb0300ac2d65be9b8708fbfde6d4b5599ec52380cf1f70956045\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__cec148f9\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"3f98c74fda8361a9\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/facebook-opt-125m-simulated-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-facebook-opt-125m-simulated\"]}],\"name\":\"ca48ea5d9ee701ac5383800306378d945e66ca5427eba33396e6805ebbdc1ea7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f6df6bc14432fdc346191db86ee06e75c8090ed87a32c984493c837e97a10be6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__09f43f13\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"793a52e02f7e18bf\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"llm/premium-simulated-simulated-premium-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:llm/maas-trlp-premium-simulated-simulated-premium\"]}],\"name\":\"fc54a1d4f18d4d59e58b6a3aa31dbfaddda2b89e5c28dc9eacf14ff38a414021\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/llm/models/facebook/opt-125m-premium')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"maas-default-gateway"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-maas-default-gateway\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:17:11.390Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-b-w4-58ca7f","namespace":"openshift-ingress","uid":"5187151d-dfe9-40c2-b03b-5e9a20a0d12c","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-b-w4-58ca7f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:17:11.448Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w3-f51151","namespace":"e2e-models-e2e-worker-w3-f51151","uid":"e3340067-224a-43ad-8020-ca9e00ead152","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w3-f51151\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:17:11.507Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-b-w3-a1d751","namespace":"openshift-ingress","uid":"2c7a0593-2f35-427a-b6f0-958582546c18","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-b-w3-a1d751\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:17:11.565Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w0-0c9014","namespace":"e2e-models-e2e-worker-w0-0c9014","uid":"dcb5a0e4-7049-4ddc-91de-e14d55b09789","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w0-0c9014\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:17:11.623Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w3-f51151","namespace":"e2e-models-e2e-worker-w3-f51151","uid":"c78aa03a-e3ca-4797-8a09-ab0d9cd88148","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w3-f51151\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:17:11.682Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-facebook-opt-125m-simulated","namespace":"llm","uid":"da8edb1a-ed61-454d-939f-fc7cd235d9fb","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-facebook-opt-125m-simulated\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:17:11.740Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-a-w2-06e461","namespace":"openshift-ingress","uid":"c459fc7a-4e41-4226-a9ad-15cf3c29611a","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-a-w2-06e461\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:17:11.859Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w1-5f765a","namespace":"e2e-models-e2e-worker-w1-5f765a","uid":"9c852546-ee7c-4e72-855c-111315f7bf82","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w1-5f765a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:17:11.917Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w2-6fa533","namespace":"e2e-models-e2e-worker-w2-6fa533","uid":"2ff73667-c2c3-4579-9503-b6ca098f1021","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w2-6fa533\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:17:11.975Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-inf-a-72f279","namespace":"openshift-ingress","uid":"adee33c2-f36f-4299-8573-4943c3d76145","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-inf-a-72f279\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:17:12.212Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-extmod-a-d6b384","namespace":"openshift-ingress","uid":"257056bc-db5f-4bc1-a9af-1a8374d5db59","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-extmod-a-d6b384\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:17:12.270Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-simulated-simulated-premium","namespace":"llm","uid":"447993be-3c57-4e68-8ffa-6fc998a39c77","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-simulated-simulated-premium\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:17:12.329Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-a-w4-7cde84","namespace":"openshift-ingress","uid":"83e46bfa-f121-4136-adc9-a9e6690edeab","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-a-w4-7cde84\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:17:12.387Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-b-w2-c7e71f","namespace":"openshift-ingress","uid":"6decd2e5-6aa1-451b-97e5-5dd8911def76","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-b-w2-c7e71f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:17:12.445Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w1-5f765a","namespace":"e2e-models-e2e-worker-w1-5f765a","uid":"7188eadc-9748-4be8-a5e2-d904cf5b6130","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w1-5f765a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:17:12.503Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-b-w0-0f0874","namespace":"openshift-ingress","uid":"8b4ec7cb-daa9-467a-b2f6-528aa3d837fc","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-b-w0-0f0874\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:17:12.561Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-a-w3-97995b","namespace":"openshift-ingress","uid":"9405e4ea-22ff-4c46-bbc0-f492e0e403dc","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-a-w3-97995b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:17:12.620Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w2-6fa533","namespace":"e2e-models-e2e-worker-w2-6fa533","uid":"3a128bb2-de88-49aa-ab9e-c8626107a077","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w2-6fa533\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:17:12.738Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-inf-a-dd28e6","namespace":"openshift-ingress","uid":"3e1bdf60-4177-43d9-b7db-08f5d5d2b75d","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-inf-a-dd28e6\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:17:12.855Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w0-0c9014","namespace":"e2e-models-e2e-worker-w0-0c9014","uid":"4f647df6-1d5b-433b-b4fc-1279ff1755f7","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w0-0c9014\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:17:12.913Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w4-d6cb38","namespace":"e2e-models-e2e-worker-w4-d6cb38","uid":"0d3ebd35-5005-4ee4-a055-ff95546e3673","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w4-d6cb38\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:17:12.972Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-a-w0-6e535d","namespace":"openshift-ingress","uid":"0eae774a-4032-4461-b2be-6f3edd911a80","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-a-w0-6e535d\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:17:13.031Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w4-d6cb38","namespace":"e2e-models-e2e-worker-w4-d6cb38","uid":"486176e6-7786-40c4-9ce0-6f4a68b408b2","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w4-d6cb38\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:17:18.077Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","AuthPolicy","EnvoyFilter","ConfigMap"],"eventTypes":{"update":26}}
{"level":"info","ts":"2026-11-02T22:17:23.468Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:17:23.523Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:17:23.532Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-02T22:17:23.532Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T22:17:23.636Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:17:23.636Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T22:17:25Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-inf-a-72f279","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-a-72f279","reconcileID":"1e7e2d14-bcb8-4179-8294-85ba1611ff79","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-inf-a-72f279","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T22:17:25Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-a-72f279","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T22:17:25Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T22:17:25Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-11-02T22:17:25Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T22:17:25Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-11-02T22:17:25Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-inf-a-72f279","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-a-72f279","reconcileID":"1e7e2d14-bcb8-4179-8294-85ba1611ff79","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-inf-a-72f279","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T22:17:25Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-a-72f279","event":"DELETE"}
{"level":"info","ts":"2026-11-02T22:17:25Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-02T22:17:25Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-inf-a-72f279\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-02T22:17:25Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"error","ts":"2026-11-02T22:17:26.848Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-inf-a-72f279","namespace":"openshift-ingress","uid":"adee33c2-f36f-4299-8573-4943c3d76145","error":"tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-inf-a-72f279\" not found"}
{"level":"error","ts":"2026-11-02T22:17:27.591Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-inf-a-72f279","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-inf-a-72f279\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:17:38.105Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Kuadrant","Gateway","ConfigMap","TokenRateLimitPolicy","HTTPRoute"],"eventTypes":{"delete":2,"update":3}}
{"level":"info","ts":"2026-11-02T22:17:38.304Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:17:38.324Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T22:17:41.256Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T22:17:41.759Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T22:17:41.985Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:17:41.985Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T22:17:42Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-extmod-a-d6b384","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-a-d6b384","reconcileID":"3df173fb-56f1-4f46-9994-77a3177055cd","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-extmod-a-d6b384","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T22:17:42Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-a-d6b384","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T22:17:42Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T22:17:42Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-11-02T22:17:42Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T22:17:42.243Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:17:42Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-11-02T22:17:42Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-extmod-a-d6b384","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-a-d6b384","reconcileID":"3df173fb-56f1-4f46-9994-77a3177055cd","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-extmod-a-d6b384","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T22:17:42Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-extmod-a-d6b384","event":"DELETE"}
{"level":"info","ts":"2026-11-02T22:17:42Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-02T22:17:42Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-extmod-a-d6b384\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-02T22:17:42Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T22:17:45.846Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:17:45.850Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:17:45.857Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T22:17:45.872Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:17:45.872Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T22:17:45.923Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:17:45.974Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T22:17:48.665Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-extmod-a-d6b384","namespace":"openshift-ingress","uid":"257056bc-db5f-4bc1-a9af-1a8374d5db59","error":"tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-extmod-a-d6b384\" not found"}
{"level":"error","ts":"2026-11-02T22:17:48.847Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-facebook-opt-125m-simulated","namespace":"llm","uid":"da8edb1a-ed61-454d-939f-fc7cd235d9fb","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-facebook-opt-125m-simulated\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:17:49.150Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T22:17:49.150Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T22:17:49.582Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-extmod-a-d6b384","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-extmod-a-d6b384\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:17:50.756Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway","EnvoyFilter","AuthPolicy"],"eventTypes":{"delete":5,"update":1}}
{"level":"info","ts":"2026-11-02T22:17:56.728Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:17:56.741Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:17:56.741Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T22:17:56.743Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:17:56.743Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:17:56.750Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"error","ts":"2026-11-02T22:17:56.858Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/e03cb0845f90d6a18a9a9657441002b5cfe4f1a82ed60e1371a433c17c76081d","error":"authconfigs.authorino.kuadrant.io \"e03cb0845f90d6a18a9a9657441002b5cfe4f1a82ed60e1371a433c17c76081d\" not found"}
{"level":"error","ts":"2026-11-02T22:17:56.860Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:17:56.860Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T22:17:56.912Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/d46c84d7a4f4c67d985c060ac96365bc2296efc839ca0a629e15b7917ed34608","error":"authconfigs.authorino.kuadrant.io \"d46c84d7a4f4c67d985c060ac96365bc2296efc839ca0a629e15b7917ed34608\" not found"}
{"level":"error","ts":"2026-11-02T22:17:56.970Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/0f045ee5bcfa76fccf818707f08da70f7997e3dcab44861f8ba72f46c548cff9","error":"authconfigs.authorino.kuadrant.io \"0f045ee5bcfa76fccf818707f08da70f7997e3dcab44861f8ba72f46c548cff9\" not found"}
{"level":"error","ts":"2026-11-02T22:17:57.045Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/0d147fe9313680b4fb1ff5f05bc428e0537ac4c25eb847ccd92a30558d2f6628","error":"authconfigs.authorino.kuadrant.io \"0d147fe9313680b4fb1ff5f05bc428e0537ac4c25eb847ccd92a30558d2f6628\" not found"}
{"level":"error","ts":"2026-11-02T22:17:57.123Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/3aa6865734f6d5a5b3ecb6aed2ade9be1ebe9bf0728be6a4dbd30330dd94c219","error":"authconfigs.authorino.kuadrant.io \"3aa6865734f6d5a5b3ecb6aed2ade9be1ebe9bf0728be6a4dbd30330dd94c219\" not found"}
{"level":"error","ts":"2026-11-02T22:17:57.178Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/f3255b398183380b1af1af7896d3f2108a40b397fc7d7f1fbbfa7f2d210dcdce","error":"authconfigs.authorino.kuadrant.io \"f3255b398183380b1af1af7896d3f2108a40b397fc7d7f1fbbfa7f2d210dcdce\" not found"}
{"level":"error","ts":"2026-11-02T22:17:58.109Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-extmod-a-d6b384","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T22:15:20Z","generation":1,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"58b5c4fb-0eda-40d4-b12e-3716657f277e\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:15:20Z"}],"name":"kuadrant-e2e-extmod-a-d6b384","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-extmod-a-d6b384","uid":"58b5c4fb-0eda-40d4-b12e-3716657f277e"}],"resourceVersion":"113942","uid":"90a17d1c-f612-4195-95a8-cb5a6ab6517b"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"47bacfe50a213dcddc73a2f63780fdd4b64d34c82079c11250fa90215fd5496c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-extmod-a-d6b384-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6f08779b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-d6b384\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-extmod-a-d6b384\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6f08779b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-d6b384\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-extmod-a-d6b384\"]}],\"name\":\"8ce08e91dc2743b9dbad3938ed2a51e89f2cf76e9dffb10bcd9b64c8e55bb5f4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"703f98dc1a58dd1e8a2458b701255a4caef2972883582a829e1b98f566899757\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-extmod-a-d6b384-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6f08779b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-d6b384\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-extmod-a-d6b384\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6f08779b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-d6b384\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-extmod-a-d6b384\"]}],\"name\":\"1a26bcf1c27524466e8797f64de5b2cc0e73dfbd52079401e43492ec33f8a01d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"caf8eb698a0af2f8e219f5cf5d527e9f8cd7751e407b11c2483ba2544ce2d058\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-extmod-a-d6b384-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6f08779b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-d6b384\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-extmod-a-d6b384\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6f08779b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-d6b384\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-extmod-a-d6b384\"]}],\"name\":\"b097a0b1b5fdb9efb5388534e76b835994e0b531f27d5116ae818802dcdd2498\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"64bce16e042b4f345c3890673202f961162ffd322e8899983ff6a4bbb09210f4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-extmod-a-d6b384-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6f08779b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-d6b384\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-extmod-a-d6b384\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6f08779b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-d6b384\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-extmod-a-d6b384\"]}],\"name\":\"3ac0f91b6e01723dd498af9b388b53ad275176b02c02146d5e1bcb34d1576841\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c8e6047adccdb25a1642ca1112582e779fdbf81c20d70aef9118d3fd9907d3f6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-extmod-a-d6b384-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6f08779b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-d6b384\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-extmod-a-d6b384\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6f08779b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-d6b384\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-extmod-a-d6b384\"]}],\"name\":\"2c3a9a9cf75869bb043b68f38427bf52eed1a3abfe2c549ff6cc588224fb9bd1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8e1d750ad1d58f6bfbfa62bba79cbf1924cc85acc3f233c669cb8a41e56d0d4b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-extmod-a-d6b384-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6f08779b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-d6b384\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-extmod-a-d6b384\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6f08779b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-extmod-a-d6b384\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-extmod-a-d6b384\"]}],\"name\":\"d527b18e47bc37a10f5cba28caaaaca08f3f60a2d9726052aebcac718b2e8533\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}}],\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-extmod-a-d6b384"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-e2e-extmod-a-d6b384\" not found"}
{"level":"error","ts":"2026-11-02T22:17:58.538Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-b-w3-a1d751","namespace":"openshift-ingress","uid":"2c7a0593-2f35-427a-b6f0-958582546c18","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-b-w3-a1d751\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:17:58.656Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w2-6fa533","namespace":"e2e-models-e2e-worker-w2-6fa533","uid":"2ff73667-c2c3-4579-9503-b6ca098f1021","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w2-6fa533\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:17:58.716Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w3-f51151","namespace":"e2e-models-e2e-worker-w3-f51151","uid":"c78aa03a-e3ca-4797-8a09-ab0d9cd88148","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w3-f51151\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:17:58.774Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w2-6fa533","namespace":"e2e-models-e2e-worker-w2-6fa533","uid":"3a128bb2-de88-49aa-ab9e-c8626107a077","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w2-6fa533\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:17:58.837Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-extmod-a-d6b384","namespace":"openshift-ingress","uid":"257056bc-db5f-4bc1-a9af-1a8374d5db59","error":"tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-extmod-a-d6b384\" not found"}
{"level":"error","ts":"2026-11-02T22:17:58.895Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w4-d6cb38","namespace":"e2e-models-e2e-worker-w4-d6cb38","uid":"0d3ebd35-5005-4ee4-a055-ff95546e3673","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w4-d6cb38\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:17:59.080Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-facebook-opt-125m-simulated","namespace":"llm","uid":"da8edb1a-ed61-454d-939f-fc7cd235d9fb","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-facebook-opt-125m-simulated\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:17:59.138Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-b-w0-0f0874","namespace":"openshift-ingress","uid":"8b4ec7cb-daa9-467a-b2f6-528aa3d837fc","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-b-w0-0f0874\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:17:59.202Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-b-w4-58ca7f","namespace":"openshift-ingress","uid":"5187151d-dfe9-40c2-b03b-5e9a20a0d12c","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-b-w4-58ca7f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:17:59.260Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w1-5f765a","namespace":"e2e-models-e2e-worker-w1-5f765a","uid":"9c852546-ee7c-4e72-855c-111315f7bf82","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w1-5f765a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:17:59.317Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-extmod-a-d6b384-maas-auth","namespace":"openshift-ingress","error":"authpolicies.kuadrant.io \"e2e-extmod-a-d6b384-maas-auth\" not found"}
{"level":"error","ts":"2026-11-02T22:17:59.381Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-inf-a-dd28e6","namespace":"openshift-ingress","uid":"3e1bdf60-4177-43d9-b7db-08f5d5d2b75d","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-inf-a-dd28e6\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:17:59.438Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-a-w4-7cde84","namespace":"openshift-ingress","uid":"83e46bfa-f121-4136-adc9-a9e6690edeab","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-a-w4-7cde84\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:17:59.506Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w0-0c9014","namespace":"e2e-models-e2e-worker-w0-0c9014","uid":"dcb5a0e4-7049-4ddc-91de-e14d55b09789","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w0-0c9014\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:17:59.614Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w1-5f765a","namespace":"e2e-models-e2e-worker-w1-5f765a","uid":"7188eadc-9748-4be8-a5e2-d904cf5b6130","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w1-5f765a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:17:59.672Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-a-w2-06e461","namespace":"openshift-ingress","uid":"c459fc7a-4e41-4226-a9ad-15cf3c29611a","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-a-w2-06e461\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:17:59.730Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-simulated-simulated-premium","namespace":"llm","uid":"447993be-3c57-4e68-8ffa-6fc998a39c77","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-simulated-simulated-premium\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:17:59.790Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w3-f51151","namespace":"e2e-models-e2e-worker-w3-f51151","uid":"e3340067-224a-43ad-8020-ca9e00ead152","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w3-f51151\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:17:59.906Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-a-w0-6e535d","namespace":"openshift-ingress","uid":"0eae774a-4032-4461-b2be-6f3edd911a80","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-a-w0-6e535d\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:17:59.964Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w4-d6cb38","namespace":"e2e-models-e2e-worker-w4-d6cb38","uid":"486176e6-7786-40c4-9ce0-6f4a68b408b2","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w4-d6cb38\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:18:00.024Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-a-w3-97995b","namespace":"openshift-ingress","uid":"9405e4ea-22ff-4c46-bbc0-f492e0e403dc","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-a-w3-97995b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:18:00.084Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w0-0c9014","namespace":"e2e-models-e2e-worker-w0-0c9014","uid":"4f647df6-1d5b-433b-b4fc-1279ff1755f7","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w0-0c9014\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:18:00.201Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-b-w2-c7e71f","namespace":"openshift-ingress","uid":"6decd2e5-6aa1-451b-97e5-5dd8911def76","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-b-w2-c7e71f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:18:00.348Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T22:18:00.348Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T22:18:00.744Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-extmod-a-d6b384","error":"gateways.gateway.networking.k8s.io \"e2e-extmod-a-d6b384\" not found"}
{"level":"info","ts":"2026-11-02T22:18:08.605Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Limitador","TokenRateLimitPolicy","ConfigMap","Gateway","Kuadrant","AuthConfig","HTTPRoute","EnvoyFilter","AuthPolicy"],"eventTypes":{"create":2,"delete":13,"update":24}}
{"level":"info","ts":"2026-11-02T22:18:09.014Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:18:09.034Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T22:18:12.069Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T22:18:12.146Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T22:18:12.146Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:18:12.354Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:18:12.354Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T22:18:15.563Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:18:15.570Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T22:18:15.579Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:18:15.579Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T22:18:15.563Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:18:15.623Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-11-02T22:18:15.681Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:18:15.681Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T22:18:19.376Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T22:18:19.377Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T22:18:27.431Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","EnvoyFilter","ConfigMap","Limitador","AuthConfig"],"eventTypes":{"delete":6,"update":4}}
{"level":"info","ts":"2026-11-02T22:18:27.729Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T22:18:29.258Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T22:18:29.461Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:18:29.461Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T22:18:32.851Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:18:32.852Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:18:32.852Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:18:32.852Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T22:18:32.857Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T22:18:32.974Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T22:18:35.990Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T22:18:35.990Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T22:18:43.760Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","Limitador"],"eventTypes":{"update":2}}
{"level":"info","ts":"2026-11-02T22:18:44.106Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T22:18:45.728Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T22:18:45.835Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:18:45.835Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T22:18:49.235Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:18:49.235Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:18:49.241Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-02T22:18:49.241Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T22:18:51.118Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T22:18:51.118Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T22:18:54.806Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Limitador","TokenRateLimitPolicy","ConfigMap"],"eventTypes":{"update":23}}
{"level":"info","ts":"2026-11-02T22:18:55.164Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T22:18:56.668Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T22:18:56.755Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:18:56.755Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T22:19:00.444Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:19:00.454Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-02T22:19:00.454Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T22:19:00.459Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:19:00.474Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:19:00.474Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T22:19:04Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-inf-b-cf2a53","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-b-cf2a53","reconcileID":"1a75c0f8-796c-4546-b078-c1607a600874","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-inf-b-cf2a53","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T22:19:04Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-b-cf2a53","event":"CREATE"}
{"level":"info","ts":"2026-11-02T22:19:04Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T22:19:04.552Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T22:19:04.552Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T22:19:04Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-02T22:19:04Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-02T22:19:04Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T22:19:04Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-inf-b-cf2a53","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-b-cf2a53","reconcileID":"98095a5f-7da2-4a35-bd79-681bdd217d55","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-inf-b-cf2a53","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T22:19:05Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-b-cf2a53","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T22:19:05Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T22:19:05Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-02T22:19:05Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-02T22:19:05Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-02T22:19:05Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T22:19:05Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-inf-b-cf2a53","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-b-cf2a53","reconcileID":"5a118f63-8b96-4836-b219-9a55d8a3acd5","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-inf-b-cf2a53","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T22:19:05Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-b-cf2a53","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T22:19:05Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T22:19:06Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-02T22:19:06Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-02T22:19:06Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-02T22:19:06Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"error","ts":"2026-11-02T22:19:06.919Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-inf-b-cf2a53","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-inf-b-cf2a53\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:19:17.213Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway","ConfigMap","Kuadrant","HTTPRoute","TokenRateLimitPolicy","AuthPolicy"],"eventTypes":{"create":3,"update":3}}
{"level":"info","ts":"2026-11-02T22:19:17.732Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:19:17.753Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T22:19:20.954Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T22:19:21.062Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T22:19:21.161Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:19:21.162Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:19:21.162Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T22:19:24.445Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:19:24.445Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:19:24.456Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T22:19:24.474Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:19:24Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-inf-a-db69f7","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-a-db69f7","reconcileID":"53e7fc66-df7d-469a-948f-a89d10fc4777","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-inf-a-db69f7","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T22:19:24.530Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:19:24.530Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T22:19:24Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-a-db69f7","event":"CREATE"}
{"level":"info","ts":"2026-11-02T22:19:24Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T22:19:24.627Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T22:19:25Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-02T22:19:25Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-02T22:19:25Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T22:19:25Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-inf-a-db69f7","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-a-db69f7","reconcileID":"2eef3a86-da40-4a96-b4c6-0d07b3e1ef2e","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-inf-a-db69f7","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T22:19:25Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-a-db69f7","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T22:19:25Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T22:19:25Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-02T22:19:25Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-02T22:19:25Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-02T22:19:25Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T22:19:27.933Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T22:19:27.933Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T22:19:28.528Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-inf-a-db69f7","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-inf-a-db69f7\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:19:37.006Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","Gateway","AuthConfig","AuthPolicy","Limitador","EnvoyFilter","HTTPRoute","Kuadrant","ConfigMap"],"eventTypes":{"create":12,"update":29}}
{"level":"info","ts":"2026-11-02T22:19:37.469Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:19:37.489Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T22:19:40.449Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T22:19:40.625Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:19:40.625Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T22:19:40.823Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:19:40.825Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T22:19:44.282Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:19:44.290Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:19:44.324Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:19:44.334Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T22:19:44.343Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:19:44.343Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-02T22:19:44.436Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:19:44.436Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T22:19:48.150Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T22:19:48.150Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T22:19:59.600Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","TokenRateLimitPolicy","EnvoyFilter","ConfigMap","Limitador","AuthPolicy","HTTPRoute","Gateway"],"eventTypes":{"create":9,"update":10}}
{"level":"info","ts":"2026-11-02T22:19:59.949Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T22:20:02.358Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T22:20:02.557Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:20:02.557Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T22:20:06.050Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:20:06.050Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:20:06.073Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:20:06.074Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T22:20:06.151Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:20:06.151Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T22:20:06.230Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T22:20:09.581Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T22:20:09.581Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T22:20:11.195Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway","HTTPRoute"],"eventTypes":{"create":1,"update":1}}
{"level":"info","ts":"2026-11-02T22:20:17.379Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:20:17.384Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:20:17.423Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T22:20:17.423Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:20:17.432Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:20:17.432Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-02T22:20:17.495Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:20:17.495Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T22:20:17.503Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route#v1-chat-completions-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"c5421eebe7da7086c1d4756a4f69af5cdd7ec596e7f07e8aff73f29facff31ae","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["c5421eebe7da7086c1d4756a4f69af5cdd7ec596e7f07e8aff73f29facff31ae"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"c5421eebe7da7086c1d4756a4f69af5cdd7ec596e7f07e8aff73f29facff31ae\" already exists"}
{"level":"error","ts":"2026-11-02T22:20:17.578Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route#v1-completions-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"ad5aa9665d52830893fb4af1a6c52222eff28c5437dcf9fe501cab6f82aeaea0","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["ad5aa9665d52830893fb4af1a6c52222eff28c5437dcf9fe501cab6f82aeaea0"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"ad5aa9665d52830893fb4af1a6c52222eff28c5437dcf9fe501cab6f82aeaea0\" already exists"}
{"level":"error","ts":"2026-11-02T22:20:17.645Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route#v1-responses-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"04ef5a9f5a54464f8dc13ab6c0af24178bef36e48dd84e92297e1f685bae9a8a","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["04ef5a9f5a54464f8dc13ab6c0af24178bef36e48dd84e92297e1f685bae9a8a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"04ef5a9f5a54464f8dc13ab6c0af24178bef36e48dd84e92297e1f685bae9a8a\" already exists"}
{"level":"error","ts":"2026-11-02T22:20:17.742Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"d03cda72cd19a4be8449b91e7c0874bc3615d892fbc822ada2024e8c1dc8bd56","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d03cda72cd19a4be8449b91e7c0874bc3615d892fbc822ada2024e8c1dc8bd56"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"d03cda72cd19a4be8449b91e7c0874bc3615d892fbc822ada2024e8c1dc8bd56\" already exists"}
{"level":"error","ts":"2026-11-02T22:20:17.831Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route#v1-completions-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"cee3ed5de102b63f4fd0d549002d21484e590243e6bb220ff26d56c71481f262","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["cee3ed5de102b63f4fd0d549002d21484e590243e6bb220ff26d56c71481f262"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"cee3ed5de102b63f4fd0d549002d21484e590243e6bb220ff26d56c71481f262\" already exists"}
{"level":"error","ts":"2026-11-02T22:20:17.907Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route#v1-catch-all-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"059aa363c4f5743984f4a4750b299221d4153361bba88fb44779ada6b736d06a","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["059aa363c4f5743984f4a4750b299221d4153361bba88fb44779ada6b736d06a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"059aa363c4f5743984f4a4750b299221d4153361bba88fb44779ada6b736d06a\" already exists"}
{"level":"error","ts":"2026-11-02T22:20:17.982Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route#v1-model-routing"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"6d702678bda1dfc9e3eeb362adcee5bc69be4839840717fadfcf3f540bbad15d","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["6d702678bda1dfc9e3eeb362adcee5bc69be4839840717fadfcf3f540bbad15d"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"6d702678bda1dfc9e3eeb362adcee5bc69be4839840717fadfcf3f540bbad15d\" already exists"}
{"level":"error","ts":"2026-11-02T22:20:18.050Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route#v1-messages-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"ae47fb19c324c072c578abb0ac24ae029fef313aee06a65794451952fe00b10b","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["ae47fb19c324c072c578abb0ac24ae029fef313aee06a65794451952fe00b10b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"ae47fb19c324c072c578abb0ac24ae029fef313aee06a65794451952fe00b10b\" already exists"}
{"level":"error","ts":"2026-11-02T22:20:18.121Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"55a7427f941cf70e3504be7b1faaabc3224d15aa575a45663edd720843ebc89b","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["55a7427f941cf70e3504be7b1faaabc3224d15aa575a45663edd720843ebc89b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"55a7427f941cf70e3504be7b1faaabc3224d15aa575a45663edd720843ebc89b\" already exists"}
{"level":"error","ts":"2026-11-02T22:20:18.187Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route#v1-messages-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"85484301f7aa6f30a87b224096575af8d7beea83a8ccf5091f246a4cb028e31b","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["85484301f7aa6f30a87b224096575af8d7beea83a8ccf5091f246a4cb028e31b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"85484301f7aa6f30a87b224096575af8d7beea83a8ccf5091f246a4cb028e31b\" already exists"}
{"level":"error","ts":"2026-11-02T22:20:18.259Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"92c755f42520a16c18887562f8b0dd82ce78b0c009a03cf56621703050a4589e","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["92c755f42520a16c18887562f8b0dd82ce78b0c009a03cf56621703050a4589e"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"92c755f42520a16c18887562f8b0dd82ce78b0c009a03cf56621703050a4589e\" already exists"}
{"level":"error","ts":"2026-11-02T22:20:18.327Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route#v1-responses-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"ccba7a9b1f6fb13d16375041d5707e71f92b68b4e5eb52e231100015ff08ef4b","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["ccba7a9b1f6fb13d16375041d5707e71f92b68b4e5eb52e231100015ff08ef4b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"ccba7a9b1f6fb13d16375041d5707e71f92b68b4e5eb52e231100015ff08ef4b\" already exists"}
{"level":"error","ts":"2026-11-02T22:20:18.888Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-shared-a-w0-6e535d","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T21:54:30Z","generation":5,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"bb413150-c71f-467a-b73c-fc346914ff7a\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:05:26Z"}],"name":"kuadrant-e2e-shared-a-w0-6e535d","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-a-w0-6e535d","uid":"bb413150-c71f-467a-b73c-fc346914ff7a"}],"resourceVersion":"98375","uid":"79ec4380-cbc0-4c66-b610-cdb28384077b"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6d702678bda1dfc9e3eeb362adcee5bc69be4839840717fadfcf3f540bbad15d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"8ccb66656d88cbc56ddfc1cdade2c6ade590ddfd8f834e284cfd4544915530dd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w0-6e535d/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6d702678bda1dfc9e3eeb362adcee5bc69be4839840717fadfcf3f540bbad15d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"57fa57a3c22d969731bb3e0e7b196f5e0d200359f9ed2a7b1165d9d152357db6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w0-6e535d/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6d702678bda1dfc9e3eeb362adcee5bc69be4839840717fadfcf3f540bbad15d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"625697231e3f5cbf71be2753d18743ad6080e6640edadbcbe1fd6a5ab9ff3124\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w0-6e535d/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6d702678bda1dfc9e3eeb362adcee5bc69be4839840717fadfcf3f540bbad15d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"627fb51e5fd1118f12e62d581e89f9ea85a52c751c25f1a92819f1261a6e611c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w0-6e535d/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6d702678bda1dfc9e3eeb362adcee5bc69be4839840717fadfcf3f540bbad15d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"5cb9df2ee0b41392658cf057b9b2ffe6e4930d1563e8a7f6c6ab1031d63fadfb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w0-6e535d/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6d702678bda1dfc9e3eeb362adcee5bc69be4839840717fadfcf3f540bbad15d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"b1e277f37353cd054251831852bb78e2291ed67be834eaa674ba095e0c0b1264\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w0-6e535d/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6d702678bda1dfc9e3eeb362adcee5bc69be4839840717fadfcf3f540bbad15d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"8fa6481b148596f034f36126a1148d4e876f65cab7ab2c22e8309f69eed3f5e6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w0-6e535d/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6d702678bda1dfc9e3eeb362adcee5bc69be4839840717fadfcf3f540bbad15d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"1c83a08230b976a64359fcaa38c73f1092134a98abfd261b0a0e983288240fbe\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w0-6e535d/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"376d56a711fbb2b29d7c46a8a0998936174b738443f0db294a13f85fd8478a94\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"3aa9e48facd88e18a7acef348feeaf654a1d4310d58727df558a9c5543ced772\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"92c755f42520a16c18887562f8b0dd82ce78b0c009a03cf56621703050a4589e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"d12fa4436543a3b2a715a59028e9bbcdedf2bfa4d33e5c27caea8e8f135d2d7d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-a-w0-6e535d/models/facebook/opt-125m/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ad5aa9665d52830893fb4af1a6c52222eff28c5437dcf9fe501cab6f82aeaea0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"e60fb22206c792ce9f8ec11d2dec26ff03e0d0c5a065444e4feaadc5464259fd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-a-w0-6e535d/models/facebook/opt-125m/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"04ef5a9f5a54464f8dc13ab6c0af24178bef36e48dd84e92297e1f685bae9a8a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"012b2529dc0c67174c800fee5f91edf075d0342bcc0a68c2dac7fd3aa49f3ed1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-a-w0-6e535d/models/facebook/opt-125m/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"85484301f7aa6f30a87b224096575af8d7beea83a8ccf5091f246a4cb028e31b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"2fde3be1dada350e13a9c66ba760a7177a36793874c94f94f769b2f43eed0fd9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-a-w0-6e535d/models/facebook/opt-125m/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c5421eebe7da7086c1d4756a4f69af5cdd7ec596e7f07e8aff73f29facff31ae\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"c9cedf5779f7eb020123e9816fa4cef99bf41c50a438f1c1266eece5e2fbdd70\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cee3ed5de102b63f4fd0d549002d21484e590243e6bb220ff26d56c71481f262\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"074049f4a840cf6d99622f94a7e8ca0e1f97df70b22ad5930ef4fa6b52b3aff7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ccba7a9b1f6fb13d16375041d5707e71f92b68b4e5eb52e231100015ff08ef4b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"0e334bd7093caaec5fe41b4441bdc10c104d2459071931de5a9ca3b102885991\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"55a7427f941cf70e3504be7b1faaabc3224d15aa575a45663edd720843ebc89b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"83d39926bc1c01831f6febd115eb15e8b306d7de81a2887a54cef686a8291839\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-a-w0-6e535d/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ae47fb19c324c072c578abb0ac24ae029fef313aee06a65794451952fe00b10b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"00d2ac54d79d1c2237a41915b66be868a4c6c1750ae37f03a32476856535518c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"059aa363c4f5743984f4a4750b299221d4153361bba88fb44779ada6b736d06a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"0a4df11db71d8d8ba29534b591e0a04826bda9a98dfdc5c7bfe4f61f4e3f1a66\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"65ad30c331bd08b64f99c2bfc9d23db3979d37b9d3b916cb76d08a0dfabf963a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"4593350858282f0ebeaf11b57850d5bccfa270a4b6088784a058e2d70b5cbe7c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"71e8c9bf81b77581f96b1cca4bb909b8434efbbb06bf9c9ec1aa5c8f412b9c76\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"01c09092684d0d3ed9db0ad6f53595f8d2c97286804d29e76075f2c30f05f44e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c3ead856f0c0807270869b6a467d9281b93eaaa8c65e788c4b6393073db2cbe8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"7d0e9eabd4ff8a0b65212f3d03a7b14a1e695503c8c41fb7cd6e844984ba7c69\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8b7e784474461510a9d9970d39fe03c297fc6f9a5f80873c40898bdfcb389e5f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"3cb722466e22fc9e58ad8f75bb3dbd6e1d2f9d75c3cfaafc5c6350857d59f964\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7482755e6f782100b8480fa82045aac768a6400e192241b0d0cf93403dad8edb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"af29fffcd438904723a318f8c7cd8dbe79f55578faf5560452874252825fdf46\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d03cda72cd19a4be8449b91e7c0874bc3615d892fbc822ada2024e8c1dc8bd56\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"efb649db4f32937f9904ced050f9327159e7fd80ed89d902f14f6c5f64e02971\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w0-6e535d/models/facebook/opt-125m')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-shared-a-w0-6e535d"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-shared-a-w0-6e535d\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:20:19.182Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-a-w0-6e535d-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-a-w0-6e535d-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:20:19.764Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"maas-gateway-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"maas-gateway-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:20:20.064Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-inf-a-db69f7","namespace":"openshift-ingress","uid":"d05da505-26f6-4943-9a64-6982813c3a59","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-inf-a-db69f7\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:20:20.306Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-inf-a-db69f7-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-inf-a-db69f7-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:20:20.834Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T22:20:20.834Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T22:20:21.347Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"rate-test-model-6e535d-kserve-route","namespace":"ai-tenant-e2e-shared-a-w0-6e535d","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"rate-test-model-6e535d-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:20:29.128Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","AuthPolicy","HTTPRoute","ConfigMap","TokenRateLimitPolicy","EnvoyFilter","Limitador"],"eventTypes":{"create":12,"update":8}}
{"level":"info","ts":"2026-11-02T22:20:29.476Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T22:20:31.435Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T22:20:31.649Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:20:31.649Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T22:20:35.382Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:20:35.386Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:20:35.423Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:20:35.429Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-02T22:20:35.429Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T22:20:35.431Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:20:35.431Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T22:20:44.588Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T22:20:44.588Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T22:20:52.992Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","TokenRateLimitPolicy","ConfigMap","AuthPolicy","Limitador"],"eventTypes":{"update":129}}
{"level":"info","ts":"2026-11-02T22:20:53.236Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T22:20:55.148Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T22:20:55.337Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:20:55.337Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T22:20:59.468Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:20:59.479Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:20:59.479Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T22:20:59.487Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:20:59.493Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-02T22:20:59.493Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T22:20:59.523Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:21:02.864Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T22:21:02.864Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T22:21:03.271Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-inf-a-dd28e6","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-inf-a-dd28e6\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:21:11.336Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway","ConfigMap","HTTPRoute","AuthPolicy"],"eventTypes":{"create":3,"update":3}}
{"level":"info","ts":"2026-11-02T22:21:17.770Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:21:17.823Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:21:17.830Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T22:21:17.836Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:21:17.844Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:21:17.844Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T22:21:17.985Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T22:21:21.255Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T22:21:21.255Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T22:21:29.654Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","TokenRateLimitPolicy","ConfigMap","Limitador","AuthPolicy","HTTPRoute","EnvoyFilter"],"eventTypes":{"create":12,"update":28}}
{"level":"info","ts":"2026-11-02T22:21:30.058Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T22:21:32.329Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T22:21:32.524Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:21:32.524Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T22:21:36.241Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:21:36.256Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:21:36.265Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:21:36.267Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:21:36.267Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T22:21:36.273Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-02T22:21:36.273Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T22:21:39.887Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T22:21:39.887Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T22:21:41.204Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-inf-b-cf2a53","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-inf-b-cf2a53\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:21:48.678Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","TokenRateLimitPolicy","Gateway","AuthPolicy","Limitador","HTTPRoute"],"eventTypes":{"create":2,"update":28}}
{"level":"info","ts":"2026-11-02T22:21:49.034Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T22:21:51.732Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T22:21:51.923Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:21:51.923Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T22:21:56.333Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:21:56.340Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:21:56.352Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T22:21:56.354Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:21:56.359Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:21:56.359Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T22:21:56.500Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T22:21:58.620Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-inf-a-dd28e6-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-inf-a-dd28e6-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:21:59.991Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T22:21:59.991Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T22:22:12.478Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","TokenRateLimitPolicy","ConfigMap","HTTPRoute","AuthPolicy","Limitador","EnvoyFilter"],"eventTypes":{"create":24,"update":32}}
{"level":"info","ts":"2026-11-02T22:22:12.831Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T22:22:15.533Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T22:22:15.725Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:22:15.725Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T22:22:19.955Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:22:19.961Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:22:19.970Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T22:22:19.971Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:22:19.972Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:22:19.973Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-02T22:22:20.177Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:22:20.177Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T22:22:24.020Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T22:22:24.020Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T22:22:25.855Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["HTTPRoute","Gateway"],"eventTypes":{"create":1,"update":1}}
{"level":"info","ts":"2026-11-02T22:22:31Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-inf-b-3edc8c","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-b-3edc8c","reconcileID":"63cfbe69-4496-4a2e-8e4e-da5e4141fee9","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-inf-b-3edc8c","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T22:22:31Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-b-3edc8c","event":"CREATE"}
{"level":"info","ts":"2026-11-02T22:22:31Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T22:22:33Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-02T22:22:33Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-02T22:22:33Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T22:22:33Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-inf-b-3edc8c","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-b-3edc8c","reconcileID":"f50a7362-03b6-43cd-9028-b4124c57eac0","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-inf-b-3edc8c","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T22:22:33Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-b-3edc8c","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T22:22:33Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T22:22:33.553Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:22:33.557Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:22:33.569Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T22:22:33.632Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:22:33.645Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:22:33.645Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-02T22:22:33.670Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-inf-a-dd28e6/test-model-dd28e6-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-inf-a-dd28e6/test-model-dd28e6-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-02T22:21:18Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:21:18Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:21:18Z"}],"name":"9258bd062de71b431eeb8ed2e8ac47c2288690f36daec361e334d63873c04b93","namespace":"kuadrant-system","resourceVersion":"122152","uid":"fc013569-3b58-472f-87af-9cf2759987f8"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["9258bd062de71b431eeb8ed2e8ac47c2288690f36daec361e334d63873c04b93"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-dd28e6.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-dd28e6.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:21:18Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:21:18Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["9258bd062de71b431eeb8ed2e8ac47c2288690f36daec361e334d63873c04b93"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"9258bd062de71b431eeb8ed2e8ac47c2288690f36daec361e334d63873c04b93\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:22:33.712Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:22:33.712Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T22:22:33.733Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-inf-a-dd28e6/test-model-dd28e6-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-inf-a-dd28e6/test-model-dd28e6-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-02T22:21:18Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:21:18Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:21:18Z"}],"name":"d5c5afa43fd153c7ea0a9f6f0aa657a3f4d2a605f5188a2c66e3bf70af6aac86","namespace":"kuadrant-system","resourceVersion":"122178","uid":"6313f8d9-4785-4d16-8e11-93cf2d91246e"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d5c5afa43fd153c7ea0a9f6f0aa657a3f4d2a605f5188a2c66e3bf70af6aac86"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-dd28e6.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-dd28e6.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:21:18Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:21:18Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["d5c5afa43fd153c7ea0a9f6f0aa657a3f4d2a605f5188a2c66e3bf70af6aac86"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"d5c5afa43fd153c7ea0a9f6f0aa657a3f4d2a605f5188a2c66e3bf70af6aac86\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:22:33.800Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"34a6fee35b5b6e4d8489e9dec6c22275d6769ec340fe614be36f43659226b008","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["34a6fee35b5b6e4d8489e9dec6c22275d6769ec340fe614be36f43659226b008"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-7cde84.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-7cde84.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"34a6fee35b5b6e4d8489e9dec6c22275d6769ec340fe614be36f43659226b008\" already exists"}
{"level":"error","ts":"2026-11-02T22:22:33.862Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-inf-a-dd28e6/test-model-dd28e6-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-inf-a-dd28e6/test-model-dd28e6-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-02T22:21:18Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:21:18Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:21:18Z"}],"name":"c187b6eaf0a2f2f78ef939e8d4d5982e4a0d11881ec0c01c6ae22143e01d5004","namespace":"kuadrant-system","resourceVersion":"122138","uid":"92c43f29-d491-4e7c-8fb1-d6015402c291"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["c187b6eaf0a2f2f78ef939e8d4d5982e4a0d11881ec0c01c6ae22143e01d5004"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-dd28e6.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-dd28e6.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:21:18Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:21:18Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["c187b6eaf0a2f2f78ef939e8d4d5982e4a0d11881ec0c01c6ae22143e01d5004"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"c187b6eaf0a2f2f78ef939e8d4d5982e4a0d11881ec0c01c6ae22143e01d5004\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:22:33.931Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"7227bd7965d40e464f5f833cf1ae228521499b8e52b256386ba7cddd67ea360b","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["7227bd7965d40e464f5f833cf1ae228521499b8e52b256386ba7cddd67ea360b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-7cde84.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-7cde84.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"7227bd7965d40e464f5f833cf1ae228521499b8e52b256386ba7cddd67ea360b\" already exists"}
{"level":"info","ts":"2026-11-02T22:22:33Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-02T22:22:33Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-02T22:22:33Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-02T22:22:33Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"error","ts":"2026-11-02T22:22:34.004Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route#v1-model-routing"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"5350573b00b923007a376a9e1a94b10285846470cdf28852896168c05e85fa70","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["5350573b00b923007a376a9e1a94b10285846470cdf28852896168c05e85fa70"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-7cde84.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-7cde84.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"5350573b00b923007a376a9e1a94b10285846470cdf28852896168c05e85fa70\" already exists"}
{"level":"error","ts":"2026-11-02T22:22:34.072Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"0bcecc0d8a2f3bd07c6b4357ee2bf111ba3a5b96cdc7f4d5ff088093263a85f9","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["0bcecc0d8a2f3bd07c6b4357ee2bf111ba3a5b96cdc7f4d5ff088093263a85f9"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-7cde84.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-7cde84.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"0bcecc0d8a2f3bd07c6b4357ee2bf111ba3a5b96cdc7f4d5ff088093263a85f9\" already exists"}
{"level":"error","ts":"2026-11-02T22:22:34.134Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-inf-a-dd28e6/test-model-dd28e6-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-inf-a-dd28e6/test-model-dd28e6-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-02T22:21:18Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:21:18Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:21:18Z"}],"name":"f8127aa578529d2e34a35451b79ba30c645b02f94df66bf4488b09e1b13ae187","namespace":"kuadrant-system","resourceVersion":"122180","uid":"d80e281f-0630-4a44-a05e-0f1fcde70299"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f8127aa578529d2e34a35451b79ba30c645b02f94df66bf4488b09e1b13ae187"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-dd28e6.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-dd28e6.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:21:18Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:21:18Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["f8127aa578529d2e34a35451b79ba30c645b02f94df66bf4488b09e1b13ae187"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"f8127aa578529d2e34a35451b79ba30c645b02f94df66bf4488b09e1b13ae187\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:22:34.205Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route#v1-completions-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"298687b21bb9308a0390d1eccce98f0f3701b3448ec88414dc705044c62f7b35","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["298687b21bb9308a0390d1eccce98f0f3701b3448ec88414dc705044c62f7b35"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-7cde84.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-7cde84.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"298687b21bb9308a0390d1eccce98f0f3701b3448ec88414dc705044c62f7b35\" already exists"}
{"level":"error","ts":"2026-11-02T22:22:34.249Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-shared-a-w4-7cde84","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T21:54:29Z","generation":5,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"30a49997-f3b8-4b9e-a63d-efe4d247c707\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:05:57Z"}],"name":"kuadrant-e2e-shared-a-w4-7cde84","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-a-w4-7cde84","uid":"30a49997-f3b8-4b9e-a63d-efe4d247c707"}],"resourceVersion":"99347","uid":"a9161c5c-8421-407e-b216-c0f311a76a78"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5350573b00b923007a376a9e1a94b10285846470cdf28852896168c05e85fa70\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-7cde84-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]}],\"name\":\"48cbc172808ea1101a391c96fa0aa6a9d997d76b9a3fe4299ef52c206b5e51da\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w4-7cde84/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5350573b00b923007a376a9e1a94b10285846470cdf28852896168c05e85fa70\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-7cde84-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]}],\"name\":\"458f6fe40bffec49fb32010c2cfd63f287660747add4cbf0fb8a18af8424e62b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w4-7cde84/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5350573b00b923007a376a9e1a94b10285846470cdf28852896168c05e85fa70\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-7cde84-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]}],\"name\":\"edfc30cea7aa4be391f5c0c0281ba5c15ae57c24deb2c99e8ff659a7e31ee30f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w4-7cde84/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5350573b00b923007a376a9e1a94b10285846470cdf28852896168c05e85fa70\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-7cde84-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]}],\"name\":\"fabe0ccdca0314c5576deae84c609d0b9b8801ca87dc819b73796fe5e9e1f9fb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w4-7cde84/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5350573b00b923007a376a9e1a94b10285846470cdf28852896168c05e85fa70\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-7cde84-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]}],\"name\":\"a635b5feded328aa50af52eefe8c511311aa26ff095d8d42023cf935b2fd9840\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w4-7cde84/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5350573b00b923007a376a9e1a94b10285846470cdf28852896168c05e85fa70\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-7cde84-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]}],\"name\":\"431e8ad28971cd1c4ad0ed4caacb6fb08c3273645039f799f7c5e1838e28468e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w4-7cde84/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5350573b00b923007a376a9e1a94b10285846470cdf28852896168c05e85fa70\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-7cde84-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]}],\"name\":\"bf9578d03514654c2a6449d92357d6fa77ac92c918c73f879acbdad94a934261\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w4-7cde84/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5350573b00b923007a376a9e1a94b10285846470cdf28852896168c05e85fa70\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-7cde84-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]}],\"name\":\"9f6e4a68a063bc9ea4a986af6d560594ce195d7803b84c67d0f915ae6805d458\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w4-7cde84/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0f923fa7f17446f382fb056bef7c9cc2146361c32cb89e19da4e6397505de43c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-7cde84-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-7cde84\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-7cde84\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]}],\"name\":\"6fb04747cbba17c2d2edd73660c4e50eec6f0ee924099f26ff442586021553ed\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"34a6fee35b5b6e4d8489e9dec6c22275d6769ec340fe614be36f43659226b008\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-7cde84-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]}],\"name\":\"ee0baf2c663c8fb32fca35ea0d66f7822a117a344c216faab45713d83644e15d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-a-w4-7cde84/models/facebook/opt-125m/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"298687b21bb9308a0390d1eccce98f0f3701b3448ec88414dc705044c62f7b35\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-7cde84-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]}],\"name\":\"0b54c8737b8cb5ca2d1d8db2626750345bc888a639756bae5b8c51b0890b6c4e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-a-w4-7cde84/models/facebook/opt-125m/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"903c98b0fff3cf1a47841a81663ba2415232166daafccec12bff78d7ecf1ad6f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-7cde84-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]}],\"name\":\"5967ef418a7e05ace3c367664f74204ca1bb1e976dda1f3f077d5715ede96ac3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-a-w4-7cde84/models/facebook/opt-125m/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bec208ec6dc21c79240eb94750ba68422695a096f53cfdb225e863fa3d9d315b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-7cde84-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]}],\"name\":\"6d2c661112529a04d92c0c59f6aca23b96458280a4e114607c8d267529ebaf59\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-a-w4-7cde84/models/facebook/opt-125m/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4c71f22ec48e1640858b5e13955ccc7284a723347433e1b6f730b142ce1fd0e1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-7cde84-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]}],\"name\":\"c6f5645306b39efe3b627da1c60119cb9627886be7c842a31d4f4213ca6b8c92\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1f7cf62dc6799b47d6f93db202824af7a9292a91889ec8859df0da33700cec22\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-7cde84-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]}],\"name\":\"cd51a15d79597727c42c21070d86ff94d8ba980d0fcd9fc7e0c774068faacced\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7227bd7965d40e464f5f833cf1ae228521499b8e52b256386ba7cddd67ea360b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-7cde84-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]}],\"name\":\"66e79b8a49aff310c44470df350bb011c8a126a68ffe503cd4babd031cfc31cd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-a-w4-7cde84/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b69925d3df07c885960ffd3cb00542ac829678560a41dc321cf97047026df6c1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-7cde84-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]}],\"name\":\"46c99d3074422622d25434536e7cb103006784460bb281b16a46dc803c12fb97\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"07296ce2840ffecfcd20ccfbb88bae26607ad04b350c3e27f6a92965b50cc44a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-7cde84-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]}],\"name\":\"ae1d19b9f3dd9001ae66784b9306df616b298bd339e6163ee537dd7cf8e4114e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2916a2827ecd216898e17d90f9a6227b27719deed72249cd41aee4bb7a1fe444\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-7cde84-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]}],\"name\":\"52ac0a3ff1c0c2cc22369d4fd8d5fc55703eba032f143b0bbafa5865297f1855\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"150da2804d58820302b448e24151b1f189b717cd68a8c1e110fba61141165eb0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-7cde84-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-7cde84\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-7cde84\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]}],\"name\":\"e314acde8746b9db89412919be5da708b16f912df85d7b1e19c5983d2065f729\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"45531229ceac4cfcba16f0f8d809077fb7e19e248278c544ac9fd018c419ef18\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-7cde84-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-7cde84\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-7cde84\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]}],\"name\":\"5d1e4a29bea3f2db952d9e19481c737e780a5cc72dc0934c1c2012a39bc18efd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f6229ee2157250d6d160cdc978e612aa3a7c43bb558942020078c3f42c450c79\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-7cde84-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-7cde84\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-7cde84\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]}],\"name\":\"228840b91d117fcc6420f8e81c02a72767236079f030e5ad6e1f7df8d2bfef2f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"96cad25fbcf27b7341cae948477117cfaf58cb098cf23b68e9b61e9380b5dbab\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-7cde84-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-7cde84\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-7cde84\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]}],\"name\":\"7f37843572934e12cedf2d78614afd5eacc9ed1f0ea54fe933bb17625146accc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"75661500a5114b056fb7b7fa79b052930433ec107cb332756c581a2f0de24173\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-7cde84-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-7cde84\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-7cde84\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]}],\"name\":\"f6e55ef63865313913827adc1faf8eb8ccb447468294af4335a4df4ebb61a404\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0bcecc0d8a2f3bd07c6b4357ee2bf111ba3a5b96cdc7f4d5ff088093263a85f9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-7cde84-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]}],\"name\":\"7d9b5d579dbe1ecadaa13e9d9ba591da4b41d12601bd8c4b52006dd509b46788\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w4-7cde84/models/facebook/opt-125m')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-shared-a-w4-7cde84"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-shared-a-w4-7cde84\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:22:34.269Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-dd28e6","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-inf-a-dd28e6#rule-5"},"creationTimestamp":"2026-11-02T22:16:27Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:16:27Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:16:27Z"}],"name":"6b8c2c1d0ad8500090d8712218e9f2ad0ae4868196347013ad6b1112fc30c004","namespace":"kuadrant-system","resourceVersion":"115747","uid":"32abd4f5-48c1-478b-b975-07376737844f"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["6b8c2c1d0ad8500090d8712218e9f2ad0ae4868196347013ad6b1112fc30c004"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-dd28e6.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-dd28e6.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:16:27Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:16:27Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["6b8c2c1d0ad8500090d8712218e9f2ad0ae4868196347013ad6b1112fc30c004"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"6b8c2c1d0ad8500090d8712218e9f2ad0ae4868196347013ad6b1112fc30c004\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:22:34.331Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-dd28e6","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-inf-a-dd28e6#rule-1"},"creationTimestamp":"2026-11-02T22:16:27Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:16:27Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:16:27Z"}],"name":"72caf46dae9fe0088c1f779cd468b7fb66ba49af22df0324b40b892b7c857043","namespace":"kuadrant-system","resourceVersion":"115714","uid":"0246a0b5-1d0c-4673-9844-09e14497df9c"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["72caf46dae9fe0088c1f779cd468b7fb66ba49af22df0324b40b892b7c857043"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-dd28e6.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-dd28e6.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:16:27Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:16:27Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["72caf46dae9fe0088c1f779cd468b7fb66ba49af22df0324b40b892b7c857043"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"72caf46dae9fe0088c1f779cd468b7fb66ba49af22df0324b40b892b7c857043\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:22:34.394Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-inf-a-dd28e6/test-model-dd28e6-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-inf-a-dd28e6/test-model-dd28e6-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-02T22:21:18Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:21:18Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:21:18Z"}],"name":"0e16a02bb9ec9d54f4ac152590af513e17bbe047d26bc648a4713e8a7c0b796f","namespace":"kuadrant-system","resourceVersion":"122145","uid":"73836606-7ec6-4ae0-920e-1ea73c60c5e9"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["0e16a02bb9ec9d54f4ac152590af513e17bbe047d26bc648a4713e8a7c0b796f"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-dd28e6.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-dd28e6.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:21:18Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:21:18Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["0e16a02bb9ec9d54f4ac152590af513e17bbe047d26bc648a4713e8a7c0b796f"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"0e16a02bb9ec9d54f4ac152590af513e17bbe047d26bc648a4713e8a7c0b796f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:22:34.460Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-inf-a-dd28e6/test-model-dd28e6-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-inf-a-dd28e6/test-model-dd28e6-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-02T22:21:18Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:21:18Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:21:18Z"}],"name":"6daba5f992d86499dfa63ba37eab60429d1fa54b9c32f70d5c6fc137c22856c8","namespace":"kuadrant-system","resourceVersion":"122174","uid":"af85a534-2ce8-46fe-bfb1-0743777f6271"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["6daba5f992d86499dfa63ba37eab60429d1fa54b9c32f70d5c6fc137c22856c8"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-dd28e6.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-dd28e6.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:21:18Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:21:18Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["6daba5f992d86499dfa63ba37eab60429d1fa54b9c32f70d5c6fc137c22856c8"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"6daba5f992d86499dfa63ba37eab60429d1fa54b9c32f70d5c6fc137c22856c8\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:22:34.528Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route#v1-completions-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"1f7cf62dc6799b47d6f93db202824af7a9292a91889ec8859df0da33700cec22","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["1f7cf62dc6799b47d6f93db202824af7a9292a91889ec8859df0da33700cec22"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-7cde84.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-7cde84.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"1f7cf62dc6799b47d6f93db202824af7a9292a91889ec8859df0da33700cec22\" already exists"}
{"level":"error","ts":"2026-11-02T22:22:34.636Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-inf-a-dd28e6/test-model-dd28e6-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-inf-a-dd28e6/test-model-dd28e6-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-02T22:21:17Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:21:17Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:21:18Z"}],"name":"aa8934811de4de226ed58fa102c3f81ebba980bc82f908f901eb350b6398182c","namespace":"kuadrant-system","resourceVersion":"122142","uid":"841aa7f9-6d0b-43e8-b0f2-afb0414e663f"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["aa8934811de4de226ed58fa102c3f81ebba980bc82f908f901eb350b6398182c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-dd28e6.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-dd28e6.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:21:18Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:21:18Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["aa8934811de4de226ed58fa102c3f81ebba980bc82f908f901eb350b6398182c"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"aa8934811de4de226ed58fa102c3f81ebba980bc82f908f901eb350b6398182c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:22:34.723Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-dd28e6","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-inf-a-dd28e6#rule-6"},"creationTimestamp":"2026-11-02T22:16:27Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:16:27Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:16:27Z"}],"name":"367523cfb64ff15643874e12a833388388fc16133685d340da1773f6658b212b","namespace":"kuadrant-system","resourceVersion":"115744","uid":"1d1c8211-8ced-4cf6-bd76-c091631eb198"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["367523cfb64ff15643874e12a833388388fc16133685d340da1773f6658b212b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-dd28e6.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-dd28e6.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:16:27Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:16:27Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["367523cfb64ff15643874e12a833388388fc16133685d340da1773f6658b212b"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"367523cfb64ff15643874e12a833388388fc16133685d340da1773f6658b212b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:22:34.786Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-inf-a-dd28e6/test-model-dd28e6-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-inf-a-dd28e6/test-model-dd28e6-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-02T22:21:18Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:21:18Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:21:18Z"}],"name":"89d1e03cf510ae9e93c27877d61a85513dda02d18210dac5de2981a1a398610b","namespace":"kuadrant-system","resourceVersion":"122163","uid":"6a2272dc-c28b-4cd6-aac9-349eca2abcf1"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["89d1e03cf510ae9e93c27877d61a85513dda02d18210dac5de2981a1a398610b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-dd28e6.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-dd28e6.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:21:18Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:21:18Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["89d1e03cf510ae9e93c27877d61a85513dda02d18210dac5de2981a1a398610b"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"89d1e03cf510ae9e93c27877d61a85513dda02d18210dac5de2981a1a398610b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:22:34.855Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route#v1-responses-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"903c98b0fff3cf1a47841a81663ba2415232166daafccec12bff78d7ecf1ad6f","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["903c98b0fff3cf1a47841a81663ba2415232166daafccec12bff78d7ecf1ad6f"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-7cde84.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-7cde84.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"903c98b0fff3cf1a47841a81663ba2415232166daafccec12bff78d7ecf1ad6f\" already exists"}
{"level":"error","ts":"2026-11-02T22:22:34.920Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route#v1-responses-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"b69925d3df07c885960ffd3cb00542ac829678560a41dc321cf97047026df6c1","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["b69925d3df07c885960ffd3cb00542ac829678560a41dc321cf97047026df6c1"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-7cde84.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-7cde84.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"b69925d3df07c885960ffd3cb00542ac829678560a41dc321cf97047026df6c1\" already exists"}
{"level":"error","ts":"2026-11-02T22:22:34.988Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route#v1-catch-all-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"2916a2827ecd216898e17d90f9a6227b27719deed72249cd41aee4bb7a1fe444","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["2916a2827ecd216898e17d90f9a6227b27719deed72249cd41aee4bb7a1fe444"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-7cde84.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-7cde84.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"2916a2827ecd216898e17d90f9a6227b27719deed72249cd41aee4bb7a1fe444\" already exists"}
{"level":"error","ts":"2026-11-02T22:22:35.056Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route#v1-messages-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"bec208ec6dc21c79240eb94750ba68422695a096f53cfdb225e863fa3d9d315b","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["bec208ec6dc21c79240eb94750ba68422695a096f53cfdb225e863fa3d9d315b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-7cde84.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-7cde84.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"bec208ec6dc21c79240eb94750ba68422695a096f53cfdb225e863fa3d9d315b\" already exists"}
{"level":"error","ts":"2026-11-02T22:22:35.119Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-inf-a-dd28e6/test-model-dd28e6-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-inf-a-dd28e6/test-model-dd28e6-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-02T22:21:18Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:21:18Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:21:18Z"}],"name":"57403378ca66f5ca9436f0980505edcace47bc462ed2626ebe90a650020f07fc","namespace":"kuadrant-system","resourceVersion":"122176","uid":"0e10bc15-6cd0-4a13-bdfb-913710704eb4"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["57403378ca66f5ca9436f0980505edcace47bc462ed2626ebe90a650020f07fc"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-dd28e6.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-dd28e6.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:21:18Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:21:18Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["57403378ca66f5ca9436f0980505edcace47bc462ed2626ebe90a650020f07fc"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"57403378ca66f5ca9436f0980505edcace47bc462ed2626ebe90a650020f07fc\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:22:35.182Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-dd28e6","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-inf-a-dd28e6#rule-2"},"creationTimestamp":"2026-11-02T22:16:27Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:16:27Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:16:27Z"}],"name":"40e0cb771c648ceb2a0ee3a2669e598e6360431b7118a681dc3e080f465910f4","namespace":"kuadrant-system","resourceVersion":"115735","uid":"46cb42e9-fa1a-40cf-a0a5-ae8510401485"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["40e0cb771c648ceb2a0ee3a2669e598e6360431b7118a681dc3e080f465910f4"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-dd28e6.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-dd28e6.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:16:27Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:16:27Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["40e0cb771c648ceb2a0ee3a2669e598e6360431b7118a681dc3e080f465910f4"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"40e0cb771c648ceb2a0ee3a2669e598e6360431b7118a681dc3e080f465910f4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:22:35.248Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route#v1-chat-completions-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"4c71f22ec48e1640858b5e13955ccc7284a723347433e1b6f730b142ce1fd0e1","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["4c71f22ec48e1640858b5e13955ccc7284a723347433e1b6f730b142ce1fd0e1"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-7cde84.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-7cde84.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"4c71f22ec48e1640858b5e13955ccc7284a723347433e1b6f730b142ce1fd0e1\" already exists"}
{"level":"error","ts":"2026-11-02T22:22:35.312Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-dd28e6","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-inf-a-dd28e6#rule-4"},"creationTimestamp":"2026-11-02T22:16:27Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:16:27Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:16:27Z"}],"name":"f13a0da8b101fb07b97a431dc942f81dd0bbdc060a1ab841eabf8a35d08378d6","namespace":"kuadrant-system","resourceVersion":"115723","uid":"5dd60787-ee74-473f-bcf9-e39a7700db5e"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f13a0da8b101fb07b97a431dc942f81dd0bbdc060a1ab841eabf8a35d08378d6"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-dd28e6.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-dd28e6.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:16:27Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:16:27Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["f13a0da8b101fb07b97a431dc942f81dd0bbdc060a1ab841eabf8a35d08378d6"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"f13a0da8b101fb07b97a431dc942f81dd0bbdc060a1ab841eabf8a35d08378d6\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:22:35.376Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-dd28e6","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-inf-a-dd28e6#rule-3"},"creationTimestamp":"2026-11-02T22:16:27Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:16:27Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:16:27Z"}],"name":"cadecb3d2ef581770e646697462759b8615722ad8d0b026b89324f6cb5d392aa","namespace":"kuadrant-system","resourceVersion":"115730","uid":"5d8d05ec-afa2-4901-96bc-5cf2233b425a"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["cadecb3d2ef581770e646697462759b8615722ad8d0b026b89324f6cb5d392aa"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-dd28e6.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-dd28e6.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:16:27Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:16:27Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["cadecb3d2ef581770e646697462759b8615722ad8d0b026b89324f6cb5d392aa"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"cadecb3d2ef581770e646697462759b8615722ad8d0b026b89324f6cb5d392aa\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:22:35.443Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route#v1-messages-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"07296ce2840ffecfcd20ccfbb88bae26607ad04b350c3e27f6a92965b50cc44a","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["07296ce2840ffecfcd20ccfbb88bae26607ad04b350c3e27f6a92965b50cc44a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-7cde84.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-7cde84.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"07296ce2840ffecfcd20ccfbb88bae26607ad04b350c3e27f6a92965b50cc44a\" already exists"}
{"level":"error","ts":"2026-11-02T22:22:35.506Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-inf-a-dd28e6/test-model-dd28e6-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-inf-a-dd28e6/test-model-dd28e6-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-02T22:21:18Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:21:18Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:21:18Z"}],"name":"8088445f84c874d08dcf507767903e3660b0eba8325e73461dadbd53a0ba8dee","namespace":"kuadrant-system","resourceVersion":"122156","uid":"2a2b1792-36b2-432b-b5bd-0c6a894fe2ea"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["8088445f84c874d08dcf507767903e3660b0eba8325e73461dadbd53a0ba8dee"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-dd28e6.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-dd28e6.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:21:18Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:21:18Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["8088445f84c874d08dcf507767903e3660b0eba8325e73461dadbd53a0ba8dee"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"8088445f84c874d08dcf507767903e3660b0eba8325e73461dadbd53a0ba8dee\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:22:35.568Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-inf-a-dd28e6/test-model-dd28e6-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-inf-a-dd28e6/test-model-dd28e6-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-02T22:21:18Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:21:18Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:21:19Z"}],"name":"403e08f9aeed9b497fb896168a8e5d7c6facf69a0be078825d4f61515393c456","namespace":"kuadrant-system","resourceVersion":"122183","uid":"9c5a65c1-1993-4ae9-b0c0-35140595bb4e"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["403e08f9aeed9b497fb896168a8e5d7c6facf69a0be078825d4f61515393c456"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-dd28e6.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-dd28e6.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:21:19Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:21:19Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["403e08f9aeed9b497fb896168a8e5d7c6facf69a0be078825d4f61515393c456"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"403e08f9aeed9b497fb896168a8e5d7c6facf69a0be078825d4f61515393c456\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:22:35.629Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-inf-a-dd28e6/test-model-dd28e6-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-inf-a-dd28e6/test-model-dd28e6-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-02T22:21:18Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:21:18Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:21:18Z"}],"name":"3e864bb2ced7b695cbdc42e5017af9550537501b27c411348a9f968789a8d2dc","namespace":"kuadrant-system","resourceVersion":"122149","uid":"7d79665a-a526-4c6b-aba6-fce77783d355"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["3e864bb2ced7b695cbdc42e5017af9550537501b27c411348a9f968789a8d2dc"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-dd28e6.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-a-dd28e6.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:21:18Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:21:18Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["3e864bb2ced7b695cbdc42e5017af9550537501b27c411348a9f968789a8d2dc"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"3e864bb2ced7b695cbdc42e5017af9550537501b27c411348a9f968789a8d2dc\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:22:35.977Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-inf-a-dd28e6-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-inf-a-dd28e6-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:22:36.176Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-a-w4-7cde84-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-a-w4-7cde84-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:22:36.376Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-b-w0-0f0874-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-b-w0-0f0874-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:22:36.584Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-inf-b-cf2a53-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-inf-b-cf2a53-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:22:37.368Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T22:22:37.368Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T22:22:37.784Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"sub-test-model-7cde84-kserve-route","namespace":"ai-tenant-e2e-shared-a-w4-7cde84","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"sub-test-model-7cde84-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:22:37.846Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-inf-b-3edc8c","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-inf-b-3edc8c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:22:41Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-mt-b5e8794c","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-mt-b5e8794c","reconcileID":"32d006a7-c0eb-4f3a-9bbe-2a0ac60ccd6d","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-mt-b5e8794c","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T22:22:41Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-mt-b5e8794c","event":"CREATE"}
{"level":"info","ts":"2026-11-02T22:22:41Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T22:22:42Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":true}
{"level":"info","ts":"2026-11-02T22:22:42Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":true}
{"level":"info","ts":"2026-11-02T22:22:42Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T22:22:42Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-mt-b5e8794c","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-mt-b5e8794c","reconcileID":"6aed832b-3200-4bd9-be08-77e117a5ed8e","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-mt-b5e8794c","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T22:22:42Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-mt-b5e8794c","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T22:22:42Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T22:22:43Z","logger":"telemetry-policy-extension-controller","msg":"Status","status is different":false}
{"level":"info","ts":"2026-11-02T22:22:43Z","logger":"telemetry-policy-extension-controller","msg":"Status","generation is different":false}
{"level":"info","ts":"2026-11-02T22:22:43Z","logger":"telemetry-policy-extension-controller","msg":"Status was not updated"}
{"level":"info","ts":"2026-11-02T22:22:43Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T22:22:49.992Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","HTTPRoute","Kuadrant","Limitador","Gateway","AuthPolicy","TokenRateLimitPolicy","EnvoyFilter","ConfigMap"],"eventTypes":{"create":16,"update":29}}
{"level":"info","ts":"2026-11-02T22:22:50.620Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:22:50.640Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T22:22:54.939Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T22:22:55.126Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:22:55.127Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:22:55.127Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T22:22:55.450Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T22:22:59.971Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:23:00.023Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:23:00.032Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T22:23:00.033Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:23:00.046Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:23:00.046Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T22:23:00.186Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T22:23:04.428Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T22:23:04.428Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T22:23:05.242Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-b-w4-58ca7f","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-shared-b-w4-58ca7f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:23:06.356Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthPolicy","Kuadrant","TokenRateLimitPolicy"],"eventTypes":{"create":2,"update":2}}
{"level":"info","ts":"2026-11-02T22:23:06.789Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:23:06.809Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T22:23:11.023Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:23:11.229Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T22:23:11.239Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T22:23:11.424Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:23:11.424Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T22:23:16.426Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:23:16.428Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:23:16.436Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T22:23:16.440Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:23:16.440Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:23:16.440Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-02T22:23:16.484Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-mt-b5e8794c","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/ratelimit":"true"},"name":"kuadrant-ratelimiting-e2e-mt-b5e8794c","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-mt-b5e8794c","uid":"1eee245d-6b25-4613-9b8e-0d58b2f756f0"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"limitador-limitador.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-ratelimit-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"limitador-limitador.kuadrant-system.svc.cluster.local","port_value":8081}}}}]}]},"name":"kuadrant-ratelimit-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-mt-b5e8794c"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-mt-b5e8794c\" already exists"}
{"level":"error","ts":"2026-11-02T22:23:16.539Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:23:16.540Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T22:23:16.540Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-inf-b-3edc8c","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"kuadrant-auth-e2e-inf-b-3edc8c","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-inf-b-3edc8c","uid":"68cc9571-28fc-4a9c-ac95-19a198bca6a3"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-auth-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local","port_value":50051}}}}]}]},"name":"kuadrant-auth-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-inf-b-3edc8c"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-inf-b-3edc8c\" already exists"}
{"level":"error","ts":"2026-11-02T22:23:16.546Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-mt-b5e8794c","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-mt-b5e8794c#rule-2"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"d384fa5cf5c165fb857b5286823c29102a8f8ecba4d0681cb67ef3f3465b3ef7","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d384fa5cf5c165fb857b5286823c29102a8f8ecba4d0681cb67ef3f3465b3ef7"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-b5e8794c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-b5e8794c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"d384fa5cf5c165fb857b5286823c29102a8f8ecba4d0681cb67ef3f3465b3ef7\" already exists"}
{"level":"error","ts":"2026-11-02T22:23:16.593Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-inf-b-3edc8c","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/ratelimit":"true"},"name":"kuadrant-ratelimiting-e2e-inf-b-3edc8c","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-inf-b-3edc8c","uid":"68cc9571-28fc-4a9c-ac95-19a198bca6a3"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"limitador-limitador.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-ratelimit-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"limitador-limitador.kuadrant-system.svc.cluster.local","port_value":8081}}}}]}]},"name":"kuadrant-ratelimit-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-inf-b-3edc8c"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-inf-b-3edc8c\" already exists"}
{"level":"error","ts":"2026-11-02T22:23:16.598Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-mt-b5e8794c","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"kuadrant-auth-e2e-mt-b5e8794c","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-mt-b5e8794c","uid":"1eee245d-6b25-4613-9b8e-0d58b2f756f0"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-auth-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local","port_value":50051}}}}]}]},"name":"kuadrant-auth-service","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-mt-b5e8794c"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-mt-b5e8794c\" already exists"}
{"level":"error","ts":"2026-11-02T22:23:16.610Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-02T22:20:07Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:20:07Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:20:07Z"}],"name":"ad5aa9665d52830893fb4af1a6c52222eff28c5437dcf9fe501cab6f82aeaea0","namespace":"kuadrant-system","resourceVersion":"120315","uid":"26290c3a-7ad9-46a3-877e-afa01d04ea68"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["ad5aa9665d52830893fb4af1a6c52222eff28c5437dcf9fe501cab6f82aeaea0"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:20:07Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:20:07Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["ad5aa9665d52830893fb4af1a6c52222eff28c5437dcf9fe501cab6f82aeaea0"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"ad5aa9665d52830893fb4af1a6c52222eff28c5437dcf9fe501cab6f82aeaea0\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:23:16.687Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-02T22:20:06Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:20:06Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:20:07Z"}],"name":"55a7427f941cf70e3504be7b1faaabc3224d15aa575a45663edd720843ebc89b","namespace":"kuadrant-system","resourceVersion":"120304","uid":"54b42902-3737-48d5-91b1-019b310945f2"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["55a7427f941cf70e3504be7b1faaabc3224d15aa575a45663edd720843ebc89b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:20:07Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:20:07Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["55a7427f941cf70e3504be7b1faaabc3224d15aa575a45663edd720843ebc89b"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"55a7427f941cf70e3504be7b1faaabc3224d15aa575a45663edd720843ebc89b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:23:16.754Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-inf-b-3edc8c","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-inf-b-3edc8c#rule-3"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"506ee78df039847eaf97d9b8797d038e73fae7adbf56dc0e52f7a663c5d452c7","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["506ee78df039847eaf97d9b8797d038e73fae7adbf56dc0e52f7a663c5d452c7"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-b-3edc8c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-b-3edc8c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"506ee78df039847eaf97d9b8797d038e73fae7adbf56dc0e52f7a663c5d452c7\" already exists"}
{"level":"error","ts":"2026-11-02T22:23:16.816Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d#rule-5"},"creationTimestamp":"2026-11-02T21:54:29Z","generation":3,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:01:20Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:04:47Z"}],"name":"71e8c9bf81b77581f96b1cca4bb909b8434efbbb06bf9c9ec1aa5c8f412b9c76","namespace":"kuadrant-system","resourceVersion":"97348","uid":"8e3bdfbd-1c5f-4bb7-8e05-2f58902e4b45"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["71e8c9bf81b77581f96b1cca4bb909b8434efbbb06bf9c9ec1aa5c8f412b9c76"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:54:30Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:54:30Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["71e8c9bf81b77581f96b1cca4bb909b8434efbbb06bf9c9ec1aa5c8f412b9c76"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"71e8c9bf81b77581f96b1cca4bb909b8434efbbb06bf9c9ec1aa5c8f412b9c76\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:23:16.819Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-inf-b-3edc8c","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"name":"kuadrant-e2e-inf-b-3edc8c","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-inf-b-3edc8c","uid":"68cc9571-28fc-4a9c-ac95-19a198bca6a3"}]},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"21b1a6ca1ae1c0d355f8efee74ea966b546c6cffa1abd25d2b5f5c54041fe5c5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-b-3edc8c-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__605ae212\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-b-3edc8c\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-3edc8c\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__605ae212\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-b-3edc8c\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-3edc8c\"]}],\"name\":\"c1911910e55182af965d610d9f38bc05dd806cebfbfe970cb6f8749b66982d0c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0df68770dc5dac7bc3f9ac1ab3d499955b3caad971ba2ac6fc9c945b4e7e14b6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-b-3edc8c-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__605ae212\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-b-3edc8c\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-3edc8c\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__605ae212\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-b-3edc8c\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-3edc8c\"]}],\"name\":\"17160e14e26559b4479fb6e2034ef26f1d0f31f140211975c1f61ca45ab1b94c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ca8dbbb4f6d8c35d9753bef1b5d4c695d70368d73b36d43c4601f15e8274e497\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-b-3edc8c-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__605ae212\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-b-3edc8c\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-3edc8c\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__605ae212\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-b-3edc8c\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-3edc8c\"]}],\"name\":\"b63d882475e50b1ac0d08379fff5dc310ba08ff7e819f684547cf66c15246001\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"506ee78df039847eaf97d9b8797d038e73fae7adbf56dc0e52f7a663c5d452c7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-b-3edc8c-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__605ae212\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-b-3edc8c\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-3edc8c\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__605ae212\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-b-3edc8c\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-3edc8c\"]}],\"name\":\"39e0359951c94a038331af98bf39a862f589ea32bdd6cb6c2471864ed407b766\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8e781df81ba5207a5cece941d490e647f56b022e86b1c0e7a56ff113fb0f316e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-b-3edc8c-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__605ae212\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-b-3edc8c\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-3edc8c\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__605ae212\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-b-3edc8c\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-3edc8c\"]}],\"name\":\"fd481a65db5bc36405090b77bb8aa879bc0c8ac80a69f61e344e0359db36c826\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"33fbe4ab46531d497814b46bc8258e0ed11d06dd94c3583a59c7924e16b4166b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-b-3edc8c-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__605ae212\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-b-3edc8c\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-3edc8c\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__605ae212\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-b-3edc8c\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-3edc8c\"]}],\"name\":\"9d8edfc92028f64c074755ccc3b0a3fe0b02ca61ffe68ae4765f79ff822d3b82\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-inf-b-3edc8c"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-e2e-inf-b-3edc8c\" already exists"}
{"level":"error","ts":"2026-11-02T22:23:16.877Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d#rule-1"},"creationTimestamp":"2026-11-02T21:54:29Z","generation":3,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:01:19Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:04:44Z"}],"name":"7482755e6f782100b8480fa82045aac768a6400e192241b0d0cf93403dad8edb","namespace":"kuadrant-system","resourceVersion":"97203","uid":"8f03f824-a6f8-42fb-be62-97bedf901cac"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["7482755e6f782100b8480fa82045aac768a6400e192241b0d0cf93403dad8edb"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:04:44Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:04:44Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["7482755e6f782100b8480fa82045aac768a6400e192241b0d0cf93403dad8edb"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"7482755e6f782100b8480fa82045aac768a6400e192241b0d0cf93403dad8edb\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:23:16.944Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-inf-b-3edc8c","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-inf-b-3edc8c#rule-2"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"0df68770dc5dac7bc3f9ac1ab3d499955b3caad971ba2ac6fc9c945b4e7e14b6","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["0df68770dc5dac7bc3f9ac1ab3d499955b3caad971ba2ac6fc9c945b4e7e14b6"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-b-3edc8c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-b-3edc8c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"0df68770dc5dac7bc3f9ac1ab3d499955b3caad971ba2ac6fc9c945b4e7e14b6\" already exists"}
{"level":"error","ts":"2026-11-02T22:23:17.009Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d#rule-3"},"creationTimestamp":"2026-11-02T21:54:30Z","generation":3,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:01:18Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:04:44Z"}],"name":"c3ead856f0c0807270869b6a467d9281b93eaaa8c65e788c4b6393073db2cbe8","namespace":"kuadrant-system","resourceVersion":"97215","uid":"f849a86d-55d5-4304-af00-b79e8250f69e"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["c3ead856f0c0807270869b6a467d9281b93eaaa8c65e788c4b6393073db2cbe8"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:54:31Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:54:31Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["c3ead856f0c0807270869b6a467d9281b93eaaa8c65e788c4b6393073db2cbe8"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"c3ead856f0c0807270869b6a467d9281b93eaaa8c65e788c4b6393073db2cbe8\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:23:17.146Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-mt-b5e8794c","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-mt-b5e8794c#rule-6"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"552e50da6fc8ce78112c3c10f99af3b6236a8497fbf912065710655e8510504c","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["552e50da6fc8ce78112c3c10f99af3b6236a8497fbf912065710655e8510504c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-b5e8794c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-b5e8794c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"552e50da6fc8ce78112c3c10f99af3b6236a8497fbf912065710655e8510504c\" already exists"}
{"level":"error","ts":"2026-11-02T22:23:17.223Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-mt-b5e8794c","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-mt-b5e8794c#rule-5"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"c3872837f0a1675ae7d85b6110e063fcc6880d67dda62e579edbd33e2ec8354b","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["c3872837f0a1675ae7d85b6110e063fcc6880d67dda62e579edbd33e2ec8354b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-b5e8794c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-b5e8794c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"c3872837f0a1675ae7d85b6110e063fcc6880d67dda62e579edbd33e2ec8354b\" already exists"}
{"level":"error","ts":"2026-11-02T22:23:17.286Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-02T22:20:06Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:20:06Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:20:06Z"}],"name":"ae47fb19c324c072c578abb0ac24ae029fef313aee06a65794451952fe00b10b","namespace":"kuadrant-system","resourceVersion":"120297","uid":"701cc148-f001-4f64-bad1-c4d680afd7e2"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["ae47fb19c324c072c578abb0ac24ae029fef313aee06a65794451952fe00b10b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:20:06Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:20:06Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["ae47fb19c324c072c578abb0ac24ae029fef313aee06a65794451952fe00b10b"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"ae47fb19c324c072c578abb0ac24ae029fef313aee06a65794451952fe00b10b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:23:17.351Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-02T22:20:06Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:20:06Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:20:06Z"}],"name":"cee3ed5de102b63f4fd0d549002d21484e590243e6bb220ff26d56c71481f262","namespace":"kuadrant-system","resourceVersion":"120285","uid":"eff0c9a1-f54b-48bd-a9bd-8b6fb5a97d5b"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["cee3ed5de102b63f4fd0d549002d21484e590243e6bb220ff26d56c71481f262"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:20:06Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:20:06Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["cee3ed5de102b63f4fd0d549002d21484e590243e6bb220ff26d56c71481f262"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"cee3ed5de102b63f4fd0d549002d21484e590243e6bb220ff26d56c71481f262\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:23:17.423Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-mt-b5e8794c","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-mt-b5e8794c#rule-3"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"27eb83fd0535f24cd93b0d1ce0ccbbba7d5a16cabf5cbfd422e5f99e46bae24a","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["27eb83fd0535f24cd93b0d1ce0ccbbba7d5a16cabf5cbfd422e5f99e46bae24a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-b5e8794c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-b5e8794c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"27eb83fd0535f24cd93b0d1ce0ccbbba7d5a16cabf5cbfd422e5f99e46bae24a\" already exists"}
{"level":"error","ts":"2026-11-02T22:23:17.488Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-mt-b5e8794c","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"name":"kuadrant-e2e-mt-b5e8794c","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-mt-b5e8794c","uid":"1eee245d-6b25-4613-9b8e-0d58b2f756f0"}]},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"552e50da6fc8ce78112c3c10f99af3b6236a8497fbf912065710655e8510504c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-b5e8794c-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__935ec6dd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-mt-b5e8794c\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-b5e8794c\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__935ec6dd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-mt-b5e8794c\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-b5e8794c\"]}],\"name\":\"82ff5749f44463f02170b39f993d77c7aa062142e34cb1497fe03bab0af2de26\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d384fa5cf5c165fb857b5286823c29102a8f8ecba4d0681cb67ef3f3465b3ef7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-b5e8794c-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__935ec6dd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-mt-b5e8794c\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-b5e8794c\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__935ec6dd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-mt-b5e8794c\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-b5e8794c\"]}],\"name\":\"0d4b4412e78de0239876a1bec358f53d4ad341c18dca28bf794fe1efbb40b5e6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c3872837f0a1675ae7d85b6110e063fcc6880d67dda62e579edbd33e2ec8354b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-b5e8794c-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__935ec6dd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-mt-b5e8794c\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-b5e8794c\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__935ec6dd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-mt-b5e8794c\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-b5e8794c\"]}],\"name\":\"68c2c2943da40f2a11c7b05a2efbbe6954746118ff2bb2344ba96d1f8865b14c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"27eb83fd0535f24cd93b0d1ce0ccbbba7d5a16cabf5cbfd422e5f99e46bae24a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-b5e8794c-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__935ec6dd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-mt-b5e8794c\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-b5e8794c\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__935ec6dd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-mt-b5e8794c\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-b5e8794c\"]}],\"name\":\"b754d7007a9be3c661fe21c271b1c71c4792f6c9b6dcfb4b98ae5b652c27c236\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a30fc40a33264166b3248563865f6a93df25171b48cc3ff2466bf0a3aa6ee4ac\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-b5e8794c-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__935ec6dd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-mt-b5e8794c\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-b5e8794c\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__935ec6dd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-mt-b5e8794c\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-b5e8794c\"]}],\"name\":\"722d49fa93e37da3871f708eaa47c447e499929321ab060520de418a0acae9c2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d944074e3b0370c28c53c2e313e65c18d16764bcebb8701e880db212d3ce3849\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-b5e8794c-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__935ec6dd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-mt-b5e8794c\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-b5e8794c\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__935ec6dd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-mt-b5e8794c\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-b5e8794c\"]}],\"name\":\"7c2637b130cdf85931196d83cd75d8d92fff2118c4319ab4084bc28e09608c85\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-mt-b5e8794c"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-e2e-mt-b5e8794c\" already exists"}
{"level":"error","ts":"2026-11-02T22:23:17.489Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-02T22:20:06Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:20:06Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:20:06Z"}],"name":"d03cda72cd19a4be8449b91e7c0874bc3615d892fbc822ada2024e8c1dc8bd56","namespace":"kuadrant-system","resourceVersion":"120301","uid":"2a88e818-5b7e-4d9f-92f0-4d73775d87cc"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d03cda72cd19a4be8449b91e7c0874bc3615d892fbc822ada2024e8c1dc8bd56"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:20:06Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:20:06Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["d03cda72cd19a4be8449b91e7c0874bc3615d892fbc822ada2024e8c1dc8bd56"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"d03cda72cd19a4be8449b91e7c0874bc3615d892fbc822ada2024e8c1dc8bd56\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:23:17.556Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-inf-b-3edc8c","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-inf-b-3edc8c#rule-1"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"33fbe4ab46531d497814b46bc8258e0ed11d06dd94c3583a59c7924e16b4166b","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["33fbe4ab46531d497814b46bc8258e0ed11d06dd94c3583a59c7924e16b4166b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-b-3edc8c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-b-3edc8c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"33fbe4ab46531d497814b46bc8258e0ed11d06dd94c3583a59c7924e16b4166b\" already exists"}
{"level":"error","ts":"2026-11-02T22:23:17.623Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-mt-b5e8794c","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-mt-b5e8794c#rule-4"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"a30fc40a33264166b3248563865f6a93df25171b48cc3ff2466bf0a3aa6ee4ac","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a30fc40a33264166b3248563865f6a93df25171b48cc3ff2466bf0a3aa6ee4ac"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-b5e8794c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-b5e8794c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"a30fc40a33264166b3248563865f6a93df25171b48cc3ff2466bf0a3aa6ee4ac\" already exists"}
{"level":"error","ts":"2026-11-02T22:23:17.686Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d#rule-2"},"creationTimestamp":"2026-11-02T21:54:29Z","generation":3,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:01:20Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:04:46Z"}],"name":"65ad30c331bd08b64f99c2bfc9d23db3979d37b9d3b916cb76d08a0dfabf963a","namespace":"kuadrant-system","resourceVersion":"97278","uid":"6ff8c85b-eced-417f-a7cc-ef673cbc30f6"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["65ad30c331bd08b64f99c2bfc9d23db3979d37b9d3b916cb76d08a0dfabf963a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:54:30Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:54:30Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["65ad30c331bd08b64f99c2bfc9d23db3979d37b9d3b916cb76d08a0dfabf963a"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"65ad30c331bd08b64f99c2bfc9d23db3979d37b9d3b916cb76d08a0dfabf963a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:23:17.750Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-02T22:20:06Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:20:06Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:20:06Z"}],"name":"92c755f42520a16c18887562f8b0dd82ce78b0c009a03cf56621703050a4589e","namespace":"kuadrant-system","resourceVersion":"120295","uid":"4f805ed8-566a-4c96-a876-680723a87aff"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["92c755f42520a16c18887562f8b0dd82ce78b0c009a03cf56621703050a4589e"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:20:06Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:20:06Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["92c755f42520a16c18887562f8b0dd82ce78b0c009a03cf56621703050a4589e"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"92c755f42520a16c18887562f8b0dd82ce78b0c009a03cf56621703050a4589e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:23:17.812Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-02T22:20:06Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:20:06Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:20:06Z"}],"name":"6d702678bda1dfc9e3eeb362adcee5bc69be4839840717fadfcf3f540bbad15d","namespace":"kuadrant-system","resourceVersion":"120289","uid":"1789057c-8a63-447d-893c-e05d61bbde02"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["6d702678bda1dfc9e3eeb362adcee5bc69be4839840717fadfcf3f540bbad15d"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:20:06Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:20:06Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["6d702678bda1dfc9e3eeb362adcee5bc69be4839840717fadfcf3f540bbad15d"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"6d702678bda1dfc9e3eeb362adcee5bc69be4839840717fadfcf3f540bbad15d\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:23:17.875Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d#rule-6"},"creationTimestamp":"2026-11-02T21:54:29Z","generation":3,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:01:19Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:04:47Z"}],"name":"376d56a711fbb2b29d7c46a8a0998936174b738443f0db294a13f85fd8478a94","namespace":"kuadrant-system","resourceVersion":"97336","uid":"87249339-368d-4d8c-8467-fde5ee5d92d7"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["376d56a711fbb2b29d7c46a8a0998936174b738443f0db294a13f85fd8478a94"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:54:30Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:54:30Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["376d56a711fbb2b29d7c46a8a0998936174b738443f0db294a13f85fd8478a94"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"376d56a711fbb2b29d7c46a8a0998936174b738443f0db294a13f85fd8478a94\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:23:17.942Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-mt-b5e8794c","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-mt-b5e8794c#rule-1"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"d944074e3b0370c28c53c2e313e65c18d16764bcebb8701e880db212d3ce3849","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d944074e3b0370c28c53c2e313e65c18d16764bcebb8701e880db212d3ce3849"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-b5e8794c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-mt-b5e8794c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"d944074e3b0370c28c53c2e313e65c18d16764bcebb8701e880db212d3ce3849\" already exists"}
{"level":"error","ts":"2026-11-02T22:23:18.006Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-02T22:20:06Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:20:06Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:20:07Z"}],"name":"85484301f7aa6f30a87b224096575af8d7beea83a8ccf5091f246a4cb028e31b","namespace":"kuadrant-system","resourceVersion":"120305","uid":"5da18c5c-0e1c-4cbb-ab01-5de3690348a2"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["85484301f7aa6f30a87b224096575af8d7beea83a8ccf5091f246a4cb028e31b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:20:07Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:20:07Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["85484301f7aa6f30a87b224096575af8d7beea83a8ccf5091f246a4cb028e31b"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"85484301f7aa6f30a87b224096575af8d7beea83a8ccf5091f246a4cb028e31b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:23:18.078Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-inf-b-3edc8c","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-inf-b-3edc8c#rule-5"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"ca8dbbb4f6d8c35d9753bef1b5d4c695d70368d73b36d43c4601f15e8274e497","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["ca8dbbb4f6d8c35d9753bef1b5d4c695d70368d73b36d43c4601f15e8274e497"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-b-3edc8c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-b-3edc8c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"ca8dbbb4f6d8c35d9753bef1b5d4c695d70368d73b36d43c4601f15e8274e497\" already exists"}
{"level":"error","ts":"2026-11-02T22:23:18.140Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d#rule-4"},"creationTimestamp":"2026-11-02T21:54:29Z","generation":3,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:01:19Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:04:45Z"}],"name":"8b7e784474461510a9d9970d39fe03c297fc6f9a5f80873c40898bdfcb389e5f","namespace":"kuadrant-system","resourceVersion":"97238","uid":"f7425df0-2e92-4ae4-8201-ef2b895a8fa6"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["8b7e784474461510a9d9970d39fe03c297fc6f9a5f80873c40898bdfcb389e5f"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:01:19Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:01:19Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["8b7e784474461510a9d9970d39fe03c297fc6f9a5f80873c40898bdfcb389e5f"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"8b7e784474461510a9d9970d39fe03c297fc6f9a5f80873c40898bdfcb389e5f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:23:18.207Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-inf-b-3edc8c","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-inf-b-3edc8c#rule-4"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"8e781df81ba5207a5cece941d490e647f56b022e86b1c0e7a56ff113fb0f316e","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["8e781df81ba5207a5cece941d490e647f56b022e86b1c0e7a56ff113fb0f316e"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-b-3edc8c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-b-3edc8c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"8e781df81ba5207a5cece941d490e647f56b022e86b1c0e7a56ff113fb0f316e\" already exists"}
{"level":"error","ts":"2026-11-02T22:23:18.270Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-02T22:20:06Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:20:06Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:20:06Z"}],"name":"ccba7a9b1f6fb13d16375041d5707e71f92b68b4e5eb52e231100015ff08ef4b","namespace":"kuadrant-system","resourceVersion":"120292","uid":"36d52290-3df0-4d2c-b495-2d8263932ee9"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["ccba7a9b1f6fb13d16375041d5707e71f92b68b4e5eb52e231100015ff08ef4b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:20:06Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:20:06Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["ccba7a9b1f6fb13d16375041d5707e71f92b68b4e5eb52e231100015ff08ef4b"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"ccba7a9b1f6fb13d16375041d5707e71f92b68b4e5eb52e231100015ff08ef4b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:23:18.335Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-02T22:20:06Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:20:06Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:20:07Z"}],"name":"c5421eebe7da7086c1d4756a4f69af5cdd7ec596e7f07e8aff73f29facff31ae","namespace":"kuadrant-system","resourceVersion":"120308","uid":"c45d1f70-0e64-4202-909b-5966c2c9ef62"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["c5421eebe7da7086c1d4756a4f69af5cdd7ec596e7f07e8aff73f29facff31ae"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:20:07Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:20:07Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["c5421eebe7da7086c1d4756a4f69af5cdd7ec596e7f07e8aff73f29facff31ae"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"c5421eebe7da7086c1d4756a4f69af5cdd7ec596e7f07e8aff73f29facff31ae\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:23:18.397Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-02T22:20:06Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:20:06Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:20:06Z"}],"name":"059aa363c4f5743984f4a4750b299221d4153361bba88fb44779ada6b736d06a","namespace":"kuadrant-system","resourceVersion":"120272","uid":"e424df59-5ab9-4499-97ec-7da8d58e1930"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["059aa363c4f5743984f4a4750b299221d4153361bba88fb44779ada6b736d06a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:20:06Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:20:06Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["059aa363c4f5743984f4a4750b299221d4153361bba88fb44779ada6b736d06a"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"059aa363c4f5743984f4a4750b299221d4153361bba88fb44779ada6b736d06a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:23:18.468Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-inf-b-3edc8c","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-inf-b-3edc8c#rule-6"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"21b1a6ca1ae1c0d355f8efee74ea966b546c6cffa1abd25d2b5f5c54041fe5c5","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["21b1a6ca1ae1c0d355f8efee74ea966b546c6cffa1abd25d2b5f5c54041fe5c5"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-b-3edc8c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-b-3edc8c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"21b1a6ca1ae1c0d355f8efee74ea966b546c6cffa1abd25d2b5f5c54041fe5c5\" already exists"}
{"level":"error","ts":"2026-11-02T22:23:18.529Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-02T22:20:06Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:20:06Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:20:06Z"}],"name":"04ef5a9f5a54464f8dc13ab6c0af24178bef36e48dd84e92297e1f685bae9a8a","namespace":"kuadrant-system","resourceVersion":"120270","uid":"aa94e7ae-a29f-4493-87ea-5503587726b6"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["04ef5a9f5a54464f8dc13ab6c0af24178bef36e48dd84e92297e1f685bae9a8a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:20:06Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:20:06Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["04ef5a9f5a54464f8dc13ab6c0af24178bef36e48dd84e92297e1f685bae9a8a"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"04ef5a9f5a54464f8dc13ab6c0af24178bef36e48dd84e92297e1f685bae9a8a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:23:18.595Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-a-w4-7cde84-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-a-w4-7cde84-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:23:18.768Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-inf-a-dd28e6-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-inf-a-dd28e6-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:23:19.007Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-inf-b-3edc8c","namespace":"openshift-ingress","uid":"5b23212e-4202-47fd-8f14-afdf9b0a9117","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-inf-b-3edc8c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:23:19.102Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-inf-b-3edc8c-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-inf-b-3edc8c-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:23:19.246Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-mt-b5e8794c","namespace":"openshift-ingress","uid":"fb0f6409-e4db-4e52-8fe1-83eee426d4f3","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-mt-b5e8794c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:23:19.796Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-mt-b5e8794c-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-mt-b5e8794c-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:23:19.931Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-a-w0-6e535d-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-a-w0-6e535d-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:23:20.384Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T22:23:20.384Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T22:23:20.592Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-mt-b5e8794c","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-mt-b5e8794c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:23:20.612Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"maas-api-route-e2e-mt-b5e8794c","namespace":"odh-ai-gateway-infra","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"maas-api-route-e2e-mt-b5e8794c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:23:20.792Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"maas-api-route-e2e-inf-b-3edc8c","namespace":"odh-ai-gateway-infra","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"maas-api-route-e2e-inf-b-3edc8c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:23:20.957Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-b-w4-58ca7f","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-shared-b-w4-58ca7f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:23:21.366Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-inf-b-3edc8c","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-inf-b-3edc8c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:23:29.499Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","HTTPRoute","EnvoyFilter","TokenRateLimitPolicy","Gateway","AuthPolicy","Limitador","ConfigMap"],"eventTypes":{"create":20,"update":32}}
{"level":"info","ts":"2026-11-02T22:23:29.905Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T22:23:33.323Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T22:23:33.471Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:23:33.471Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T22:23:38.360Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:23:38.360Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:23:38.370Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T22:23:38.372Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:23:38.394Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:23:38.394Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T22:23:38.523Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T22:23:42.373Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T22:23:42.373Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T22:23:55.249Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Limitador","AuthConfig","HTTPRoute","AuthPolicy","EnvoyFilter","ConfigMap","TokenRateLimitPolicy"],"eventTypes":{"create":12,"update":14}}
{"level":"info","ts":"2026-11-02T22:23:55.763Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T22:23:58.831Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T22:23:58.970Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:23:58.970Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T22:24:03.744Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:24:03.749Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:24:03.756Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:24:03.757Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-02T22:24:03.757Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T22:24:03.760Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:24:03.760Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-02T22:24:07.075Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-a-w4-7cde84-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-a-w4-7cde84-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:24:08.571Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T22:24:08.571Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T22:24:10.577Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthPolicy"],"eventTypes":{"update":2}}
{"level":"info","ts":"2026-11-02T22:24:18.246Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:24:18.261Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:24:18.261Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-02T22:24:18.363Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-inf-b-cf2a53/test-model-cf2a53-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-inf-b-cf2a53/test-model-cf2a53-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-02T22:21:56Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:21:56Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:21:56Z"}],"name":"9da1cd647a32052e65257e603b4575d2cfa2f998b4bd573b105b322ee6d2cd51","namespace":"kuadrant-system","resourceVersion":"122890","uid":"797f4779-fb23-4b2a-ae7a-c75003201de6"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["9da1cd647a32052e65257e603b4575d2cfa2f998b4bd573b105b322ee6d2cd51"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-b-cf2a53.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-b-cf2a53.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:21:56Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:21:56Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["9da1cd647a32052e65257e603b4575d2cfa2f998b4bd573b105b322ee6d2cd51"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"9da1cd647a32052e65257e603b4575d2cfa2f998b4bd573b105b322ee6d2cd51\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:24:18.432Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-inf-b-cf2a53/test-model-cf2a53-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-inf-b-cf2a53/test-model-cf2a53-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-02T22:21:57Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:21:57Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:21:58Z"}],"name":"ae538932d8b6f49827040f7f8ca1b30791881c6e01c750e3bba7a11444701aef","namespace":"kuadrant-system","resourceVersion":"122954","uid":"70e58539-fa58-4e96-ac10-c9e8cc4c73a7"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["ae538932d8b6f49827040f7f8ca1b30791881c6e01c750e3bba7a11444701aef"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-b-cf2a53.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-b-cf2a53.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:21:58Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:21:58Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["ae538932d8b6f49827040f7f8ca1b30791881c6e01c750e3bba7a11444701aef"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"ae538932d8b6f49827040f7f8ca1b30791881c6e01c750e3bba7a11444701aef\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:24:18.537Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-inf-b-cf2a53/test-model-cf2a53-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-inf-b-cf2a53/test-model-cf2a53-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-02T22:21:56Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:21:56Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:21:56Z"}],"name":"a234aedd33a300d9ddb29b5cc4775d742e324acc4eba36683fda82c514ca4df7","namespace":"kuadrant-system","resourceVersion":"122903","uid":"7606f6b7-0e43-4111-aba1-cfa98172a9d1"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a234aedd33a300d9ddb29b5cc4775d742e324acc4eba36683fda82c514ca4df7"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-b-cf2a53.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-b-cf2a53.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:21:56Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:21:56Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["a234aedd33a300d9ddb29b5cc4775d742e324acc4eba36683fda82c514ca4df7"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a234aedd33a300d9ddb29b5cc4775d742e324acc4eba36683fda82c514ca4df7\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:24:18.623Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-inf-b-cf2a53","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-inf-b-cf2a53#rule-1"},"creationTimestamp":"2026-11-02T22:19:24Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:19:24Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:19:24Z"}],"name":"678ba96c8e01f3819132ce94ffb60abe123db2e883a2d335ec0ae1a65eebc9c2","namespace":"kuadrant-system","resourceVersion":"119414","uid":"12d6b171-8153-4e63-9aa5-7fdd306dab8f"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["678ba96c8e01f3819132ce94ffb60abe123db2e883a2d335ec0ae1a65eebc9c2"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-b-cf2a53.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-b-cf2a53.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:19:24Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:19:24Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["678ba96c8e01f3819132ce94ffb60abe123db2e883a2d335ec0ae1a65eebc9c2"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"678ba96c8e01f3819132ce94ffb60abe123db2e883a2d335ec0ae1a65eebc9c2\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:24:18.685Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w0-0f0874/rate-test-model-0f0874-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w0-0f0874/rate-test-model-0f0874-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-02T22:21:58Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:21:58Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:21:59Z"}],"name":"48e95544e68fc50e4e4e36c8679af44644ecbfb2cf7df51e27a09f30472eda9e","namespace":"kuadrant-system","resourceVersion":"122992","uid":"d54ae2b4-349d-4cea-9bd2-48806259b9ff"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["48e95544e68fc50e4e4e36c8679af44644ecbfb2cf7df51e27a09f30472eda9e"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:21:59Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:21:59Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["48e95544e68fc50e4e4e36c8679af44644ecbfb2cf7df51e27a09f30472eda9e"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"48e95544e68fc50e4e4e36c8679af44644ecbfb2cf7df51e27a09f30472eda9e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:24:18.748Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w0-0f0874","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w0-0f0874#rule-1"},"creationTimestamp":"2026-11-02T21:56:34Z","generation":3,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:02:33Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:04:46Z"}],"name":"ffaef4e77ab77e038e2181351f7ed710141739ce5f70351bf42c0606b9215e72","namespace":"kuadrant-system","resourceVersion":"97295","uid":"0ae00e90-2d9e-4cd3-9880-e48b0f30deaa"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["ffaef4e77ab77e038e2181351f7ed710141739ce5f70351bf42c0606b9215e72"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:56:34Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:56:34Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["ffaef4e77ab77e038e2181351f7ed710141739ce5f70351bf42c0606b9215e72"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"ffaef4e77ab77e038e2181351f7ed710141739ce5f70351bf42c0606b9215e72\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:24:18.816Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-inf-b-cf2a53","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-inf-b-cf2a53#rule-5"},"creationTimestamp":"2026-11-02T22:19:25Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:19:25Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:19:25Z"}],"name":"cef0f4c4be2f6db7ef6ec330309895be984f5a86740e00b7ff2f97edfd998522","namespace":"kuadrant-system","resourceVersion":"119444","uid":"cd69ddf8-90ff-4a1d-8741-6c40dabeb378"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["cef0f4c4be2f6db7ef6ec330309895be984f5a86740e00b7ff2f97edfd998522"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-b-cf2a53.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-b-cf2a53.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:19:25Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:19:25Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["cef0f4c4be2f6db7ef6ec330309895be984f5a86740e00b7ff2f97edfd998522"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"cef0f4c4be2f6db7ef6ec330309895be984f5a86740e00b7ff2f97edfd998522\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:24:18.879Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-inf-b-cf2a53/test-model-cf2a53-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-inf-b-cf2a53/test-model-cf2a53-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-02T22:21:57Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:21:57Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:21:57Z"}],"name":"36f59cd489a1a8c6b8aace4eaab9de289e5f767b7a794a974802f9cb2d951613","namespace":"kuadrant-system","resourceVersion":"122924","uid":"038ba777-62e9-47bf-8a9c-7ebf70b439a0"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["36f59cd489a1a8c6b8aace4eaab9de289e5f767b7a794a974802f9cb2d951613"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-b-cf2a53.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-b-cf2a53.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:21:57Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:21:57Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["36f59cd489a1a8c6b8aace4eaab9de289e5f767b7a794a974802f9cb2d951613"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"36f59cd489a1a8c6b8aace4eaab9de289e5f767b7a794a974802f9cb2d951613\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:24:18.947Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w0-0f0874/rate-test-model-0f0874-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w0-0f0874/rate-test-model-0f0874-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-02T22:21:57Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:21:57Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:21:58Z"}],"name":"aa5865acb61f14eec3bcbdde417b12bdef516ceb89d09786d23726919283c8f2","namespace":"kuadrant-system","resourceVersion":"122951","uid":"9cf3aabe-cacf-48fa-9cb2-3ffd71397ba6"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["aa5865acb61f14eec3bcbdde417b12bdef516ceb89d09786d23726919283c8f2"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:21:58Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:21:58Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["aa5865acb61f14eec3bcbdde417b12bdef516ceb89d09786d23726919283c8f2"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"aa5865acb61f14eec3bcbdde417b12bdef516ceb89d09786d23726919283c8f2\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:24:19.008Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-inf-b-cf2a53","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-inf-b-cf2a53#rule-2"},"creationTimestamp":"2026-11-02T22:19:24Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:19:24Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:19:24Z"}],"name":"c81789e1553bf7e7d1d0740e3a95011d3c200b400ce15c0a79e4cb90668180c5","namespace":"kuadrant-system","resourceVersion":"119419","uid":"722734fe-b1df-4afd-825d-c6ce9cc6129d"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["c81789e1553bf7e7d1d0740e3a95011d3c200b400ce15c0a79e4cb90668180c5"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-b-cf2a53.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-b-cf2a53.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:19:24Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:19:24Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["c81789e1553bf7e7d1d0740e3a95011d3c200b400ce15c0a79e4cb90668180c5"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"c81789e1553bf7e7d1d0740e3a95011d3c200b400ce15c0a79e4cb90668180c5\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:24:19.075Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w0-0f0874","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w0-0f0874#rule-2"},"creationTimestamp":"2026-11-02T21:56:34Z","generation":3,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:02:33Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:04:47Z"}],"name":"8ccf868b0c716a18e90e502ebb2284ce90d5ee3fcd5779be4d996fb8a3d03b43","namespace":"kuadrant-system","resourceVersion":"97357","uid":"0a0ee5ce-0c48-4c2d-85b6-4991d695d43a"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["8ccf868b0c716a18e90e502ebb2284ce90d5ee3fcd5779be4d996fb8a3d03b43"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:56:34Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:56:34Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["8ccf868b0c716a18e90e502ebb2284ce90d5ee3fcd5779be4d996fb8a3d03b43"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"8ccf868b0c716a18e90e502ebb2284ce90d5ee3fcd5779be4d996fb8a3d03b43\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:24:19.139Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-inf-b-cf2a53","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-inf-b-cf2a53#rule-6"},"creationTimestamp":"2026-11-02T22:19:25Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:19:25Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:19:25Z"}],"name":"5a40698293ed44103a2b127c08980b4704f79ba3d5f07cb6981daedc8d4d99d4","namespace":"kuadrant-system","resourceVersion":"119435","uid":"0ff7c828-d438-4632-85c4-780cec499d22"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["5a40698293ed44103a2b127c08980b4704f79ba3d5f07cb6981daedc8d4d99d4"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-b-cf2a53.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-b-cf2a53.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:19:25Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:19:25Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["5a40698293ed44103a2b127c08980b4704f79ba3d5f07cb6981daedc8d4d99d4"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"5a40698293ed44103a2b127c08980b4704f79ba3d5f07cb6981daedc8d4d99d4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:24:19.202Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-inf-b-cf2a53/test-model-cf2a53-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-inf-b-cf2a53/test-model-cf2a53-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-02T22:21:57Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:21:57Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:21:57Z"}],"name":"a9c4f48d62ee69c54ae779d6c76b9fe145dd93b97bc6ee8b7f8cdf551f7e1301","namespace":"kuadrant-system","resourceVersion":"122944","uid":"01de6e11-6ca2-44b1-85b2-ed3fae8a4295"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a9c4f48d62ee69c54ae779d6c76b9fe145dd93b97bc6ee8b7f8cdf551f7e1301"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-b-cf2a53.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-b-cf2a53.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:21:57Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:21:57Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["a9c4f48d62ee69c54ae779d6c76b9fe145dd93b97bc6ee8b7f8cdf551f7e1301"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a9c4f48d62ee69c54ae779d6c76b9fe145dd93b97bc6ee8b7f8cdf551f7e1301\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:24:19.265Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-inf-b-cf2a53/test-model-cf2a53-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-inf-b-cf2a53/test-model-cf2a53-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-02T22:21:57Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:21:57Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:21:57Z"}],"name":"75422695f1d128b0d1545739622bea2225ae8c48899cc84d91003457e1161238","namespace":"kuadrant-system","resourceVersion":"122933","uid":"200bea71-5b4b-4189-8d15-ed2a297bdbef"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["75422695f1d128b0d1545739622bea2225ae8c48899cc84d91003457e1161238"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-b-cf2a53.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-b-cf2a53.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:21:57Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:21:57Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["75422695f1d128b0d1545739622bea2225ae8c48899cc84d91003457e1161238"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"75422695f1d128b0d1545739622bea2225ae8c48899cc84d91003457e1161238\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:24:19.328Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-inf-b-cf2a53/test-model-cf2a53-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-inf-b-cf2a53/test-model-cf2a53-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-02T22:21:57Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:21:57Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:21:57Z"}],"name":"d4c683e7155828a798af50a301faea067a965501f891b81ab087cb5c27a019e0","namespace":"kuadrant-system","resourceVersion":"122916","uid":"e139c5a3-05cb-4414-b18d-ffb99e2e8edf"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d4c683e7155828a798af50a301faea067a965501f891b81ab087cb5c27a019e0"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-b-cf2a53.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-b-cf2a53.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:21:57Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:21:57Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["d4c683e7155828a798af50a301faea067a965501f891b81ab087cb5c27a019e0"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"d4c683e7155828a798af50a301faea067a965501f891b81ab087cb5c27a019e0\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:24:19.393Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-inf-b-cf2a53/test-model-cf2a53-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-inf-b-cf2a53/test-model-cf2a53-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-02T22:21:56Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:21:56Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:21:56Z"}],"name":"0b3150ef82234069264c1ae3ab23e26e2411f4a59c3e35b9bd0696949df8b07c","namespace":"kuadrant-system","resourceVersion":"122897","uid":"0c774bca-10b8-41f5-8b68-05d171100087"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["0b3150ef82234069264c1ae3ab23e26e2411f4a59c3e35b9bd0696949df8b07c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-b-cf2a53.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-b-cf2a53.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:21:56Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:21:56Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["0b3150ef82234069264c1ae3ab23e26e2411f4a59c3e35b9bd0696949df8b07c"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"0b3150ef82234069264c1ae3ab23e26e2411f4a59c3e35b9bd0696949df8b07c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:24:19.456Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w0-0f0874","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w0-0f0874#rule-5"},"creationTimestamp":"2026-11-02T21:56:33Z","generation":3,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:02:34Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:04:47Z"}],"name":"848b20842f79c8cc02bec7966c894853251e29e5c14c8a4cff729041c180e15c","namespace":"kuadrant-system","resourceVersion":"97345","uid":"6384ebbc-a9ea-4bb7-a3b1-750a047b299f"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["848b20842f79c8cc02bec7966c894853251e29e5c14c8a4cff729041c180e15c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:56:34Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:56:34Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["848b20842f79c8cc02bec7966c894853251e29e5c14c8a4cff729041c180e15c"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"848b20842f79c8cc02bec7966c894853251e29e5c14c8a4cff729041c180e15c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:24:19.518Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w0-0f0874/rate-test-model-0f0874-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w0-0f0874/rate-test-model-0f0874-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-02T22:21:57Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:21:57Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:21:57Z"}],"name":"a9353902ff809c3953ab78fb1a74b0913862deabf4e36537f31dcb1d590b46dd","namespace":"kuadrant-system","resourceVersion":"122914","uid":"9ceba798-2b52-481b-8fad-fc477041f889"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a9353902ff809c3953ab78fb1a74b0913862deabf4e36537f31dcb1d590b46dd"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:21:57Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:21:57Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["a9353902ff809c3953ab78fb1a74b0913862deabf4e36537f31dcb1d590b46dd"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a9353902ff809c3953ab78fb1a74b0913862deabf4e36537f31dcb1d590b46dd\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:24:19.580Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-inf-b-cf2a53/test-model-cf2a53-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-inf-b-cf2a53/test-model-cf2a53-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-02T22:21:57Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:21:57Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:21:57Z"}],"name":"b4c56341c5c36a21e698500bb292840aa96122e63d2198e4b4fc18b93329e457","namespace":"kuadrant-system","resourceVersion":"122922","uid":"7a56d0bb-9e48-404f-b4b7-024d920e5d9d"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["b4c56341c5c36a21e698500bb292840aa96122e63d2198e4b4fc18b93329e457"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-b-cf2a53.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-b-cf2a53.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:21:57Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:21:57Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["b4c56341c5c36a21e698500bb292840aa96122e63d2198e4b4fc18b93329e457"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"b4c56341c5c36a21e698500bb292840aa96122e63d2198e4b4fc18b93329e457\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:24:19.642Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w0-0f0874/rate-test-model-0f0874-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w0-0f0874/rate-test-model-0f0874-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-02T22:21:56Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:21:56Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:21:57Z"}],"name":"a7d80a75dae47b36245f18223c45bf04ddce116b33459885543e64da9d9d1caa","namespace":"kuadrant-system","resourceVersion":"122909","uid":"e50df1e7-1125-43ab-b2f5-35068561424f"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a7d80a75dae47b36245f18223c45bf04ddce116b33459885543e64da9d9d1caa"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:21:57Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:21:57Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["a7d80a75dae47b36245f18223c45bf04ddce116b33459885543e64da9d9d1caa"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a7d80a75dae47b36245f18223c45bf04ddce116b33459885543e64da9d9d1caa\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:24:19.704Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-inf-b-cf2a53","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-inf-b-cf2a53#rule-3"},"creationTimestamp":"2026-11-02T22:19:24Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:19:24Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:19:25Z"}],"name":"054d560df1f705c436811daf8d1ea086ac0e3e8dc41620c9afc84b49127ca106","namespace":"kuadrant-system","resourceVersion":"119434","uid":"553857ee-0531-4360-b5f0-e95c8003e05c"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["054d560df1f705c436811daf8d1ea086ac0e3e8dc41620c9afc84b49127ca106"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-b-cf2a53.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-b-cf2a53.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:19:25Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:19:25Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["054d560df1f705c436811daf8d1ea086ac0e3e8dc41620c9afc84b49127ca106"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"054d560df1f705c436811daf8d1ea086ac0e3e8dc41620c9afc84b49127ca106\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:24:19.767Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w0-0f0874","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w0-0f0874#rule-4"},"creationTimestamp":"2026-11-02T21:56:34Z","generation":3,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:02:34Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:04:47Z"}],"name":"6e2c4c40ad28f1eeda9eca533706722536247311f5ede5be2cbe544e374719a6","namespace":"kuadrant-system","resourceVersion":"97355","uid":"0f063dfd-17bc-49a3-923a-24c33cc81a1b"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["6e2c4c40ad28f1eeda9eca533706722536247311f5ede5be2cbe544e374719a6"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:56:34Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:56:34Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["6e2c4c40ad28f1eeda9eca533706722536247311f5ede5be2cbe544e374719a6"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"6e2c4c40ad28f1eeda9eca533706722536247311f5ede5be2cbe544e374719a6\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:24:19.829Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-inf-b-cf2a53","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-inf-b-cf2a53#rule-4"},"creationTimestamp":"2026-11-02T22:19:24Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:19:24Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:19:25Z"}],"name":"0341dd3343c276503041c15c999e18fc35f75cca81eacac744dd9469ae745026","namespace":"kuadrant-system","resourceVersion":"119431","uid":"0734d7cd-450e-4ba2-abaf-bc56332fd3b9"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["0341dd3343c276503041c15c999e18fc35f75cca81eacac744dd9469ae745026"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-b-cf2a53.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-b-cf2a53.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:19:25Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:19:25Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["0341dd3343c276503041c15c999e18fc35f75cca81eacac744dd9469ae745026"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"0341dd3343c276503041c15c999e18fc35f75cca81eacac744dd9469ae745026\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:24:19.890Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w0-0f0874/rate-test-model-0f0874-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w0-0f0874/rate-test-model-0f0874-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-02T22:21:56Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:21:56Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:21:56Z"}],"name":"21c045f9fd9a65bcf44bc04d3fcb17d52c1649c95ac1f90f68dd01492045074d","namespace":"kuadrant-system","resourceVersion":"122900","uid":"e0cf3311-db06-4066-9ec6-cbd372974947"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["21c045f9fd9a65bcf44bc04d3fcb17d52c1649c95ac1f90f68dd01492045074d"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:21:56Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:21:56Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["21c045f9fd9a65bcf44bc04d3fcb17d52c1649c95ac1f90f68dd01492045074d"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"21c045f9fd9a65bcf44bc04d3fcb17d52c1649c95ac1f90f68dd01492045074d\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:24:19.953Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w0-0f0874/rate-test-model-0f0874-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w0-0f0874/rate-test-model-0f0874-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-02T22:21:56Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:21:56Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:21:57Z"}],"name":"27c00f1160fee4edb42d2d932daa50752238a681b270e486550b0ccd674d7682","namespace":"kuadrant-system","resourceVersion":"122911","uid":"440185d5-df09-4c11-8ad7-931acebd941c"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["27c00f1160fee4edb42d2d932daa50752238a681b270e486550b0ccd674d7682"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:21:57Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:21:57Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["27c00f1160fee4edb42d2d932daa50752238a681b270e486550b0ccd674d7682"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"27c00f1160fee4edb42d2d932daa50752238a681b270e486550b0ccd674d7682\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:24:20.015Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w0-0f0874/rate-test-model-0f0874-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w0-0f0874/rate-test-model-0f0874-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-02T22:21:57Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:21:57Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:21:57Z"}],"name":"723ff56478b245706677de5d534bdca6f79a45abce147a872b1386591bf44cbc","namespace":"kuadrant-system","resourceVersion":"122939","uid":"4ff3bc89-1fc6-43b3-9ac7-9dfb02d10af6"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["723ff56478b245706677de5d534bdca6f79a45abce147a872b1386591bf44cbc"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:21:57Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:21:57Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["723ff56478b245706677de5d534bdca6f79a45abce147a872b1386591bf44cbc"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"723ff56478b245706677de5d534bdca6f79a45abce147a872b1386591bf44cbc\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:24:20.077Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w0-0f0874/rate-test-model-0f0874-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w0-0f0874/rate-test-model-0f0874-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-02T22:21:58Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:21:58Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:21:58Z"}],"name":"16fa7701b7d425ecd2db71ef9158baee753a6f3a0a2da1c3b4f412045e679280","namespace":"kuadrant-system","resourceVersion":"122961","uid":"482db935-1ba8-421c-b4b5-5cc3a13666a7"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["16fa7701b7d425ecd2db71ef9158baee753a6f3a0a2da1c3b4f412045e679280"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:21:58Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:21:58Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["16fa7701b7d425ecd2db71ef9158baee753a6f3a0a2da1c3b4f412045e679280"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"16fa7701b7d425ecd2db71ef9158baee753a6f3a0a2da1c3b4f412045e679280\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:24:20.139Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w0-0f0874/rate-test-model-0f0874-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w0-0f0874/rate-test-model-0f0874-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-02T22:21:56Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:21:56Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:21:57Z"}],"name":"f4ecce895af38f9134e1fa20d5bd1e91c0c47aeb2d6d3a1ff49cf2e9138234bb","namespace":"kuadrant-system","resourceVersion":"122906","uid":"565a05e6-140a-46e5-a246-a6d43bf9a776"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f4ecce895af38f9134e1fa20d5bd1e91c0c47aeb2d6d3a1ff49cf2e9138234bb"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:21:57Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:21:57Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["f4ecce895af38f9134e1fa20d5bd1e91c0c47aeb2d6d3a1ff49cf2e9138234bb"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"f4ecce895af38f9134e1fa20d5bd1e91c0c47aeb2d6d3a1ff49cf2e9138234bb\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:24:20.205Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-inf-b-cf2a53/test-model-cf2a53-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-inf-b-cf2a53/test-model-cf2a53-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-02T22:21:57Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:21:57Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:21:58Z"}],"name":"8f54956d96e36043013f1cad22e658a30f7234238f4c6ac115015e6cb72c53af","namespace":"kuadrant-system","resourceVersion":"122957","uid":"6e4603a2-bf49-48d5-87e2-481ac6c8c6a1"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["8f54956d96e36043013f1cad22e658a30f7234238f4c6ac115015e6cb72c53af"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-b-cf2a53.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-b-cf2a53.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:21:58Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:21:58Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["8f54956d96e36043013f1cad22e658a30f7234238f4c6ac115015e6cb72c53af"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"8f54956d96e36043013f1cad22e658a30f7234238f4c6ac115015e6cb72c53af\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:24:20.268Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w0-0f0874/rate-test-model-0f0874-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w0-0f0874/rate-test-model-0f0874-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-02T22:21:58Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:21:58Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:21:58Z"}],"name":"3d0d554392a2c25a1ce426beeffb3f2b91339d1b96f1197bf10fe0af0ece726b","namespace":"kuadrant-system","resourceVersion":"122967","uid":"6f10de51-18d9-4a45-9831-4605fae4d2e7"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["3d0d554392a2c25a1ce426beeffb3f2b91339d1b96f1197bf10fe0af0ece726b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:21:58Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:21:58Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["3d0d554392a2c25a1ce426beeffb3f2b91339d1b96f1197bf10fe0af0ece726b"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"3d0d554392a2c25a1ce426beeffb3f2b91339d1b96f1197bf10fe0af0ece726b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:24:20.329Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-inf-b-cf2a53/test-model-cf2a53-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-inf-b-cf2a53/test-model-cf2a53-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-02T22:21:57Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:21:57Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:21:58Z"}],"name":"01fd84c9f653a29a2a0291503f14873693d890a0d697fa12b20b5b1ea0b13434","namespace":"kuadrant-system","resourceVersion":"122948","uid":"c1afa627-03e1-452b-bcd2-2e04d3615dac"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["01fd84c9f653a29a2a0291503f14873693d890a0d697fa12b20b5b1ea0b13434"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-b-cf2a53.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-b-cf2a53.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:21:58Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:21:58Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["01fd84c9f653a29a2a0291503f14873693d890a0d697fa12b20b5b1ea0b13434"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"01fd84c9f653a29a2a0291503f14873693d890a0d697fa12b20b5b1ea0b13434\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:24:20.392Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w0-0f0874/rate-test-model-0f0874-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w0-0f0874/rate-test-model-0f0874-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-02T22:21:57Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:21:57Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:21:57Z"}],"name":"52afa67a4bb23da81788fa24144b809f70c5f20786bfc6a5c4e8bd0929485ee9","namespace":"kuadrant-system","resourceVersion":"122937","uid":"6bfddea9-7e58-47d1-88cf-b785ff066054"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["52afa67a4bb23da81788fa24144b809f70c5f20786bfc6a5c4e8bd0929485ee9"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:21:57Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:21:57Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["52afa67a4bb23da81788fa24144b809f70c5f20786bfc6a5c4e8bd0929485ee9"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"52afa67a4bb23da81788fa24144b809f70c5f20786bfc6a5c4e8bd0929485ee9\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:24:20.456Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w0-0f0874","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w0-0f0874#rule-6"},"creationTimestamp":"2026-11-02T21:56:34Z","generation":3,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:02:35Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:04:45Z"}],"name":"4676855aaad0efd1f263930f7407a2242dda7211d0408fa3820678f475f20874","namespace":"kuadrant-system","resourceVersion":"97254","uid":"e3d62d4f-d4b7-4603-a0dd-991806014450"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["4676855aaad0efd1f263930f7407a2242dda7211d0408fa3820678f475f20874"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:56:34Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:56:34Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["4676855aaad0efd1f263930f7407a2242dda7211d0408fa3820678f475f20874"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"4676855aaad0efd1f263930f7407a2242dda7211d0408fa3820678f475f20874\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:24:20.520Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w0-0f0874","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w0-0f0874#rule-3"},"creationTimestamp":"2026-11-02T21:56:34Z","generation":3,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:02:36Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:04:47Z"}],"name":"b0dda7ce592fb57a979446129e21c491a217f4c5c9a704c19a519ee42c367e92","namespace":"kuadrant-system","resourceVersion":"97326","uid":"d48b3d18-33ed-4660-af27-b3404ed9ef2e"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["b0dda7ce592fb57a979446129e21c491a217f4c5c9a704c19a519ee42c367e92"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:04:47Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:04:47Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["b0dda7ce592fb57a979446129e21c491a217f4c5c9a704c19a519ee42c367e92"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"b0dda7ce592fb57a979446129e21c491a217f4c5c9a704c19a519ee42c367e92\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:24:20.581Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w0-0f0874/rate-test-model-0f0874-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w0-0f0874/rate-test-model-0f0874-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-02T22:21:57Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:21:57Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:21:57Z"}],"name":"357c492c00cb28b26cd246d2e8f1f9086e6b25af6c039d953442c5371d3cf70a","namespace":"kuadrant-system","resourceVersion":"122920","uid":"0c7bf5de-371a-4758-9a1a-0b433aacd43a"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["357c492c00cb28b26cd246d2e8f1f9086e6b25af6c039d953442c5371d3cf70a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:21:57Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:21:57Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["357c492c00cb28b26cd246d2e8f1f9086e6b25af6c039d953442c5371d3cf70a"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"357c492c00cb28b26cd246d2e8f1f9086e6b25af6c039d953442c5371d3cf70a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:24:20.645Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-inf-b-cf2a53/test-model-cf2a53-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-inf-b-cf2a53/test-model-cf2a53-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-02T22:21:56Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:21:56Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:21:56Z"}],"name":"d66ae91b6f3f592a7cc55ee10763ab8e59850dd205657f8d1e061c0d7024852a","namespace":"kuadrant-system","resourceVersion":"122894","uid":"a78b071e-acde-44ff-9d0a-77110a9c6ec7"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d66ae91b6f3f592a7cc55ee10763ab8e59850dd205657f8d1e061c0d7024852a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-b-cf2a53.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-inf-b-cf2a53.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:21:56Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:21:56Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["d66ae91b6f3f592a7cc55ee10763ab8e59850dd205657f8d1e061c0d7024852a"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"d66ae91b6f3f592a7cc55ee10763ab8e59850dd205657f8d1e061c0d7024852a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:24:20.895Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-a-w4-7cde84-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-a-w4-7cde84-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:24:21.369Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-inf-b-cf2a53-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-inf-b-cf2a53-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:24:21.572Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-b-w4-58ca7f-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-b-w4-58ca7f-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:24:21.703Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-b-w0-0f0874-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-b-w0-0f0874-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:24:31.225Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","TokenRateLimitPolicy","AuthPolicy","ConfigMap","Limitador"],"eventTypes":{"update":67}}
{"level":"info","ts":"2026-11-02T22:24:31.689Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T22:24:34.267Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T22:24:34.470Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:24:34.470Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T22:24:39.545Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:24:39.551Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:24:39.562Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-02T22:24:39.562Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T22:24:39.567Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:24:39.653Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:24:39.653Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T22:24:43.422Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T22:24:43.422Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T22:24:52.800Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","ConfigMap","AuthPolicy"],"eventTypes":{"update":22}}
{"level":"info","ts":"2026-11-02T22:25:00.437Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:25:00.463Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:25:00.463Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T22:25:16.465Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthPolicy","TokenRateLimitPolicy","ConfigMap"],"eventTypes":{"create":3,"update":2}}
{"level":"info","ts":"2026-11-02T22:25:23Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-inf-a-db69f7","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-a-db69f7","reconcileID":"218866ec-749c-4d8b-91f2-e79a98ac6e71","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-inf-a-db69f7","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T22:25:23Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-a-db69f7","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T22:25:23Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T22:25:23Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-11-02T22:25:23Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T22:25:24Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-11-02T22:25:24Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-inf-a-db69f7","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-a-db69f7","reconcileID":"218866ec-749c-4d8b-91f2-e79a98ac6e71","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-inf-a-db69f7","namespace":"openshift-ingress"}
{"level":"error","ts":"2026-11-02T22:25:24Z","logger":"telemetry-policy-extension-controller","msg":"Reconciler error","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-inf-a-db69f7","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-a-db69f7","reconcileID":"5e6a433e-6ebc-4b06-bd1b-45be81c0d396","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-inf-a-db69f7\" not found","stacktrace":"sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:353\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-02T22:25:24Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-a-db69f7","event":"DELETE"}
{"level":"info","ts":"2026-11-02T22:25:24Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-02T22:25:24Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-inf-a-db69f7\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-02T22:25:24Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T22:25:24.288Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:25:24.290Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:25:24.330Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T22:25:24.359Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:25:24.359Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T22:25:24.546Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T22:25:28.498Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-inf-a-db69f7","namespace":"openshift-ingress","uid":"d05da505-26f6-4943-9a64-6982813c3a59","error":"tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-inf-a-db69f7\" not found"}
{"level":"error","ts":"2026-11-02T22:25:30.163Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-inf-a-db69f7","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-inf-a-db69f7\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:25:30.720Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthPolicy"],"eventTypes":{"update":1}}
{"level":"info","ts":"2026-11-02T22:25:38.647Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:25:38.662Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:25:38.662Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-02T22:25:38.767Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w4-58ca7f/sub-test-model-58ca7f-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w4-58ca7f/sub-test-model-58ca7f-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-02T22:23:39Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:23:39Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:23:39Z"}],"name":"db97adc82f6275f9945cc699e3249b65dcbbbf17944383132eedc3e975e2dfc1","namespace":"kuadrant-system","resourceVersion":"124907","uid":"8bc6bfc1-7760-4bd8-8368-180fda046b54"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["db97adc82f6275f9945cc699e3249b65dcbbbf17944383132eedc3e975e2dfc1"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-58ca7f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-58ca7f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:23:39Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:23:39Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["db97adc82f6275f9945cc699e3249b65dcbbbf17944383132eedc3e975e2dfc1"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"db97adc82f6275f9945cc699e3249b65dcbbbf17944383132eedc3e975e2dfc1\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:25:38.830Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w4-58ca7f/sub-test-model-58ca7f-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w4-58ca7f/sub-test-model-58ca7f-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-02T22:23:38Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:23:38Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:23:38Z"}],"name":"05dfe91984622f543d577d60ad0e98debc1b5bd07f1250f8f270652128b9a853","namespace":"kuadrant-system","resourceVersion":"124891","uid":"cf52e26d-793e-4dcf-9dfe-3d12763fb025"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["05dfe91984622f543d577d60ad0e98debc1b5bd07f1250f8f270652128b9a853"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-58ca7f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-58ca7f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:23:38Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:23:38Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["05dfe91984622f543d577d60ad0e98debc1b5bd07f1250f8f270652128b9a853"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"05dfe91984622f543d577d60ad0e98debc1b5bd07f1250f8f270652128b9a853\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:25:38.943Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w4-58ca7f/sub-test-model-58ca7f-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w4-58ca7f/sub-test-model-58ca7f-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-02T22:23:39Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:23:39Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:23:39Z"}],"name":"be2ffbe198ef8e3efead04eb5c81cee5ced5b0ab3ea9d64aaa790c22f57de5ff","namespace":"kuadrant-system","resourceVersion":"124910","uid":"79a71117-a2d8-46bd-b9bb-f29f6976d2df"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["be2ffbe198ef8e3efead04eb5c81cee5ced5b0ab3ea9d64aaa790c22f57de5ff"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-58ca7f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-58ca7f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:23:39Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:23:39Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["be2ffbe198ef8e3efead04eb5c81cee5ced5b0ab3ea9d64aaa790c22f57de5ff"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"be2ffbe198ef8e3efead04eb5c81cee5ced5b0ab3ea9d64aaa790c22f57de5ff\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:25:39.053Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-58ca7f","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-58ca7f#rule-2"},"creationTimestamp":"2026-11-02T21:56:34Z","generation":3,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:03:45Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:05:57Z"}],"name":"6acb8fe5e02ded3380a75376f0b127d4a9709eeca703e4ffefd97996bba073a8","namespace":"kuadrant-system","resourceVersion":"99314","uid":"769597b2-1a89-49a8-bf4b-3a6434789390"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["6acb8fe5e02ded3380a75376f0b127d4a9709eeca703e4ffefd97996bba073a8"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-58ca7f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-58ca7f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:56:34Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:56:34Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["6acb8fe5e02ded3380a75376f0b127d4a9709eeca703e4ffefd97996bba073a8"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"6acb8fe5e02ded3380a75376f0b127d4a9709eeca703e4ffefd97996bba073a8\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:25:39.129Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-58ca7f","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-58ca7f#rule-4"},"creationTimestamp":"2026-11-02T21:56:33Z","generation":3,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:03:45Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:05:57Z"}],"name":"a87be006d97d67fcdec172b6143f1db733cd2c78dc7239fae4e7b34930fb681c","namespace":"kuadrant-system","resourceVersion":"99341","uid":"50c18295-f10a-4845-9d61-2531351cb3f7"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a87be006d97d67fcdec172b6143f1db733cd2c78dc7239fae4e7b34930fb681c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-58ca7f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-58ca7f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:56:34Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:56:34Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["a87be006d97d67fcdec172b6143f1db733cd2c78dc7239fae4e7b34930fb681c"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a87be006d97d67fcdec172b6143f1db733cd2c78dc7239fae4e7b34930fb681c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:25:39.402Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w4-58ca7f/sub-test-model-58ca7f-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w4-58ca7f/sub-test-model-58ca7f-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-02T22:23:39Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:23:39Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:23:39Z"}],"name":"4771105e998747ab87e30b9916bd0d3a852b162e19269a4d69d86617027fa582","namespace":"kuadrant-system","resourceVersion":"124924","uid":"88192a02-3c0e-41ac-ae8a-b50a8a43f8fb"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["4771105e998747ab87e30b9916bd0d3a852b162e19269a4d69d86617027fa582"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-58ca7f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-58ca7f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:23:39Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:23:39Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["4771105e998747ab87e30b9916bd0d3a852b162e19269a4d69d86617027fa582"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"4771105e998747ab87e30b9916bd0d3a852b162e19269a4d69d86617027fa582\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:25:39.464Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w4-58ca7f/sub-test-model-58ca7f-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w4-58ca7f/sub-test-model-58ca7f-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-02T22:23:39Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:23:39Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:23:39Z"}],"name":"e94800a9d3a799f286010bb4d55769112ca5d678d762741e0c71c1921017c69c","namespace":"kuadrant-system","resourceVersion":"124913","uid":"89c38abe-c538-4569-b5a8-93c6adf5c5d5"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["e94800a9d3a799f286010bb4d55769112ca5d678d762741e0c71c1921017c69c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-58ca7f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-58ca7f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:23:39Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:23:39Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["e94800a9d3a799f286010bb4d55769112ca5d678d762741e0c71c1921017c69c"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"e94800a9d3a799f286010bb4d55769112ca5d678d762741e0c71c1921017c69c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:25:39.527Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w4-58ca7f/sub-test-model-58ca7f-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w4-58ca7f/sub-test-model-58ca7f-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-02T22:23:38Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:23:38Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:23:38Z"}],"name":"b5b4080374db36030ad8d34f7c5ee8aaf7b0cfceb9180deca07da688e9219b20","namespace":"kuadrant-system","resourceVersion":"124897","uid":"ca1ec5fb-de1f-4dcc-b204-ca8fdc126413"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["b5b4080374db36030ad8d34f7c5ee8aaf7b0cfceb9180deca07da688e9219b20"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-58ca7f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-58ca7f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:23:38Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:23:38Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["b5b4080374db36030ad8d34f7c5ee8aaf7b0cfceb9180deca07da688e9219b20"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"b5b4080374db36030ad8d34f7c5ee8aaf7b0cfceb9180deca07da688e9219b20\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:25:39.593Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-58ca7f","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-58ca7f#rule-5"},"creationTimestamp":"2026-11-02T21:56:33Z","generation":3,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:03:45Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:05:58Z"}],"name":"f84e45e70df6f2c62c67fba14ae375620e4a3732a0ed6adeb79c70fb4031c1d5","namespace":"kuadrant-system","resourceVersion":"99368","uid":"4cdd65eb-8833-4ada-8361-dc2bab33b4de"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f84e45e70df6f2c62c67fba14ae375620e4a3732a0ed6adeb79c70fb4031c1d5"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-58ca7f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-58ca7f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:05:58Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:05:58Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["f84e45e70df6f2c62c67fba14ae375620e4a3732a0ed6adeb79c70fb4031c1d5"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"f84e45e70df6f2c62c67fba14ae375620e4a3732a0ed6adeb79c70fb4031c1d5\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:25:39.654Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w4-58ca7f/sub-test-model-58ca7f-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w4-58ca7f/sub-test-model-58ca7f-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-02T22:23:38Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:23:38Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:23:39Z"}],"name":"dcd47998632ad52804f5314d21b106a956847b33837c74d48d5a29cc3b4024ad","namespace":"kuadrant-system","resourceVersion":"124900","uid":"080a51bf-65e9-4fa1-8db7-f51b5cc994e0"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["dcd47998632ad52804f5314d21b106a956847b33837c74d48d5a29cc3b4024ad"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-58ca7f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-58ca7f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:23:39Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:23:39Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["dcd47998632ad52804f5314d21b106a956847b33837c74d48d5a29cc3b4024ad"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"dcd47998632ad52804f5314d21b106a956847b33837c74d48d5a29cc3b4024ad\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:25:39.718Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w4-58ca7f/sub-test-model-58ca7f-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w4-58ca7f/sub-test-model-58ca7f-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-02T22:23:38Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:23:38Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:23:39Z"}],"name":"38428c3070019fb5581a88dc33df668a4d886ea7948236b801b97917c6107e4f","namespace":"kuadrant-system","resourceVersion":"124902","uid":"3b755b50-c388-4563-ab92-bbefc5a69202"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["38428c3070019fb5581a88dc33df668a4d886ea7948236b801b97917c6107e4f"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-58ca7f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-58ca7f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:23:39Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:23:39Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["38428c3070019fb5581a88dc33df668a4d886ea7948236b801b97917c6107e4f"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"38428c3070019fb5581a88dc33df668a4d886ea7948236b801b97917c6107e4f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:25:39.782Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w4-58ca7f/sub-test-model-58ca7f-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w4-58ca7f/sub-test-model-58ca7f-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-02T22:23:39Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:23:39Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:23:39Z"}],"name":"2c4a533eea3223851fc74430041650ade5b0f0bf93b147221445526acdd2138a","namespace":"kuadrant-system","resourceVersion":"124905","uid":"9b569fe6-71c5-4a60-a479-f7c7d65f1ff7"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["2c4a533eea3223851fc74430041650ade5b0f0bf93b147221445526acdd2138a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-58ca7f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-58ca7f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:23:39Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:23:39Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["2c4a533eea3223851fc74430041650ade5b0f0bf93b147221445526acdd2138a"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"2c4a533eea3223851fc74430041650ade5b0f0bf93b147221445526acdd2138a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:25:39.783Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-inf-a-db69f7","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T22:19:46Z","generation":1,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"33718c43-d803-462a-8802-d492b73b81fa\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:19:46Z"}],"name":"kuadrant-e2e-inf-a-db69f7","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-inf-a-db69f7","uid":"33718c43-d803-462a-8802-d492b73b81fa"}],"resourceVersion":"119863","uid":"f644dc3f-5085-4fbe-85fc-63f117a7a317"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9f351cdcc6182e21013e55166c2daef53dea66ac7cc1008cde7a3f32ed0ee698\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-db69f7-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d5ab7e0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-db69f7\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-db69f7\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d5ab7e0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-db69f7\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-db69f7\"]}],\"name\":\"9b1b0da1bc7e70bd66ec6b3a6baf54b006d6914072d554b4767745000ce460c0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"500e0961f36924a35205fa455d4efbe8e7dae5b2d20414f5ea31856b7e079af6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-db69f7-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d5ab7e0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-db69f7\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-db69f7\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d5ab7e0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-db69f7\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-db69f7\"]}],\"name\":\"e8bf4dc9ee5c757850670320b12d068b54e8feec8570c0776b09e8493f040b6e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a383273ae0661c1d42bf0bd7f4c05904333a5d0109c2ee33a67571d1522bc01c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-db69f7-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d5ab7e0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-db69f7\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-db69f7\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d5ab7e0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-db69f7\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-db69f7\"]}],\"name\":\"a23b8b5adb12d0f745f35cd5b3233f9f9d0144c8852155968b6058ab13195cb8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"626d8a2a4d005d1fc30824216b06d7f26f95b6482937eec5e236f294e452742f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-db69f7-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d5ab7e0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-db69f7\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-db69f7\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d5ab7e0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-db69f7\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-db69f7\"]}],\"name\":\"17a76e33af92017e8c5ac6c2509cf842386ba4b10fc053916e5a5535d4ca74f1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"daea2b7f8fc98bc7641aa8f6aa5c9617d4f49f3b512ea51bf4c8c18cb647305a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-db69f7-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d5ab7e0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-db69f7\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-db69f7\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d5ab7e0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-db69f7\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-db69f7\"]}],\"name\":\"f2afdc4e02474c803ac30b6808604172524e684cbd6fe317f52bf59c0a54ac7a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0e473ed2b85aecd3fd1e29ae1b7e1a8b4f29c78d48ca927e58cbca66ed51dfc5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-db69f7-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d5ab7e0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-db69f7\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-db69f7\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d5ab7e0b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-db69f7\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-db69f7\"]}],\"name\":\"2ce762ebdc3f4cba388c20d732f934ff7e0035903c92729bf86a30faca0b3db7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}}],\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-inf-a-db69f7"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-e2e-inf-a-db69f7\" not found"}
{"level":"error","ts":"2026-11-02T22:25:39.844Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-58ca7f","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-58ca7f#rule-1"},"creationTimestamp":"2026-11-02T21:56:33Z","generation":3,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:03:43Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:05:56Z"}],"name":"5b294df7b29e8cb61b717640614fa36dd2c243ed540ecb057e57e5c1fc26ab65","namespace":"kuadrant-system","resourceVersion":"99310","uid":"84a655c3-a5d3-4d21-afda-508a24e4c506"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["5b294df7b29e8cb61b717640614fa36dd2c243ed540ecb057e57e5c1fc26ab65"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-58ca7f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-58ca7f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:05:56Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:05:56Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["5b294df7b29e8cb61b717640614fa36dd2c243ed540ecb057e57e5c1fc26ab65"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"5b294df7b29e8cb61b717640614fa36dd2c243ed540ecb057e57e5c1fc26ab65\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:25:39.906Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-58ca7f","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-58ca7f#rule-3"},"creationTimestamp":"2026-11-02T21:56:34Z","generation":3,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:03:45Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:05:57Z"}],"name":"8e6ff67d93e4d9b2ea87c487a06f947d8b76a18c9c78078c58dee29914a5b47c","namespace":"kuadrant-system","resourceVersion":"99357","uid":"79768f89-239b-4c5e-939e-7ab4393ce77d"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["8e6ff67d93e4d9b2ea87c487a06f947d8b76a18c9c78078c58dee29914a5b47c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-58ca7f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-58ca7f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:05:57Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:05:57Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["8e6ff67d93e4d9b2ea87c487a06f947d8b76a18c9c78078c58dee29914a5b47c"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"8e6ff67d93e4d9b2ea87c487a06f947d8b76a18c9c78078c58dee29914a5b47c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:25:39.974Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w4-58ca7f/sub-test-model-58ca7f-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w4-58ca7f/sub-test-model-58ca7f-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-02T22:23:38Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:23:38Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:23:38Z"}],"name":"6475cde502ebebcff22dfa440b75efd59881365f0ea459d58c5a3473aab71895","namespace":"kuadrant-system","resourceVersion":"124893","uid":"5e222455-3024-4043-8870-82f721694ecc"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["6475cde502ebebcff22dfa440b75efd59881365f0ea459d58c5a3473aab71895"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-58ca7f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-58ca7f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:23:38Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:23:38Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["6475cde502ebebcff22dfa440b75efd59881365f0ea459d58c5a3473aab71895"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"6475cde502ebebcff22dfa440b75efd59881365f0ea459d58c5a3473aab71895\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:25:40.045Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-58ca7f","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-58ca7f#rule-6"},"creationTimestamp":"2026-11-02T21:56:33Z","generation":3,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:03:44Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:05:57Z"}],"name":"9dccfbfbcf84c5edf4e0a3cc993bd8181b6febef066c8d0c3b0f13de64710295","namespace":"kuadrant-system","resourceVersion":"99325","uid":"3313984a-810e-48ff-83fb-1e422c30f66c"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["9dccfbfbcf84c5edf4e0a3cc993bd8181b6febef066c8d0c3b0f13de64710295"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-58ca7f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-58ca7f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:05:57Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:05:57Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["9dccfbfbcf84c5edf4e0a3cc993bd8181b6febef066c8d0c3b0f13de64710295"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"9dccfbfbcf84c5edf4e0a3cc993bd8181b6febef066c8d0c3b0f13de64710295\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:25:40.109Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w4-58ca7f/sub-test-model-58ca7f-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w4-58ca7f/sub-test-model-58ca7f-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-02T22:23:39Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:23:39Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:23:39Z"}],"name":"cc0e1f81e6a71fde26f34a97e231591eaab95562cccb49c6cb59a034fa309987","namespace":"kuadrant-system","resourceVersion":"124915","uid":"5bf5e865-e1e0-4275-8b7b-9ba5ad50a516"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["cc0e1f81e6a71fde26f34a97e231591eaab95562cccb49c6cb59a034fa309987"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-58ca7f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-58ca7f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:23:39Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:23:39Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["cc0e1f81e6a71fde26f34a97e231591eaab95562cccb49c6cb59a034fa309987"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"cc0e1f81e6a71fde26f34a97e231591eaab95562cccb49c6cb59a034fa309987\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:25:40.171Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w4-58ca7f/sub-test-model-58ca7f-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w4-58ca7f/sub-test-model-58ca7f-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-02T22:23:39Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:23:39Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:23:39Z"}],"name":"28d296b0545dc8f7d84dfcef93b120823ee44a90209d1f46e520e8c4fbff297c","namespace":"kuadrant-system","resourceVersion":"124918","uid":"4f99cc26-9cab-47f1-8da4-115ffae52c9c"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["28d296b0545dc8f7d84dfcef93b120823ee44a90209d1f46e520e8c4fbff297c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-58ca7f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w4-58ca7f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:23:39Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:23:39Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["28d296b0545dc8f7d84dfcef93b120823ee44a90209d1f46e520e8c4fbff297c"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"28d296b0545dc8f7d84dfcef93b120823ee44a90209d1f46e520e8c4fbff297c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:25:41.504Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-b-w4-58ca7f-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-b-w4-58ca7f-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:25:41.768Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-inf-a-db69f7-maas-auth","namespace":"openshift-ingress","error":"authpolicies.kuadrant.io \"e2e-inf-a-db69f7-maas-auth\" not found"}
{"level":"error","ts":"2026-11-02T22:25:41.832Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-a-w0-6e535d-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-a-w0-6e535d-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:25:41.896Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-b-w0-0f0874-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-b-w0-0f0874-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:25:42.898Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-inf-a-db69f7","error":"gateways.gateway.networking.k8s.io \"e2e-inf-a-db69f7\" not found"}
{"level":"info","ts":"2026-11-02T22:25:51.752Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","TokenRateLimitPolicy","AuthPolicy","Kuadrant","HTTPRoute","EnvoyFilter","Limitador","ConfigMap","Gateway"],"eventTypes":{"delete":8,"update":56}}
{"level":"info","ts":"2026-11-02T22:25:52.220Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:25:52.240Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T22:25:56.739Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T22:25:56.871Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T22:25:56.966Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:25:57.027Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:25:57.027Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T22:26:01.924Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:26:01.924Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:26:01.937Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T22:26:01.939Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:26:01.950Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:26:01.950Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-02T22:26:02.143Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:26:02.143Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T22:26:05.109Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-a-w0-6e535d-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-a-w0-6e535d-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:26:05.173Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-inf-a-dd28e6-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-inf-a-dd28e6-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:26:05.872Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-test-model-dd28e6","namespace":"ai-tenant-e2e-inf-a-dd28e6","uid":"4ac73bce-bed3-4b13-88ce-2b1d47c39db5","error":"tokenratelimitpolicies.kuadrant.io \"maas-trlp-test-model-dd28e6\" not found"}
{"level":"error","ts":"2026-11-02T22:26:06.480Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-rate-test-model-0f0874","namespace":"ai-tenant-e2e-shared-b-w0-0f0874","uid":"d5cd0142-3458-40cc-b5a5-fa303cc4b433","error":"tokenratelimitpolicies.kuadrant.io \"maas-trlp-rate-test-model-0f0874\" not found"}
{"level":"info","ts":"2026-11-02T22:26:06.975Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T22:26:06.975Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T22:26:07.183Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-inf-a-dd28e6","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-inf-a-dd28e6\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:26:16.083Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","AuthPolicy","HTTPRoute","EnvoyFilter","TokenRateLimitPolicy","Limitador","Gateway","ConfigMap"],"eventTypes":{"delete":9,"update":47}}
{"level":"info","ts":"2026-11-02T22:26:16.436Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T22:26:19.743Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T22:26:19.924Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:26:19.924Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T22:26:24.548Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:26:24.553Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:26:24.561Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T22:26:24.562Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:26:24.562Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T22:26:24.565Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:26:24.781Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T22:26:29.672Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-test-model-cf2a53","namespace":"ai-tenant-e2e-inf-b-cf2a53","uid":"f3b9b89e-30f2-490c-968c-7e22f5a9a317","error":"tokenratelimitpolicies.kuadrant.io \"maas-trlp-test-model-cf2a53\" not found"}
{"level":"info","ts":"2026-11-02T22:26:30.392Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T22:26:30.392Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T22:26:39.524Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","AuthPolicy","TokenRateLimitPolicy","ConfigMap","EnvoyFilter","Limitador","HTTPRoute"],"eventTypes":{"create":2,"delete":13,"update":53}}
{"level":"info","ts":"2026-11-02T22:26:39.874Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T22:26:42.330Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T22:26:42.544Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:26:42.544Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T22:26:47.250Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:26:47.251Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:26:47.260Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T22:26:47.323Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:26:47.325Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:26:47.325Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-02T22:26:47.371Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:26:47.371Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T22:26:51.463Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T22:26:51.463Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T22:26:52.116Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"test-model-cf2a53-kserve-route","namespace":"ai-tenant-e2e-inf-b-cf2a53","error":"httproutes.gateway.networking.k8s.io \"test-model-cf2a53-kserve-route\" not found"}
{"level":"error","ts":"2026-11-02T22:26:52.475Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-inf-b-cf2a53","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-inf-b-cf2a53\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:27:00.366Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["EnvoyFilter","Gateway","AuthPolicy","TokenRateLimitPolicy","Limitador","HTTPRoute","ConfigMap"],"eventTypes":{"delete":1,"update":16}}
{"level":"info","ts":"2026-11-02T22:27:00.718Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T22:27:02Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-inf-b-3edc8c","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-b-3edc8c","reconcileID":"634f1e6a-5714-419f-9bb8-cb0e6d7d7442","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-inf-b-3edc8c","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T22:27:02Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-b-3edc8c","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T22:27:02Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T22:27:02Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-11-02T22:27:02Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T22:27:02Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-11-02T22:27:02Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-inf-b-3edc8c","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-b-3edc8c","reconcileID":"634f1e6a-5714-419f-9bb8-cb0e6d7d7442","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-inf-b-3edc8c","namespace":"openshift-ingress"}
{"level":"error","ts":"2026-11-02T22:27:02Z","logger":"telemetry-policy-extension-controller","msg":"Reconciler error","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-inf-b-3edc8c","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-b-3edc8c","reconcileID":"29f3b8e5-b930-421f-9af2-7045c7a3810a","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-inf-b-3edc8c\" not found","stacktrace":"sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:353\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-02T22:27:02Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-b-3edc8c","event":"DELETE"}
{"level":"info","ts":"2026-11-02T22:27:02Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-02T22:27:02Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-inf-b-3edc8c\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-02T22:27:02Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T22:27:04.329Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T22:27:04.523Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:27:04.523Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T22:27:08.532Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:27:08.541Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:27:08.545Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:27:08.545Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T22:27:08.547Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:27:08.549Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T22:27:08.766Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T22:27:09Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-mt-b5e8794c","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-mt-b5e8794c","reconcileID":"380b2ef5-b6de-4285-989b-9888a7710dbb","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-mt-b5e8794c","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T22:27:09Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-mt-b5e8794c","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T22:27:09Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T22:27:09Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-11-02T22:27:09Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"error","ts":"2026-11-02T22:27:09.469Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-inf-b-3edc8c","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T22:23:00Z","generation":1,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"68cc9571-28fc-4a9c-ac95-19a198bca6a3\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:23:00Z"}],"name":"kuadrant-e2e-inf-b-3edc8c","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-inf-b-3edc8c","uid":"68cc9571-28fc-4a9c-ac95-19a198bca6a3"}],"resourceVersion":"124231","uid":"1bd4ac80-1267-46a4-a399-d46b00db2dc0"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"21b1a6ca1ae1c0d355f8efee74ea966b546c6cffa1abd25d2b5f5c54041fe5c5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-b-3edc8c-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__605ae212\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-b-3edc8c\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-3edc8c\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__605ae212\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-b-3edc8c\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-3edc8c\"]}],\"name\":\"c1911910e55182af965d610d9f38bc05dd806cebfbfe970cb6f8749b66982d0c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0df68770dc5dac7bc3f9ac1ab3d499955b3caad971ba2ac6fc9c945b4e7e14b6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-b-3edc8c-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__605ae212\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-b-3edc8c\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-3edc8c\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__605ae212\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-b-3edc8c\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-3edc8c\"]}],\"name\":\"17160e14e26559b4479fb6e2034ef26f1d0f31f140211975c1f61ca45ab1b94c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ca8dbbb4f6d8c35d9753bef1b5d4c695d70368d73b36d43c4601f15e8274e497\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-b-3edc8c-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__605ae212\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-b-3edc8c\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-3edc8c\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__605ae212\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-b-3edc8c\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-3edc8c\"]}],\"name\":\"b63d882475e50b1ac0d08379fff5dc310ba08ff7e819f684547cf66c15246001\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"506ee78df039847eaf97d9b8797d038e73fae7adbf56dc0e52f7a663c5d452c7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-b-3edc8c-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__605ae212\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-b-3edc8c\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-3edc8c\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__605ae212\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-b-3edc8c\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-3edc8c\"]}],\"name\":\"39e0359951c94a038331af98bf39a862f589ea32bdd6cb6c2471864ed407b766\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8e781df81ba5207a5cece941d490e647f56b022e86b1c0e7a56ff113fb0f316e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-b-3edc8c-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__605ae212\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-b-3edc8c\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-3edc8c\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__605ae212\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-b-3edc8c\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-3edc8c\"]}],\"name\":\"fd481a65db5bc36405090b77bb8aa879bc0c8ac80a69f61e344e0359db36c826\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"33fbe4ab46531d497814b46bc8258e0ed11d06dd94c3583a59c7924e16b4166b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-b-3edc8c-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__605ae212\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-b-3edc8c\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-3edc8c\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__605ae212\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-b-3edc8c\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-3edc8c\"]}],\"name\":\"9d8edfc92028f64c074755ccc3b0a3fe0b02ca61ffe68ae4765f79ff822d3b82\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}}],\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-inf-b-3edc8c"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-e2e-inf-b-3edc8c\" not found"}
{"level":"info","ts":"2026-11-02T22:27:09Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-11-02T22:27:09Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-mt-b5e8794c","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-mt-b5e8794c","reconcileID":"380b2ef5-b6de-4285-989b-9888a7710dbb","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-mt-b5e8794c","namespace":"openshift-ingress"}
{"level":"error","ts":"2026-11-02T22:27:09Z","logger":"telemetry-policy-extension-controller","msg":"Reconciler error","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-mt-b5e8794c","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-mt-b5e8794c","reconcileID":"37deb044-7973-49cd-b5ad-940ee75d2a58","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-mt-b5e8794c\" not found","stacktrace":"sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:353\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-02T22:27:09Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-mt-b5e8794c","event":"DELETE"}
{"level":"info","ts":"2026-11-02T22:27:09Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-02T22:27:09Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-mt-b5e8794c\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-02T22:27:09Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"error","ts":"2026-11-02T22:27:10.964Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-mt-b5e8794c","namespace":"openshift-ingress","uid":"fb0f6409-e4db-4e52-8fe1-83eee426d4f3","error":"tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-mt-b5e8794c\" not found"}
{"level":"error","ts":"2026-11-02T22:27:11.403Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-inf-b-3edc8c-maas-auth","namespace":"openshift-ingress","error":"authpolicies.kuadrant.io \"e2e-inf-b-3edc8c-maas-auth\" not found"}
{"level":"error","ts":"2026-11-02T22:27:11.463Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-mt-b5e8794c-maas-auth","namespace":"openshift-ingress","error":"authpolicies.kuadrant.io \"e2e-mt-b5e8794c-maas-auth\" not found"}
{"level":"error","ts":"2026-11-02T22:27:11.809Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-b-w0-0f0874-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-b-w0-0f0874-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:27:12.396Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-sub-test-model-7cde84","namespace":"ai-tenant-e2e-shared-a-w4-7cde84","uid":"d94b3ed8-2ac4-433c-b1f7-2c76b5612d60","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-sub-test-model-7cde84\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:27:12.514Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-inf-b-3edc8c","namespace":"openshift-ingress","uid":"5b23212e-4202-47fd-8f14-afdf9b0a9117","error":"tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-inf-b-3edc8c\" not found"}
{"level":"info","ts":"2026-11-02T22:27:12.814Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T22:27:12.814Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T22:27:12.870Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-inf-b-3edc8c","error":"gateways.gateway.networking.k8s.io \"e2e-inf-b-3edc8c\" not found"}
{"level":"error","ts":"2026-11-02T22:27:13.442Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-mt-b5e8794c","error":"gateways.gateway.networking.k8s.io \"e2e-mt-b5e8794c\" not found"}
{"level":"info","ts":"2026-11-02T22:27:14.709Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthPolicy"],"eventTypes":{"update":1}}
{"level":"info","ts":"2026-11-02T22:27:21.567Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:27:21.625Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:27:21.625Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-02T22:27:21.687Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-7cde84","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-7cde84#rule-5"},"creationTimestamp":"2026-11-02T21:54:29Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:24:39Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:24:40Z"}],"name":"45531229ceac4cfcba16f0f8d809077fb7e19e248278c544ac9fd018c419ef18","namespace":"kuadrant-system","resourceVersion":"126026","uid":"a6478ea4-1b85-4c62-8d3f-6cfa3a37ff61"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["45531229ceac4cfcba16f0f8d809077fb7e19e248278c544ac9fd018c419ef18"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-7cde84.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-7cde84.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:24:40Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:24:40Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["45531229ceac4cfcba16f0f8d809077fb7e19e248278c544ac9fd018c419ef18"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"45531229ceac4cfcba16f0f8d809077fb7e19e248278c544ac9fd018c419ef18\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:27:21.750Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-02T22:22:22Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:24:40Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:24:40Z"}],"name":"bec208ec6dc21c79240eb94750ba68422695a096f53cfdb225e863fa3d9d315b","namespace":"kuadrant-system","resourceVersion":"126032","uid":"16c8c179-2e65-4f42-b82a-8a50ef2ece50"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["bec208ec6dc21c79240eb94750ba68422695a096f53cfdb225e863fa3d9d315b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-7cde84.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-7cde84.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:22:22Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:22:22Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["bec208ec6dc21c79240eb94750ba68422695a096f53cfdb225e863fa3d9d315b"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"bec208ec6dc21c79240eb94750ba68422695a096f53cfdb225e863fa3d9d315b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:27:21.824Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-02T22:22:21Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:24:40Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:24:40Z"}],"name":"b69925d3df07c885960ffd3cb00542ac829678560a41dc321cf97047026df6c1","namespace":"kuadrant-system","resourceVersion":"126035","uid":"22072846-3c4e-43ef-b6e7-66e593cd3081"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["b69925d3df07c885960ffd3cb00542ac829678560a41dc321cf97047026df6c1"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-7cde84.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-7cde84.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:22:21Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:22:21Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["b69925d3df07c885960ffd3cb00542ac829678560a41dc321cf97047026df6c1"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"b69925d3df07c885960ffd3cb00542ac829678560a41dc321cf97047026df6c1\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:27:21.923Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-02T22:22:21Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:24:39Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:24:39Z"}],"name":"903c98b0fff3cf1a47841a81663ba2415232166daafccec12bff78d7ecf1ad6f","namespace":"kuadrant-system","resourceVersion":"126009","uid":"7b8332b2-d331-483f-b7e4-1d5820389746"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["903c98b0fff3cf1a47841a81663ba2415232166daafccec12bff78d7ecf1ad6f"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-7cde84.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-7cde84.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:22:21Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:22:21Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["903c98b0fff3cf1a47841a81663ba2415232166daafccec12bff78d7ecf1ad6f"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"903c98b0fff3cf1a47841a81663ba2415232166daafccec12bff78d7ecf1ad6f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:27:22.023Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-02T22:22:22Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:24:40Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:24:41Z"}],"name":"1f7cf62dc6799b47d6f93db202824af7a9292a91889ec8859df0da33700cec22","namespace":"kuadrant-system","resourceVersion":"126055","uid":"c90a5cb0-680c-4e76-968d-bdb064d9c268"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["1f7cf62dc6799b47d6f93db202824af7a9292a91889ec8859df0da33700cec22"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-7cde84.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-7cde84.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:22:22Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:22:22Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["1f7cf62dc6799b47d6f93db202824af7a9292a91889ec8859df0da33700cec22"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"1f7cf62dc6799b47d6f93db202824af7a9292a91889ec8859df0da33700cec22\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:27:22.089Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-02T22:22:20Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:24:40Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:24:40Z"}],"name":"2916a2827ecd216898e17d90f9a6227b27719deed72249cd41aee4bb7a1fe444","namespace":"kuadrant-system","resourceVersion":"126052","uid":"d7fe07ba-6bc8-49e4-b9a5-d6b62ddc1e67"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["2916a2827ecd216898e17d90f9a6227b27719deed72249cd41aee4bb7a1fe444"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-7cde84.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-7cde84.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:22:20Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:22:20Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["2916a2827ecd216898e17d90f9a6227b27719deed72249cd41aee4bb7a1fe444"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"2916a2827ecd216898e17d90f9a6227b27719deed72249cd41aee4bb7a1fe444\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:27:22.152Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-7cde84","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-7cde84#rule-6"},"creationTimestamp":"2026-11-02T21:54:29Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:24:40Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:24:40Z"}],"name":"0f923fa7f17446f382fb056bef7c9cc2146361c32cb89e19da4e6397505de43c","namespace":"kuadrant-system","resourceVersion":"126030","uid":"707d9773-391a-4d40-b035-045086444d40"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["0f923fa7f17446f382fb056bef7c9cc2146361c32cb89e19da4e6397505de43c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-7cde84.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-7cde84.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:54:30Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:54:30Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["0f923fa7f17446f382fb056bef7c9cc2146361c32cb89e19da4e6397505de43c"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"0f923fa7f17446f382fb056bef7c9cc2146361c32cb89e19da4e6397505de43c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:27:22.214Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-02T22:22:21Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:24:40Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:24:40Z"}],"name":"298687b21bb9308a0390d1eccce98f0f3701b3448ec88414dc705044c62f7b35","namespace":"kuadrant-system","resourceVersion":"126048","uid":"44100c6a-93ff-455a-a622-d6d97eda1cca"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["298687b21bb9308a0390d1eccce98f0f3701b3448ec88414dc705044c62f7b35"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-7cde84.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-7cde84.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:22:22Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:22:22Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["298687b21bb9308a0390d1eccce98f0f3701b3448ec88414dc705044c62f7b35"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"298687b21bb9308a0390d1eccce98f0f3701b3448ec88414dc705044c62f7b35\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:27:22.276Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-7cde84","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-7cde84#rule-4"},"creationTimestamp":"2026-11-02T21:54:29Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:24:39Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:24:39Z"}],"name":"96cad25fbcf27b7341cae948477117cfaf58cb098cf23b68e9b61e9380b5dbab","namespace":"kuadrant-system","resourceVersion":"126011","uid":"d6d17e1c-e49a-4a17-93a3-b5e2e7f8832d"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["96cad25fbcf27b7341cae948477117cfaf58cb098cf23b68e9b61e9380b5dbab"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-7cde84.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-7cde84.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:54:30Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:54:30Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["96cad25fbcf27b7341cae948477117cfaf58cb098cf23b68e9b61e9380b5dbab"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"96cad25fbcf27b7341cae948477117cfaf58cb098cf23b68e9b61e9380b5dbab\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:27:22.341Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-02T22:22:20Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:24:40Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:24:40Z"}],"name":"07296ce2840ffecfcd20ccfbb88bae26607ad04b350c3e27f6a92965b50cc44a","namespace":"kuadrant-system","resourceVersion":"126038","uid":"34301b40-202c-4221-b684-2897ff2f2030"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["07296ce2840ffecfcd20ccfbb88bae26607ad04b350c3e27f6a92965b50cc44a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-7cde84.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-7cde84.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:22:20Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:22:20Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["07296ce2840ffecfcd20ccfbb88bae26607ad04b350c3e27f6a92965b50cc44a"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"07296ce2840ffecfcd20ccfbb88bae26607ad04b350c3e27f6a92965b50cc44a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:27:22.404Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-7cde84","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-7cde84#rule-2"},"creationTimestamp":"2026-11-02T21:54:30Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:24:40Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:24:40Z"}],"name":"150da2804d58820302b448e24151b1f189b717cd68a8c1e110fba61141165eb0","namespace":"kuadrant-system","resourceVersion":"126040","uid":"dc273a82-52cc-4e8b-a51f-cc542527634d"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["150da2804d58820302b448e24151b1f189b717cd68a8c1e110fba61141165eb0"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-7cde84.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-7cde84.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:05:57Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:05:57Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["150da2804d58820302b448e24151b1f189b717cd68a8c1e110fba61141165eb0"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"150da2804d58820302b448e24151b1f189b717cd68a8c1e110fba61141165eb0\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:27:22.467Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-02T22:22:21Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:24:39Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:24:40Z"}],"name":"0bcecc0d8a2f3bd07c6b4357ee2bf111ba3a5b96cdc7f4d5ff088093263a85f9","namespace":"kuadrant-system","resourceVersion":"126023","uid":"825c8908-bdc9-4b87-8d9d-2824a750917a"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["0bcecc0d8a2f3bd07c6b4357ee2bf111ba3a5b96cdc7f4d5ff088093263a85f9"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-7cde84.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-7cde84.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:22:21Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:22:21Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["0bcecc0d8a2f3bd07c6b4357ee2bf111ba3a5b96cdc7f4d5ff088093263a85f9"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"0bcecc0d8a2f3bd07c6b4357ee2bf111ba3a5b96cdc7f4d5ff088093263a85f9\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:27:22.534Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-7cde84","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-7cde84#rule-3"},"creationTimestamp":"2026-11-02T21:54:30Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:24:41Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:24:41Z"}],"name":"f6229ee2157250d6d160cdc978e612aa3a7c43bb558942020078c3f42c450c79","namespace":"kuadrant-system","resourceVersion":"126057","uid":"1e0df38d-4dfc-4590-a0de-439f77fc7a8d"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f6229ee2157250d6d160cdc978e612aa3a7c43bb558942020078c3f42c450c79"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-7cde84.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-7cde84.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:54:30Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:54:30Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["f6229ee2157250d6d160cdc978e612aa3a7c43bb558942020078c3f42c450c79"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"f6229ee2157250d6d160cdc978e612aa3a7c43bb558942020078c3f42c450c79\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:27:22.599Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-02T22:22:21Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:24:40Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:24:40Z"}],"name":"4c71f22ec48e1640858b5e13955ccc7284a723347433e1b6f730b142ce1fd0e1","namespace":"kuadrant-system","resourceVersion":"126044","uid":"406031a5-c178-48af-8375-a24caf57663a"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["4c71f22ec48e1640858b5e13955ccc7284a723347433e1b6f730b142ce1fd0e1"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-7cde84.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-7cde84.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:22:22Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:22:22Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["4c71f22ec48e1640858b5e13955ccc7284a723347433e1b6f730b142ce1fd0e1"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"4c71f22ec48e1640858b5e13955ccc7284a723347433e1b6f730b142ce1fd0e1\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:27:22.662Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-02T22:22:20Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:24:41Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:24:41Z"}],"name":"34a6fee35b5b6e4d8489e9dec6c22275d6769ec340fe614be36f43659226b008","namespace":"kuadrant-system","resourceVersion":"126059","uid":"7d69b61b-93b0-4a51-8d45-82ff178f63a9"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["34a6fee35b5b6e4d8489e9dec6c22275d6769ec340fe614be36f43659226b008"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-7cde84.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-7cde84.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:22:21Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:22:21Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["34a6fee35b5b6e4d8489e9dec6c22275d6769ec340fe614be36f43659226b008"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"34a6fee35b5b6e4d8489e9dec6c22275d6769ec340fe614be36f43659226b008\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:27:22.725Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-7cde84","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-7cde84#rule-1"},"creationTimestamp":"2026-11-02T21:54:30Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:24:40Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:24:40Z"}],"name":"75661500a5114b056fb7b7fa79b052930433ec107cb332756c581a2f0de24173","namespace":"kuadrant-system","resourceVersion":"126050","uid":"13c499d8-3532-43e1-a0fb-416679a27bab"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["75661500a5114b056fb7b7fa79b052930433ec107cb332756c581a2f0de24173"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-7cde84.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-7cde84.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:24:40Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:24:40Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["75661500a5114b056fb7b7fa79b052930433ec107cb332756c581a2f0de24173"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"75661500a5114b056fb7b7fa79b052930433ec107cb332756c581a2f0de24173\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:27:22.787Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-02T22:22:20Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:24:40Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:24:40Z"}],"name":"5350573b00b923007a376a9e1a94b10285846470cdf28852896168c05e85fa70","namespace":"kuadrant-system","resourceVersion":"126041","uid":"07f91331-06e5-44cc-8e26-06336c5ce0a9"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["5350573b00b923007a376a9e1a94b10285846470cdf28852896168c05e85fa70"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-7cde84.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-7cde84.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:22:20Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:22:20Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["5350573b00b923007a376a9e1a94b10285846470cdf28852896168c05e85fa70"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"5350573b00b923007a376a9e1a94b10285846470cdf28852896168c05e85fa70\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:27:22.848Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-02T22:22:22Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:24:39Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:24:40Z"}],"name":"7227bd7965d40e464f5f833cf1ae228521499b8e52b256386ba7cddd67ea360b","namespace":"kuadrant-system","resourceVersion":"126020","uid":"0e4000b3-5416-45f0-a86f-74a924382b60"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["7227bd7965d40e464f5f833cf1ae228521499b8e52b256386ba7cddd67ea360b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-7cde84.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w4-7cde84.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:24:40Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:24:40Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["7227bd7965d40e464f5f833cf1ae228521499b8e52b256386ba7cddd67ea360b"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"7227bd7965d40e464f5f833cf1ae228521499b8e52b256386ba7cddd67ea360b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:27:22.909Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/9da1cd647a32052e65257e603b4575d2cfa2f998b4bd573b105b322ee6d2cd51","error":"authconfigs.authorino.kuadrant.io \"9da1cd647a32052e65257e603b4575d2cfa2f998b4bd573b105b322ee6d2cd51\" not found"}
{"level":"error","ts":"2026-11-02T22:27:22.963Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/8f54956d96e36043013f1cad22e658a30f7234238f4c6ac115015e6cb72c53af","error":"authconfigs.authorino.kuadrant.io \"8f54956d96e36043013f1cad22e658a30f7234238f4c6ac115015e6cb72c53af\" not found"}
{"level":"error","ts":"2026-11-02T22:27:23.017Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/d66ae91b6f3f592a7cc55ee10763ab8e59850dd205657f8d1e061c0d7024852a","error":"authconfigs.authorino.kuadrant.io \"d66ae91b6f3f592a7cc55ee10763ab8e59850dd205657f8d1e061c0d7024852a\" not found"}
{"level":"error","ts":"2026-11-02T22:27:23.072Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/36f59cd489a1a8c6b8aace4eaab9de289e5f767b7a794a974802f9cb2d951613","error":"authconfigs.authorino.kuadrant.io \"36f59cd489a1a8c6b8aace4eaab9de289e5f767b7a794a974802f9cb2d951613\" not found"}
{"level":"error","ts":"2026-11-02T22:27:23.126Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/75422695f1d128b0d1545739622bea2225ae8c48899cc84d91003457e1161238","error":"authconfigs.authorino.kuadrant.io \"75422695f1d128b0d1545739622bea2225ae8c48899cc84d91003457e1161238\" not found"}
{"level":"error","ts":"2026-11-02T22:27:23.181Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/01fd84c9f653a29a2a0291503f14873693d890a0d697fa12b20b5b1ea0b13434","error":"authconfigs.authorino.kuadrant.io \"01fd84c9f653a29a2a0291503f14873693d890a0d697fa12b20b5b1ea0b13434\" not found"}
{"level":"error","ts":"2026-11-02T22:27:23.200Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-inf-b-3edc8c","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T22:23:00Z","generation":1,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"68cc9571-28fc-4a9c-ac95-19a198bca6a3\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:23:00Z"}],"name":"kuadrant-e2e-inf-b-3edc8c","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-inf-b-3edc8c","uid":"68cc9571-28fc-4a9c-ac95-19a198bca6a3"}],"resourceVersion":"124231","uid":"1bd4ac80-1267-46a4-a399-d46b00db2dc0"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"21b1a6ca1ae1c0d355f8efee74ea966b546c6cffa1abd25d2b5f5c54041fe5c5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-b-3edc8c-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__605ae212\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-b-3edc8c\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-3edc8c\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__605ae212\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-b-3edc8c\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-3edc8c\"]}],\"name\":\"c1911910e55182af965d610d9f38bc05dd806cebfbfe970cb6f8749b66982d0c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0df68770dc5dac7bc3f9ac1ab3d499955b3caad971ba2ac6fc9c945b4e7e14b6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-b-3edc8c-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__605ae212\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-b-3edc8c\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-3edc8c\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__605ae212\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-b-3edc8c\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-3edc8c\"]}],\"name\":\"17160e14e26559b4479fb6e2034ef26f1d0f31f140211975c1f61ca45ab1b94c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ca8dbbb4f6d8c35d9753bef1b5d4c695d70368d73b36d43c4601f15e8274e497\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-b-3edc8c-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__605ae212\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-b-3edc8c\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-3edc8c\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__605ae212\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-b-3edc8c\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-3edc8c\"]}],\"name\":\"b63d882475e50b1ac0d08379fff5dc310ba08ff7e819f684547cf66c15246001\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"506ee78df039847eaf97d9b8797d038e73fae7adbf56dc0e52f7a663c5d452c7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-b-3edc8c-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__605ae212\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-b-3edc8c\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-3edc8c\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__605ae212\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-b-3edc8c\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-3edc8c\"]}],\"name\":\"39e0359951c94a038331af98bf39a862f589ea32bdd6cb6c2471864ed407b766\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8e781df81ba5207a5cece941d490e647f56b022e86b1c0e7a56ff113fb0f316e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-b-3edc8c-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__605ae212\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-b-3edc8c\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-3edc8c\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__605ae212\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-b-3edc8c\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-3edc8c\"]}],\"name\":\"fd481a65db5bc36405090b77bb8aa879bc0c8ac80a69f61e344e0359db36c826\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"33fbe4ab46531d497814b46bc8258e0ed11d06dd94c3583a59c7924e16b4166b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-b-3edc8c-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__605ae212\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-b-3edc8c\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-3edc8c\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__605ae212\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-b-3edc8c\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-3edc8c\"]}],\"name\":\"9d8edfc92028f64c074755ccc3b0a3fe0b02ca61ffe68ae4765f79ff822d3b82\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}}],\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-inf-b-3edc8c"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-e2e-inf-b-3edc8c\" not found"}
{"level":"error","ts":"2026-11-02T22:27:23.236Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/a9c4f48d62ee69c54ae779d6c76b9fe145dd93b97bc6ee8b7f8cdf551f7e1301","error":"authconfigs.authorino.kuadrant.io \"a9c4f48d62ee69c54ae779d6c76b9fe145dd93b97bc6ee8b7f8cdf551f7e1301\" not found"}
{"level":"error","ts":"2026-11-02T22:27:23.290Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/0b3150ef82234069264c1ae3ab23e26e2411f4a59c3e35b9bd0696949df8b07c","error":"authconfigs.authorino.kuadrant.io \"0b3150ef82234069264c1ae3ab23e26e2411f4a59c3e35b9bd0696949df8b07c\" not found"}
{"level":"error","ts":"2026-11-02T22:27:23.344Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/b4c56341c5c36a21e698500bb292840aa96122e63d2198e4b4fc18b93329e457","error":"authconfigs.authorino.kuadrant.io \"b4c56341c5c36a21e698500bb292840aa96122e63d2198e4b4fc18b93329e457\" not found"}
{"level":"error","ts":"2026-11-02T22:27:23.399Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/d4c683e7155828a798af50a301faea067a965501f891b81ab087cb5c27a019e0","error":"authconfigs.authorino.kuadrant.io \"d4c683e7155828a798af50a301faea067a965501f891b81ab087cb5c27a019e0\" not found"}
{"level":"error","ts":"2026-11-02T22:27:23.400Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-inf-b-cf2a53","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T22:19:26Z","generation":4,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"b4803bc8-228a-4605-9b73-6cbc88e2a509\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:26:49Z"}],"name":"kuadrant-e2e-inf-b-cf2a53","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-inf-b-cf2a53","uid":"b4803bc8-228a-4605-9b73-6cbc88e2a509"}],"resourceVersion":"128651","uid":"c0ff5f58-d553-475b-b266-ebe493267d13"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5a40698293ed44103a2b127c08980b4704f79ba3d5f07cb6981daedc8d4d99d4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-b-cf2a53-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ed20beeb\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-b-cf2a53\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-cf2a53\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ed20beeb\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-b-cf2a53\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-cf2a53\"]}],\"name\":\"c52ffb3a7b4138e80a04cd2bafcb134bf82569b2b012cb78b763055f12d388fc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c81789e1553bf7e7d1d0740e3a95011d3c200b400ce15c0a79e4cb90668180c5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-b-cf2a53-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ed20beeb\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-b-cf2a53\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-cf2a53\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ed20beeb\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-b-cf2a53\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-cf2a53\"]}],\"name\":\"3149fee2b8b7821150414b8aa4819aba60a1fffcffb75d8fcaf72e6ae23a2c4a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cef0f4c4be2f6db7ef6ec330309895be984f5a86740e00b7ff2f97edfd998522\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-b-cf2a53-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ed20beeb\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-b-cf2a53\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-cf2a53\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ed20beeb\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-b-cf2a53\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-cf2a53\"]}],\"name\":\"9018b8ffa374f37f63799efb5af7191fedb5633a7d3a4fb89bbf8812b19ee09f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"054d560df1f705c436811daf8d1ea086ac0e3e8dc41620c9afc84b49127ca106\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-b-cf2a53-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ed20beeb\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-b-cf2a53\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-cf2a53\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ed20beeb\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-b-cf2a53\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-cf2a53\"]}],\"name\":\"9b3087cb5e9e371c78c6a72df0d13c1d587bd5902c037d2c55b195aab7833258\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0341dd3343c276503041c15c999e18fc35f75cca81eacac744dd9469ae745026\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-b-cf2a53-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ed20beeb\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-b-cf2a53\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-cf2a53\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ed20beeb\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-b-cf2a53\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-cf2a53\"]}],\"name\":\"cf53c53eef73a765c98756e13adefb673bb0f6d015f324012be16c08e4c118ec\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"678ba96c8e01f3819132ce94ffb60abe123db2e883a2d335ec0ae1a65eebc9c2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-b-cf2a53-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ed20beeb\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-b-cf2a53\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-cf2a53\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__ed20beeb\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-b-cf2a53\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-b-cf2a53\"]}],\"name\":\"3d1b27cf9b2174af5eaf1c1f820ac9f9de11b6abbbee0845c43390fc8634bdf1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-inf-b-cf2a53"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-inf-b-cf2a53\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:27:23.454Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/a234aedd33a300d9ddb29b5cc4775d742e324acc4eba36683fda82c514ca4df7","error":"authconfigs.authorino.kuadrant.io \"a234aedd33a300d9ddb29b5cc4775d742e324acc4eba36683fda82c514ca4df7\" not found"}
{"level":"error","ts":"2026-11-02T22:27:23.508Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/ae538932d8b6f49827040f7f8ca1b30791881c6e01c750e3bba7a11444701aef","error":"authconfigs.authorino.kuadrant.io \"ae538932d8b6f49827040f7f8ca1b30791881c6e01c750e3bba7a11444701aef\" not found"}
{"level":"error","ts":"2026-11-02T22:27:23.571Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-mt-b5e8794c","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T22:23:00Z","generation":1,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"1eee245d-6b25-4613-9b8e-0d58b2f756f0\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:23:00Z"}],"name":"kuadrant-e2e-mt-b5e8794c","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-mt-b5e8794c","uid":"1eee245d-6b25-4613-9b8e-0d58b2f756f0"}],"resourceVersion":"124235","uid":"6f6a07d0-fda6-48f6-b721-b64a488bf42b"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"552e50da6fc8ce78112c3c10f99af3b6236a8497fbf912065710655e8510504c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-b5e8794c-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__935ec6dd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-mt-b5e8794c\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-b5e8794c\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__935ec6dd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-mt-b5e8794c\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-b5e8794c\"]}],\"name\":\"82ff5749f44463f02170b39f993d77c7aa062142e34cb1497fe03bab0af2de26\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d384fa5cf5c165fb857b5286823c29102a8f8ecba4d0681cb67ef3f3465b3ef7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-b5e8794c-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__935ec6dd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-mt-b5e8794c\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-b5e8794c\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__935ec6dd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-mt-b5e8794c\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-b5e8794c\"]}],\"name\":\"0d4b4412e78de0239876a1bec358f53d4ad341c18dca28bf794fe1efbb40b5e6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c3872837f0a1675ae7d85b6110e063fcc6880d67dda62e579edbd33e2ec8354b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-b5e8794c-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__935ec6dd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-mt-b5e8794c\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-b5e8794c\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__935ec6dd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-mt-b5e8794c\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-b5e8794c\"]}],\"name\":\"68c2c2943da40f2a11c7b05a2efbbe6954746118ff2bb2344ba96d1f8865b14c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"27eb83fd0535f24cd93b0d1ce0ccbbba7d5a16cabf5cbfd422e5f99e46bae24a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-b5e8794c-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__935ec6dd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-mt-b5e8794c\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-b5e8794c\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__935ec6dd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-mt-b5e8794c\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-b5e8794c\"]}],\"name\":\"b754d7007a9be3c661fe21c271b1c71c4792f6c9b6dcfb4b98ae5b652c27c236\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a30fc40a33264166b3248563865f6a93df25171b48cc3ff2466bf0a3aa6ee4ac\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-b5e8794c-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__935ec6dd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-mt-b5e8794c\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-b5e8794c\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__935ec6dd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-mt-b5e8794c\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-b5e8794c\"]}],\"name\":\"722d49fa93e37da3871f708eaa47c447e499929321ab060520de418a0acae9c2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d944074e3b0370c28c53c2e313e65c18d16764bcebb8701e880db212d3ce3849\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-mt-b5e8794c-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__935ec6dd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-mt-b5e8794c\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-b5e8794c\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__935ec6dd\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-mt-b5e8794c\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-mt-b5e8794c\"]}],\"name\":\"7c2637b130cdf85931196d83cd75d8d92fff2118c4319ab4084bc28e09608c85\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}}],\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-mt-b5e8794c"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-e2e-mt-b5e8794c\" not found"}
{"level":"error","ts":"2026-11-02T22:27:23.634Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-a-w4-7cde84-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-a-w4-7cde84-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:27:23.877Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-inf-b-3edc8c-maas-auth","namespace":"openshift-ingress","error":"authpolicies.kuadrant.io \"e2e-inf-b-3edc8c-maas-auth\" not found"}
{"level":"error","ts":"2026-11-02T22:27:24.113Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-b-w4-58ca7f-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-b-w4-58ca7f-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:27:24.314Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-mt-b5e8794c-maas-auth","namespace":"openshift-ingress","error":"authpolicies.kuadrant.io \"e2e-mt-b5e8794c-maas-auth\" not found"}
{"level":"error","ts":"2026-11-02T22:27:24.736Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-b-w0-0f0874-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-b-w0-0f0874-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:27:25.125Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-inf-b-3edc8c","error":"gateways.gateway.networking.k8s.io \"e2e-inf-b-3edc8c\" not found"}
{"level":"error","ts":"2026-11-02T22:27:25.480Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-mt-b5e8794c","error":"gateways.gateway.networking.k8s.io \"e2e-mt-b5e8794c\" not found"}
{"level":"info","ts":"2026-11-02T22:27:33.835Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["EnvoyFilter","AuthConfig","AuthPolicy","Limitador","Kuadrant","ConfigMap","HTTPRoute","TokenRateLimitPolicy","Gateway"],"eventTypes":{"delete":27,"update":25}}
{"level":"info","ts":"2026-11-02T22:27:34.333Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:27:34.341Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T22:27:36Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-shared-a-w2-06e461","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-a-w2-06e461","reconcileID":"157cf769-7cf0-4270-b87d-cb32802e472c","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-shared-a-w2-06e461","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T22:27:36Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-a-w2-06e461","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T22:27:36Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T22:27:36Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-11-02T22:27:36Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T22:27:37Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-11-02T22:27:37Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-shared-a-w2-06e461","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-a-w2-06e461","reconcileID":"157cf769-7cf0-4270-b87d-cb32802e472c","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-shared-a-w2-06e461","namespace":"openshift-ingress"}
{"level":"error","ts":"2026-11-02T22:27:37Z","logger":"telemetry-policy-extension-controller","msg":"Reconciler error","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-shared-a-w2-06e461","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-a-w2-06e461","reconcileID":"83ad14ef-e1e5-478d-81ae-72bffd6f1453","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-shared-a-w2-06e461\" not found","stacktrace":"sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:353\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-02T22:27:37Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-a-w2-06e461","event":"DELETE"}
{"level":"info","ts":"2026-11-02T22:27:37Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-02T22:27:37Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-shared-a-w2-06e461\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-02T22:27:37Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T22:27:38.458Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T22:27:38.552Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T22:27:38.661Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:27:38.661Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T22:27:38.749Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:27:43Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-inf-a-dd28e6","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-a-dd28e6","reconcileID":"107f708c-816f-4a3e-ac4d-1570896a76d7","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-inf-a-dd28e6","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T22:27:43Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-a-dd28e6","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T22:27:43Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T22:27:43Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-11-02T22:27:43Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T22:27:43Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-11-02T22:27:43Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-inf-a-dd28e6","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-a-dd28e6","reconcileID":"107f708c-816f-4a3e-ac4d-1570896a76d7","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-inf-a-dd28e6","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T22:27:43.369Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:27:43.371Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:27:43Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-a-dd28e6","event":"DELETE"}
{"level":"info","ts":"2026-11-02T22:27:43Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-02T22:27:43Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-inf-a-dd28e6\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-02T22:27:43Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T22:27:43.430Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T22:27:43.440Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:27:43.440Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T22:27:43.444Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-11-02T22:27:43.604Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:27:43.604Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T22:27:44.121Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-shared-a-w2-06e461","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T21:57:02Z","generation":4,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"d2c5712f-dd0e-4053-9a1f-54cc2f9da146\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:08:16Z"}],"name":"kuadrant-e2e-shared-a-w2-06e461","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-a-w2-06e461","uid":"d2c5712f-dd0e-4053-9a1f-54cc2f9da146"}],"resourceVersion":"102199","uid":"1ac11796-f745-4493-904e-fe4a3aaa4896"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d385206b1115a96c9f0147bd3800677310b659b18edb542eabe78e9dcf3d5903\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w2-06e461-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__19a73354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-06e461\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-06e461\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__19a73354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-06e461\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-06e461\"]}],\"name\":\"b549b8e82700c4f9440c76e2e87986ec39a088e7107894713b59cde4495a76e2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3c9315326fe75b44d6f5e3c7cd9fac13abf4b1a9918698589b0faa0c42deeb08\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w2-06e461-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__19a73354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-06e461\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-06e461\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__19a73354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-06e461\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-06e461\"]}],\"name\":\"479365efca2e3b90f48cc446d43f713f2be6711d43c072384287f8744152c4ac\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5257a14d8fc9908d3b52cf96fc5c9a6cd32b6940ef72c0e96cba23b3ded3d1b4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w2-06e461-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__19a73354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-06e461\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-06e461\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__19a73354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-06e461\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-06e461\"]}],\"name\":\"5ab05e09b5086d58bc3ba357893103478807d6be035c97b1dfa823c5c9b6d62d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"33019b54557cbd49426d4158e18ab3a88d235b9f20f792586c271053788a54a8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w2-06e461-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__19a73354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-06e461\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-06e461\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__19a73354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-06e461\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-06e461\"]}],\"name\":\"71b4675439e02b53cfb6ef6df9336acea0a91b623222cb67411d492fdda99858\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2ed83c23a8290f3646a543920910524ccfc2baad0ca9fb2e965cb8bd4f0fbf83\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w2-06e461-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__19a73354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-06e461\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-06e461\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__19a73354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-06e461\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-06e461\"]}],\"name\":\"328152874d79d022e9a61088d93d937d2ebf6d33b715fdcdae40b206cc472cb5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f1500aad848242a78004ce946110822a45e41d3c4e8b411396c76761e740aa13\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w2-06e461-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__19a73354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-06e461\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-06e461\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__19a73354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-06e461\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-06e461\"]}],\"name\":\"bae0bb257f438d171a6a8fd83d7ffa1f9ec9c7b6dcd238460f21f5c9b5fe8942\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}}],\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-shared-a-w2-06e461"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-e2e-shared-a-w2-06e461\" not found"}
{"level":"error","ts":"2026-11-02T22:27:47.017Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-inf-a-dd28e6","namespace":"openshift-ingress","uid":"3e1bdf60-4177-43d9-b7db-08f5d5d2b75d","error":"tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-inf-a-dd28e6\" not found"}
{"level":"error","ts":"2026-11-02T22:27:47.110Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-a-w2-06e461-maas-auth","namespace":"openshift-ingress","error":"authpolicies.kuadrant.io \"e2e-shared-a-w2-06e461-maas-auth\" not found"}
{"level":"error","ts":"2026-11-02T22:27:47.675Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-sub-test-model-58ca7f","namespace":"ai-tenant-e2e-shared-b-w4-58ca7f","uid":"c8dd0cb4-2981-4770-bc5d-ced14a85401e","error":"tokenratelimitpolicies.kuadrant.io \"maas-trlp-sub-test-model-58ca7f\" not found"}
{"level":"error","ts":"2026-11-02T22:27:47.911Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-a-w2-06e461","namespace":"openshift-ingress","uid":"c459fc7a-4e41-4226-a9ad-15cf3c29611a","error":"tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-a-w2-06e461\" not found"}
{"level":"info","ts":"2026-11-02T22:27:48.568Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T22:27:48.568Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T22:27:48.627Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-a-w2-06e461","error":"gateways.gateway.networking.k8s.io \"e2e-shared-a-w2-06e461\" not found"}
{"level":"error","ts":"2026-11-02T22:27:49.225Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-inf-a-dd28e6","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-inf-a-dd28e6\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:27:50.374Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy"],"eventTypes":{"update":1}}
{"level":"info","ts":"2026-11-02T22:27:56.658Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:27:56.665Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T22:27:56.672Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:27:56.673Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-02T22:27:56.723Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:27:56.723Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T22:27:57.900Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-shared-b-w4-58ca7f","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T21:56:33Z","generation":6,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"c11bd7aa-0f34-4363-b9b9-7f75323c0b3b\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:26:48Z"}],"name":"kuadrant-e2e-shared-b-w4-58ca7f","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-b-w4-58ca7f","uid":"c11bd7aa-0f34-4363-b9b9-7f75323c0b3b"}],"resourceVersion":"128644","uid":"08c1b782-3acf-494e-be97-2effd8846277"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cc0e1f81e6a71fde26f34a97e231591eaab95562cccb49c6cb59a034fa309987\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-58ca7f-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__d3659a2b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"0ce27b1a9b951ff6\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-58ca7f/sub-test-model-58ca7f-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-58ca7f/maas-trlp-sub-test-model-58ca7f\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__d3659a2b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"0ce27b1a9b951ff6\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-58ca7f/sub-test-model-58ca7f-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-58ca7f/maas-trlp-sub-test-model-58ca7f\"]}],\"name\":\"16d70795591de5097a354483ac0071d54ba340908f483ec956e0d2858c4ca971\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w4-58ca7f/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cc0e1f81e6a71fde26f34a97e231591eaab95562cccb49c6cb59a034fa309987\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-58ca7f-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__d3659a2b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"0ce27b1a9b951ff6\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-58ca7f/sub-test-model-58ca7f-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-58ca7f/maas-trlp-sub-test-model-58ca7f\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__d3659a2b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"0ce27b1a9b951ff6\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-58ca7f/sub-test-model-58ca7f-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-58ca7f/maas-trlp-sub-test-model-58ca7f\"]}],\"name\":\"bdbcdd21e4191009b326e6a48458600c97e67be7982554dc298679b0a93d9bdd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w4-58ca7f/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cc0e1f81e6a71fde26f34a97e231591eaab95562cccb49c6cb59a034fa309987\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-58ca7f-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__d3659a2b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"0ce27b1a9b951ff6\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-58ca7f/sub-test-model-58ca7f-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-58ca7f/maas-trlp-sub-test-model-58ca7f\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__d3659a2b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"0ce27b1a9b951ff6\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-58ca7f/sub-test-model-58ca7f-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-58ca7f/maas-trlp-sub-test-model-58ca7f\"]}],\"name\":\"24fd1c07778298144c004197e0860e036a66f73cf7c108e2029e0e98a902178b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w4-58ca7f/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cc0e1f81e6a71fde26f34a97e231591eaab95562cccb49c6cb59a034fa309987\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-58ca7f-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__d3659a2b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"0ce27b1a9b951ff6\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-58ca7f/sub-test-model-58ca7f-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-58ca7f/maas-trlp-sub-test-model-58ca7f\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__d3659a2b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"0ce27b1a9b951ff6\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-58ca7f/sub-test-model-58ca7f-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-58ca7f/maas-trlp-sub-test-model-58ca7f\"]}],\"name\":\"e175d08e6eefcb0d76e95b5025b2341e122e17ec7537363179003912a224e3a3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w4-58ca7f/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cc0e1f81e6a71fde26f34a97e231591eaab95562cccb49c6cb59a034fa309987\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-58ca7f-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__d3659a2b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"0ce27b1a9b951ff6\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-58ca7f/sub-test-model-58ca7f-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-58ca7f/maas-trlp-sub-test-model-58ca7f\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__d3659a2b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"0ce27b1a9b951ff6\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-58ca7f/sub-test-model-58ca7f-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-58ca7f/maas-trlp-sub-test-model-58ca7f\"]}],\"name\":\"83033bb8c6dd82428b7bf52e9bd506099eb9870109fbc7a367984f6ad686fb03\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w4-58ca7f/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cc0e1f81e6a71fde26f34a97e231591eaab95562cccb49c6cb59a034fa309987\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-58ca7f-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__d3659a2b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"0ce27b1a9b951ff6\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-58ca7f/sub-test-model-58ca7f-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-58ca7f/maas-trlp-sub-test-model-58ca7f\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__d3659a2b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"0ce27b1a9b951ff6\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-58ca7f/sub-test-model-58ca7f-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-58ca7f/maas-trlp-sub-test-model-58ca7f\"]}],\"name\":\"b0a829abbe233318b7f22c645988111ceac30d86b74ab772560baf6823c15930\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w4-58ca7f/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cc0e1f81e6a71fde26f34a97e231591eaab95562cccb49c6cb59a034fa309987\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-58ca7f-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__d3659a2b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"0ce27b1a9b951ff6\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-58ca7f/sub-test-model-58ca7f-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-58ca7f/maas-trlp-sub-test-model-58ca7f\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__d3659a2b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"0ce27b1a9b951ff6\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-58ca7f/sub-test-model-58ca7f-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-58ca7f/maas-trlp-sub-test-model-58ca7f\"]}],\"name\":\"82bed5671e4005c57b7fd6b45226f23f21fce96bd5a5b3349543c289ade1a40c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w4-58ca7f/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cc0e1f81e6a71fde26f34a97e231591eaab95562cccb49c6cb59a034fa309987\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-58ca7f-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__d3659a2b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"0ce27b1a9b951ff6\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-58ca7f/sub-test-model-58ca7f-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-58ca7f/maas-trlp-sub-test-model-58ca7f\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__d3659a2b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"0ce27b1a9b951ff6\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-58ca7f/sub-test-model-58ca7f-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-58ca7f/maas-trlp-sub-test-model-58ca7f\"]}],\"name\":\"411a5fd153f1d67a684ca8fa3af9523786dfeeff75ea294c1217d705ca35fd02\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w4-58ca7f/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9dccfbfbcf84c5edf4e0a3cc993bd8181b6febef066c8d0c3b0f13de64710295\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-58ca7f-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__50a1e7c4\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-58ca7f\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-58ca7f\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__50a1e7c4\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-58ca7f\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-58ca7f\"]}],\"name\":\"9cac59daced143b8d180cdc28d5c60985cfb4dc4b4384228e194211a1ad12e11\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"05dfe91984622f543d577d60ad0e98debc1b5bd07f1250f8f270652128b9a853\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-58ca7f-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__d3659a2b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"0ce27b1a9b951ff6\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-58ca7f/sub-test-model-58ca7f-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-58ca7f/maas-trlp-sub-test-model-58ca7f\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__d3659a2b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"0ce27b1a9b951ff6\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-58ca7f/sub-test-model-58ca7f-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-58ca7f/maas-trlp-sub-test-model-58ca7f\"]}],\"name\":\"1044b534d0f6faef14ed0bd307453b7c030b0abc4c46ccb788e27adc710838af\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w4-58ca7f/models/facebook/opt-125m/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4771105e998747ab87e30b9916bd0d3a852b162e19269a4d69d86617027fa582\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-58ca7f-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__d3659a2b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"0ce27b1a9b951ff6\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-58ca7f/sub-test-model-58ca7f-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-58ca7f/maas-trlp-sub-test-model-58ca7f\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__d3659a2b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"0ce27b1a9b951ff6\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-58ca7f/sub-test-model-58ca7f-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-58ca7f/maas-trlp-sub-test-model-58ca7f\"]}],\"name\":\"4ad8d96dab89dc57fe8c8854176448f69a000a847ddd4cd62315c0af402f9b61\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w4-58ca7f/models/facebook/opt-125m/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e94800a9d3a799f286010bb4d55769112ca5d678d762741e0c71c1921017c69c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-58ca7f-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__d3659a2b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"0ce27b1a9b951ff6\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-58ca7f/sub-test-model-58ca7f-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-58ca7f/maas-trlp-sub-test-model-58ca7f\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__d3659a2b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"0ce27b1a9b951ff6\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-58ca7f/sub-test-model-58ca7f-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-58ca7f/maas-trlp-sub-test-model-58ca7f\"]}],\"name\":\"59fccfcae3ce789c55676dda302d502fe709580cd0afbd7dd6a9cfa048d0db09\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w4-58ca7f/models/facebook/opt-125m/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"28d296b0545dc8f7d84dfcef93b120823ee44a90209d1f46e520e8c4fbff297c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-58ca7f-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__d3659a2b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"0ce27b1a9b951ff6\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-58ca7f/sub-test-model-58ca7f-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-58ca7f/maas-trlp-sub-test-model-58ca7f\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__d3659a2b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"0ce27b1a9b951ff6\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-58ca7f/sub-test-model-58ca7f-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-58ca7f/maas-trlp-sub-test-model-58ca7f\"]}],\"name\":\"cdf7cc884642fe2b1e91f047d34270519d17202de1ebfec0084beec4b38d8942\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w4-58ca7f/models/facebook/opt-125m/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"be2ffbe198ef8e3efead04eb5c81cee5ced5b0ab3ea9d64aaa790c22f57de5ff\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-58ca7f-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__d3659a2b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"0ce27b1a9b951ff6\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-58ca7f/sub-test-model-58ca7f-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-58ca7f/maas-trlp-sub-test-model-58ca7f\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__d3659a2b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"0ce27b1a9b951ff6\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-58ca7f/sub-test-model-58ca7f-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-58ca7f/maas-trlp-sub-test-model-58ca7f\"]}],\"name\":\"080b8f552aecbb66eef801a1d3dc9ae9fca9d213a13d3f37f776022b1fd32dc6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w4-58ca7f/sub-test-model-58ca7f/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"db97adc82f6275f9945cc699e3249b65dcbbbf17944383132eedc3e975e2dfc1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-58ca7f-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__d3659a2b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"0ce27b1a9b951ff6\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-58ca7f/sub-test-model-58ca7f-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-58ca7f/maas-trlp-sub-test-model-58ca7f\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__d3659a2b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"0ce27b1a9b951ff6\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-58ca7f/sub-test-model-58ca7f-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-58ca7f/maas-trlp-sub-test-model-58ca7f\"]}],\"name\":\"92e68be16a11824ab13598ac2f0547975378647b3138d77801ecb7f8fbf902ea\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w4-58ca7f/sub-test-model-58ca7f/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"dcd47998632ad52804f5314d21b106a956847b33837c74d48d5a29cc3b4024ad\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-58ca7f-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__d3659a2b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"0ce27b1a9b951ff6\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-58ca7f/sub-test-model-58ca7f-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-58ca7f/maas-trlp-sub-test-model-58ca7f\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__d3659a2b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"0ce27b1a9b951ff6\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-58ca7f/sub-test-model-58ca7f-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-58ca7f/maas-trlp-sub-test-model-58ca7f\"]}],\"name\":\"4d3a3f3008d6b6dea607a579a4027f80e378e571bd8c947479b9ff771261e85e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w4-58ca7f/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2c4a533eea3223851fc74430041650ade5b0f0bf93b147221445526acdd2138a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-58ca7f-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__d3659a2b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"0ce27b1a9b951ff6\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-58ca7f/sub-test-model-58ca7f-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-58ca7f/maas-trlp-sub-test-model-58ca7f\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__d3659a2b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"0ce27b1a9b951ff6\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-58ca7f/sub-test-model-58ca7f-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-58ca7f/maas-trlp-sub-test-model-58ca7f\"]}],\"name\":\"69089a396eb3890eddf67009f211cf0774456611f2dd8e136846bbabd85ae4dc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w4-58ca7f/sub-test-model-58ca7f/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"38428c3070019fb5581a88dc33df668a4d886ea7948236b801b97917c6107e4f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-58ca7f-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__d3659a2b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"0ce27b1a9b951ff6\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-58ca7f/sub-test-model-58ca7f-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-58ca7f/maas-trlp-sub-test-model-58ca7f\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__d3659a2b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"0ce27b1a9b951ff6\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-58ca7f/sub-test-model-58ca7f-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-58ca7f/maas-trlp-sub-test-model-58ca7f\"]}],\"name\":\"360c45b6bb0f74de2015da7b2336d532a04558b7dbf4b0d3bfd6d279562dafbe\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w4-58ca7f/sub-test-model-58ca7f/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6475cde502ebebcff22dfa440b75efd59881365f0ea459d58c5a3473aab71895\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-58ca7f-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__d3659a2b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"0ce27b1a9b951ff6\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-58ca7f/sub-test-model-58ca7f-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-58ca7f/maas-trlp-sub-test-model-58ca7f\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__d3659a2b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"0ce27b1a9b951ff6\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-58ca7f/sub-test-model-58ca7f-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-58ca7f/maas-trlp-sub-test-model-58ca7f\"]}],\"name\":\"710314562b9ccbff587b9509b2be1a5056398fb105188160f6c8e05d2167824a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w4-58ca7f/sub-test-model-58ca7f')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6acb8fe5e02ded3380a75376f0b127d4a9709eeca703e4ffefd97996bba073a8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-58ca7f-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__50a1e7c4\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-58ca7f\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-58ca7f\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__50a1e7c4\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-58ca7f\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-58ca7f\"]}],\"name\":\"0e48f35372f1ca63bf72ce3f982d42904086167b37407e934620b88a6b1d9b7a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f84e45e70df6f2c62c67fba14ae375620e4a3732a0ed6adeb79c70fb4031c1d5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-58ca7f-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__50a1e7c4\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-58ca7f\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-58ca7f\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__50a1e7c4\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-58ca7f\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-58ca7f\"]}],\"name\":\"b80f6cfb2ca9e5d7e0fe43d0578b85961ada60649dea4023cbfa83f4c2a1d4d6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8e6ff67d93e4d9b2ea87c487a06f947d8b76a18c9c78078c58dee29914a5b47c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-58ca7f-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__50a1e7c4\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-58ca7f\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-58ca7f\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__50a1e7c4\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-58ca7f\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-58ca7f\"]}],\"name\":\"62f62b2b98d219d9fa11e8eeef1788a1092ab9c645c7eed86eda513c2534a8e3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a87be006d97d67fcdec172b6143f1db733cd2c78dc7239fae4e7b34930fb681c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-58ca7f-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__50a1e7c4\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-58ca7f\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-58ca7f\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__50a1e7c4\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-58ca7f\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-58ca7f\"]}],\"name\":\"583ad00400c0381e6333f121438204f6c80cc03dd7dbf5e71cf01e41c7c43dc1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5b294df7b29e8cb61b717640614fa36dd2c243ed540ecb057e57e5c1fc26ab65\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-58ca7f-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__50a1e7c4\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-58ca7f\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-58ca7f\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__50a1e7c4\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-58ca7f\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-58ca7f\"]}],\"name\":\"719700e803a3a5f0d2be4857f415edce300561ebb593aa6f57ee43dd1dbbc501\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b5b4080374db36030ad8d34f7c5ee8aaf7b0cfceb9180deca07da688e9219b20\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-58ca7f-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__d3659a2b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"0ce27b1a9b951ff6\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-58ca7f/sub-test-model-58ca7f-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-58ca7f/maas-trlp-sub-test-model-58ca7f\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__d3659a2b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"0ce27b1a9b951ff6\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w4-58ca7f/sub-test-model-58ca7f-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w4-58ca7f/maas-trlp-sub-test-model-58ca7f\"]}],\"name\":\"10a8d233fa30405741b62cc4a91548a388d3f41b0678771e1fe160e1669b2c1d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w4-58ca7f/models/facebook/opt-125m')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-shared-b-w4-58ca7f"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-shared-b-w4-58ca7f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:27:58.102Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-shared-a-w2-06e461","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T21:57:02Z","generation":4,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"d2c5712f-dd0e-4053-9a1f-54cc2f9da146\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:08:16Z"}],"name":"kuadrant-e2e-shared-a-w2-06e461","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-a-w2-06e461","uid":"d2c5712f-dd0e-4053-9a1f-54cc2f9da146"}],"resourceVersion":"102199","uid":"1ac11796-f745-4493-904e-fe4a3aaa4896"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d385206b1115a96c9f0147bd3800677310b659b18edb542eabe78e9dcf3d5903\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w2-06e461-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__19a73354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-06e461\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-06e461\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__19a73354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-06e461\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-06e461\"]}],\"name\":\"b549b8e82700c4f9440c76e2e87986ec39a088e7107894713b59cde4495a76e2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3c9315326fe75b44d6f5e3c7cd9fac13abf4b1a9918698589b0faa0c42deeb08\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w2-06e461-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__19a73354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-06e461\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-06e461\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__19a73354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-06e461\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-06e461\"]}],\"name\":\"479365efca2e3b90f48cc446d43f713f2be6711d43c072384287f8744152c4ac\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5257a14d8fc9908d3b52cf96fc5c9a6cd32b6940ef72c0e96cba23b3ded3d1b4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w2-06e461-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__19a73354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-06e461\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-06e461\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__19a73354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-06e461\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-06e461\"]}],\"name\":\"5ab05e09b5086d58bc3ba357893103478807d6be035c97b1dfa823c5c9b6d62d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"33019b54557cbd49426d4158e18ab3a88d235b9f20f792586c271053788a54a8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w2-06e461-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__19a73354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-06e461\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-06e461\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__19a73354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-06e461\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-06e461\"]}],\"name\":\"71b4675439e02b53cfb6ef6df9336acea0a91b623222cb67411d492fdda99858\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2ed83c23a8290f3646a543920910524ccfc2baad0ca9fb2e965cb8bd4f0fbf83\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w2-06e461-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__19a73354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-06e461\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-06e461\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__19a73354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-06e461\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-06e461\"]}],\"name\":\"328152874d79d022e9a61088d93d937d2ebf6d33b715fdcdae40b206cc472cb5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f1500aad848242a78004ce946110822a45e41d3c4e8b411396c76761e740aa13\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w2-06e461-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__19a73354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-06e461\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-06e461\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__19a73354\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w2-06e461\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w2-06e461\"]}],\"name\":\"bae0bb257f438d171a6a8fd83d7ffa1f9ec9c7b6dcd238460f21f5c9b5fe8942\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}}],\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-shared-a-w2-06e461"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-e2e-shared-a-w2-06e461\" not found"}
{"level":"error","ts":"2026-11-02T22:27:58.283Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-shared-a-w4-7cde84","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T21:54:29Z","generation":7,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"30a49997-f3b8-4b9e-a63d-efe4d247c707\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:26:48Z"}],"name":"kuadrant-e2e-shared-a-w4-7cde84","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-a-w4-7cde84","uid":"30a49997-f3b8-4b9e-a63d-efe4d247c707"}],"resourceVersion":"128636","uid":"a9161c5c-8421-407e-b216-c0f311a76a78"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5350573b00b923007a376a9e1a94b10285846470cdf28852896168c05e85fa70\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-7cde84-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]}],\"name\":\"48cbc172808ea1101a391c96fa0aa6a9d997d76b9a3fe4299ef52c206b5e51da\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w4-7cde84/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5350573b00b923007a376a9e1a94b10285846470cdf28852896168c05e85fa70\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-7cde84-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]}],\"name\":\"458f6fe40bffec49fb32010c2cfd63f287660747add4cbf0fb8a18af8424e62b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w4-7cde84/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5350573b00b923007a376a9e1a94b10285846470cdf28852896168c05e85fa70\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-7cde84-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]}],\"name\":\"edfc30cea7aa4be391f5c0c0281ba5c15ae57c24deb2c99e8ff659a7e31ee30f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w4-7cde84/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5350573b00b923007a376a9e1a94b10285846470cdf28852896168c05e85fa70\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-7cde84-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]}],\"name\":\"fabe0ccdca0314c5576deae84c609d0b9b8801ca87dc819b73796fe5e9e1f9fb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w4-7cde84/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5350573b00b923007a376a9e1a94b10285846470cdf28852896168c05e85fa70\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-7cde84-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]}],\"name\":\"a635b5feded328aa50af52eefe8c511311aa26ff095d8d42023cf935b2fd9840\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w4-7cde84/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5350573b00b923007a376a9e1a94b10285846470cdf28852896168c05e85fa70\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-7cde84-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]}],\"name\":\"431e8ad28971cd1c4ad0ed4caacb6fb08c3273645039f799f7c5e1838e28468e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w4-7cde84/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5350573b00b923007a376a9e1a94b10285846470cdf28852896168c05e85fa70\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-7cde84-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]}],\"name\":\"bf9578d03514654c2a6449d92357d6fa77ac92c918c73f879acbdad94a934261\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w4-7cde84/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5350573b00b923007a376a9e1a94b10285846470cdf28852896168c05e85fa70\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-7cde84-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]}],\"name\":\"9f6e4a68a063bc9ea4a986af6d560594ce195d7803b84c67d0f915ae6805d458\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w4-7cde84/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0f923fa7f17446f382fb056bef7c9cc2146361c32cb89e19da4e6397505de43c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-7cde84-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-7cde84\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-7cde84\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]}],\"name\":\"6fb04747cbba17c2d2edd73660c4e50eec6f0ee924099f26ff442586021553ed\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"34a6fee35b5b6e4d8489e9dec6c22275d6769ec340fe614be36f43659226b008\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-7cde84-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]}],\"name\":\"ee0baf2c663c8fb32fca35ea0d66f7822a117a344c216faab45713d83644e15d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-a-w4-7cde84/models/facebook/opt-125m/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"298687b21bb9308a0390d1eccce98f0f3701b3448ec88414dc705044c62f7b35\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-7cde84-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]}],\"name\":\"0b54c8737b8cb5ca2d1d8db2626750345bc888a639756bae5b8c51b0890b6c4e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-a-w4-7cde84/models/facebook/opt-125m/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"903c98b0fff3cf1a47841a81663ba2415232166daafccec12bff78d7ecf1ad6f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-7cde84-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]}],\"name\":\"5967ef418a7e05ace3c367664f74204ca1bb1e976dda1f3f077d5715ede96ac3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-a-w4-7cde84/models/facebook/opt-125m/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bec208ec6dc21c79240eb94750ba68422695a096f53cfdb225e863fa3d9d315b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-7cde84-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]}],\"name\":\"6d2c661112529a04d92c0c59f6aca23b96458280a4e114607c8d267529ebaf59\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-a-w4-7cde84/models/facebook/opt-125m/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4c71f22ec48e1640858b5e13955ccc7284a723347433e1b6f730b142ce1fd0e1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-7cde84-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]}],\"name\":\"c6f5645306b39efe3b627da1c60119cb9627886be7c842a31d4f4213ca6b8c92\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1f7cf62dc6799b47d6f93db202824af7a9292a91889ec8859df0da33700cec22\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-7cde84-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]}],\"name\":\"cd51a15d79597727c42c21070d86ff94d8ba980d0fcd9fc7e0c774068faacced\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7227bd7965d40e464f5f833cf1ae228521499b8e52b256386ba7cddd67ea360b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-7cde84-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]}],\"name\":\"66e79b8a49aff310c44470df350bb011c8a126a68ffe503cd4babd031cfc31cd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-a-w4-7cde84/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b69925d3df07c885960ffd3cb00542ac829678560a41dc321cf97047026df6c1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-7cde84-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]}],\"name\":\"46c99d3074422622d25434536e7cb103006784460bb281b16a46dc803c12fb97\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"07296ce2840ffecfcd20ccfbb88bae26607ad04b350c3e27f6a92965b50cc44a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-7cde84-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]}],\"name\":\"ae1d19b9f3dd9001ae66784b9306df616b298bd339e6163ee537dd7cf8e4114e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2916a2827ecd216898e17d90f9a6227b27719deed72249cd41aee4bb7a1fe444\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-7cde84-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]}],\"name\":\"52ac0a3ff1c0c2cc22369d4fd8d5fc55703eba032f143b0bbafa5865297f1855\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"150da2804d58820302b448e24151b1f189b717cd68a8c1e110fba61141165eb0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-7cde84-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-7cde84\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-7cde84\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]}],\"name\":\"e314acde8746b9db89412919be5da708b16f912df85d7b1e19c5983d2065f729\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"45531229ceac4cfcba16f0f8d809077fb7e19e248278c544ac9fd018c419ef18\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-7cde84-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-7cde84\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-7cde84\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]}],\"name\":\"5d1e4a29bea3f2db952d9e19481c737e780a5cc72dc0934c1c2012a39bc18efd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f6229ee2157250d6d160cdc978e612aa3a7c43bb558942020078c3f42c450c79\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-7cde84-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-7cde84\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-7cde84\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]}],\"name\":\"228840b91d117fcc6420f8e81c02a72767236079f030e5ad6e1f7df8d2bfef2f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"96cad25fbcf27b7341cae948477117cfaf58cb098cf23b68e9b61e9380b5dbab\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-7cde84-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-7cde84\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-7cde84\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]}],\"name\":\"7f37843572934e12cedf2d78614afd5eacc9ed1f0ea54fe933bb17625146accc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"75661500a5114b056fb7b7fa79b052930433ec107cb332756c581a2f0de24173\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-7cde84-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-7cde84\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-7cde84\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]}],\"name\":\"f6e55ef63865313913827adc1faf8eb8ccb447468294af4335a4df4ebb61a404\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0bcecc0d8a2f3bd07c6b4357ee2bf111ba3a5b96cdc7f4d5ff088093263a85f9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-7cde84-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w4-7cde84/sub-test-model-7cde84-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]}],\"name\":\"7d9b5d579dbe1ecadaa13e9d9ba591da4b41d12601bd8c4b52006dd509b46788\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w4-7cde84/models/facebook/opt-125m')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-shared-a-w4-7cde84"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-shared-a-w4-7cde84\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:27:58.479Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-inf-a-dd28e6","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T22:16:28Z","generation":4,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"d3a82459-b6d7-4a13-9725-ba2076fa17d6\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:26:26Z"}],"name":"kuadrant-e2e-inf-a-dd28e6","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-inf-a-dd28e6","uid":"d3a82459-b6d7-4a13-9725-ba2076fa17d6"}],"resourceVersion":"128212","uid":"a07e27d8-b556-43f5-8f55-1925a2ab94c9"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"367523cfb64ff15643874e12a833388388fc16133685d340da1773f6658b212b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-dd28e6-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8b2b2edb\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-dd28e6\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-dd28e6\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8b2b2edb\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-dd28e6\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-dd28e6\"]}],\"name\":\"62009a3036ccd2e3fc17419ea09a53834e74ac23b54e2c90f0198174822fd6b6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"40e0cb771c648ceb2a0ee3a2669e598e6360431b7118a681dc3e080f465910f4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-dd28e6-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8b2b2edb\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-dd28e6\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-dd28e6\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8b2b2edb\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-dd28e6\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-dd28e6\"]}],\"name\":\"3e06face95a3104520fabfbb961ac6057d7b735b2b119828aa2143a59176eee2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6b8c2c1d0ad8500090d8712218e9f2ad0ae4868196347013ad6b1112fc30c004\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-dd28e6-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8b2b2edb\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-dd28e6\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-dd28e6\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8b2b2edb\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-dd28e6\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-dd28e6\"]}],\"name\":\"572f1bc9de1dda317bcae85e83039cf9b7b9e6c3b552c4792a105b2a6d3ecf8d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cadecb3d2ef581770e646697462759b8615722ad8d0b026b89324f6cb5d392aa\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-dd28e6-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8b2b2edb\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-dd28e6\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-dd28e6\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8b2b2edb\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-dd28e6\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-dd28e6\"]}],\"name\":\"a74ee860acb79956147d33c68c446602b7940bb0c29ab5b899f0fb77ec5bb798\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f13a0da8b101fb07b97a431dc942f81dd0bbdc060a1ab841eabf8a35d08378d6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-dd28e6-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8b2b2edb\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-dd28e6\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-dd28e6\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8b2b2edb\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-dd28e6\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-dd28e6\"]}],\"name\":\"5ea4337f87ea79f791f25977c2241de7c7630c1d1d781e0587e10fbf5a618ac3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"72caf46dae9fe0088c1f779cd468b7fb66ba49af22df0324b40b892b7c857043\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-inf-a-dd28e6-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8b2b2edb\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-dd28e6\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-dd28e6\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8b2b2edb\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-inf-a-dd28e6\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-inf-a-dd28e6\"]}],\"name\":\"1ec3b60448f2ca1f1bbfb6b6ee9fba8482844197c73f520ed258ca9fb534e4b1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}}],\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-inf-a-dd28e6"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-e2e-inf-a-dd28e6\" not found"}
{"level":"error","ts":"2026-11-02T22:27:58.658Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-inf-a-dd28e6","namespace":"openshift-ingress","uid":"3e1bdf60-4177-43d9-b7db-08f5d5d2b75d","error":"tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-inf-a-dd28e6\" not found"}
{"level":"error","ts":"2026-11-02T22:27:58.955Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-sub-test-model-58ca7f","namespace":"ai-tenant-e2e-shared-b-w4-58ca7f","uid":"c8dd0cb4-2981-4770-bc5d-ced14a85401e","error":"tokenratelimitpolicies.kuadrant.io \"maas-trlp-sub-test-model-58ca7f\" not found"}
{"level":"error","ts":"2026-11-02T22:27:59.732Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-a-w4-7cde84","namespace":"openshift-ingress","uid":"83e46bfa-f121-4136-adc9-a9e6690edeab","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-a-w4-7cde84\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:28:00.148Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-a-w2-06e461","namespace":"openshift-ingress","uid":"c459fc7a-4e41-4226-a9ad-15cf3c29611a","error":"tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-a-w2-06e461\" not found"}
{"level":"error","ts":"2026-11-02T22:28:00.334Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-a-w3-97995b","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-shared-a-w3-97995b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:28:00.398Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"sub-test-model-7cde84-kserve-route","namespace":"ai-tenant-e2e-shared-a-w4-7cde84","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"sub-test-model-7cde84-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:28:00.866Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-a-w2-06e461","error":"gateways.gateway.networking.k8s.io \"e2e-shared-a-w2-06e461\" not found"}
{"level":"error","ts":"2026-11-02T22:28:01.109Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-inf-a-dd28e6","error":"gateways.gateway.networking.k8s.io \"e2e-inf-a-dd28e6\" not found"}
{"level":"info","ts":"2026-11-02T22:28:08.761Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","Kuadrant","ConfigMap","AuthPolicy","EnvoyFilter","TokenRateLimitPolicy","HTTPRoute","Limitador","Gateway"],"eventTypes":{"create":1,"delete":27,"update":47}}
{"level":"info","ts":"2026-11-02T22:28:09.018Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:28:09.038Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T22:28:12.669Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T22:28:12.975Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:28:12.975Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T22:28:13.055Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T22:28:13.123Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:28:17.187Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:28:17.192Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:28:17.223Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:28:17.232Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T22:28:17.235Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:28:17.235Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T22:28:17.352Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T22:28:20.540Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T22:28:20.541Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T22:28:20.943Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-a-w4-7cde84","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-shared-a-w4-7cde84\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:28:21.000Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"data-science-gateway","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"data-science-gateway\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:28:32.318Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","AuthPolicy","Gateway","Limitador","AuthConfig","ConfigMap","EnvoyFilter","HTTPRoute"],"eventTypes":{"create":12,"delete":13,"update":12}}
{"level":"info","ts":"2026-11-02T22:28:32.562Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T22:28:35.050Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T22:28:35.324Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:28:35.324Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T22:28:39.123Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:28:39.143Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:28:39.154Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T22:28:39.225Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:28:39.246Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:28:39.246Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-02T22:28:39.265Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:28:39.265Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T22:28:42.257Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T22:28:42.257Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T22:28:42.439Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"data-science-gateway","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"data-science-gateway\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:28:43.762Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway","HTTPRoute"],"eventTypes":{"delete":1,"update":2}}
{"level":"info","ts":"2026-11-02T22:28:50.000Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:28:50.023Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:28:50.037Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:28:50.037Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T22:28:50.044Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:28:50.055Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"error","ts":"2026-11-02T22:28:50.223Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:28:50.223Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T22:28:50.343Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/38428c3070019fb5581a88dc33df668a4d886ea7948236b801b97917c6107e4f","error":"authconfigs.authorino.kuadrant.io \"38428c3070019fb5581a88dc33df668a4d886ea7948236b801b97917c6107e4f\" not found"}
{"level":"error","ts":"2026-11-02T22:28:50.398Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/db97adc82f6275f9945cc699e3249b65dcbbbf17944383132eedc3e975e2dfc1","error":"authconfigs.authorino.kuadrant.io \"db97adc82f6275f9945cc699e3249b65dcbbbf17944383132eedc3e975e2dfc1\" not found"}
{"level":"error","ts":"2026-11-02T22:28:50.452Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/34a6fee35b5b6e4d8489e9dec6c22275d6769ec340fe614be36f43659226b008","error":"authconfigs.authorino.kuadrant.io \"34a6fee35b5b6e4d8489e9dec6c22275d6769ec340fe614be36f43659226b008\" not found"}
{"level":"error","ts":"2026-11-02T22:28:50.507Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/cc0e1f81e6a71fde26f34a97e231591eaab95562cccb49c6cb59a034fa309987","error":"authconfigs.authorino.kuadrant.io \"cc0e1f81e6a71fde26f34a97e231591eaab95562cccb49c6cb59a034fa309987\" not found"}
{"level":"error","ts":"2026-11-02T22:28:50.561Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/4771105e998747ab87e30b9916bd0d3a852b162e19269a4d69d86617027fa582","error":"authconfigs.authorino.kuadrant.io \"4771105e998747ab87e30b9916bd0d3a852b162e19269a4d69d86617027fa582\" not found"}
{"level":"error","ts":"2026-11-02T22:28:50.616Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/2916a2827ecd216898e17d90f9a6227b27719deed72249cd41aee4bb7a1fe444","error":"authconfigs.authorino.kuadrant.io \"2916a2827ecd216898e17d90f9a6227b27719deed72249cd41aee4bb7a1fe444\" not found"}
{"level":"error","ts":"2026-11-02T22:28:50.670Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/b69925d3df07c885960ffd3cb00542ac829678560a41dc321cf97047026df6c1","error":"authconfigs.authorino.kuadrant.io \"b69925d3df07c885960ffd3cb00542ac829678560a41dc321cf97047026df6c1\" not found"}
{"level":"error","ts":"2026-11-02T22:28:50.712Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-shared-b-w4-58ca7f","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T21:56:33Z","generation":8,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"c11bd7aa-0f34-4363-b9b9-7f75323c0b3b\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:28:18Z"}],"name":"kuadrant-e2e-shared-b-w4-58ca7f","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-b-w4-58ca7f","uid":"c11bd7aa-0f34-4363-b9b9-7f75323c0b3b"}],"resourceVersion":"130987","uid":"08c1b782-3acf-494e-be97-2effd8846277"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9dccfbfbcf84c5edf4e0a3cc993bd8181b6febef066c8d0c3b0f13de64710295\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-58ca7f-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__50a1e7c4\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-58ca7f\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-58ca7f\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__50a1e7c4\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-58ca7f\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-58ca7f\"]}],\"name\":\"9cac59daced143b8d180cdc28d5c60985cfb4dc4b4384228e194211a1ad12e11\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6acb8fe5e02ded3380a75376f0b127d4a9709eeca703e4ffefd97996bba073a8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-58ca7f-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__50a1e7c4\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-58ca7f\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-58ca7f\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__50a1e7c4\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-58ca7f\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-58ca7f\"]}],\"name\":\"0e48f35372f1ca63bf72ce3f982d42904086167b37407e934620b88a6b1d9b7a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f84e45e70df6f2c62c67fba14ae375620e4a3732a0ed6adeb79c70fb4031c1d5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-58ca7f-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__50a1e7c4\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-58ca7f\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-58ca7f\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__50a1e7c4\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-58ca7f\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-58ca7f\"]}],\"name\":\"b80f6cfb2ca9e5d7e0fe43d0578b85961ada60649dea4023cbfa83f4c2a1d4d6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8e6ff67d93e4d9b2ea87c487a06f947d8b76a18c9c78078c58dee29914a5b47c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-58ca7f-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__50a1e7c4\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-58ca7f\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-58ca7f\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__50a1e7c4\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-58ca7f\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-58ca7f\"]}],\"name\":\"62f62b2b98d219d9fa11e8eeef1788a1092ab9c645c7eed86eda513c2534a8e3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a87be006d97d67fcdec172b6143f1db733cd2c78dc7239fae4e7b34930fb681c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-58ca7f-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__50a1e7c4\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-58ca7f\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-58ca7f\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__50a1e7c4\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-58ca7f\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-58ca7f\"]}],\"name\":\"583ad00400c0381e6333f121438204f6c80cc03dd7dbf5e71cf01e41c7c43dc1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5b294df7b29e8cb61b717640614fa36dd2c243ed540ecb057e57e5c1fc26ab65\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w4-58ca7f-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__50a1e7c4\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-58ca7f\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-58ca7f\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__50a1e7c4\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w4-58ca7f\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w4-58ca7f\"]}],\"name\":\"719700e803a3a5f0d2be4857f415edce300561ebb593aa6f57ee43dd1dbbc501\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-shared-b-w4-58ca7f"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-shared-b-w4-58ca7f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:28:50.725Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/1f7cf62dc6799b47d6f93db202824af7a9292a91889ec8859df0da33700cec22","error":"authconfigs.authorino.kuadrant.io \"1f7cf62dc6799b47d6f93db202824af7a9292a91889ec8859df0da33700cec22\" not found"}
{"level":"error","ts":"2026-11-02T22:28:50.779Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/6475cde502ebebcff22dfa440b75efd59881365f0ea459d58c5a3473aab71895","error":"authconfigs.authorino.kuadrant.io \"6475cde502ebebcff22dfa440b75efd59881365f0ea459d58c5a3473aab71895\" not found"}
{"level":"error","ts":"2026-11-02T22:28:50.835Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/bec208ec6dc21c79240eb94750ba68422695a096f53cfdb225e863fa3d9d315b","error":"authconfigs.authorino.kuadrant.io \"bec208ec6dc21c79240eb94750ba68422695a096f53cfdb225e863fa3d9d315b\" not found"}
{"level":"error","ts":"2026-11-02T22:28:50.889Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/7227bd7965d40e464f5f833cf1ae228521499b8e52b256386ba7cddd67ea360b","error":"authconfigs.authorino.kuadrant.io \"7227bd7965d40e464f5f833cf1ae228521499b8e52b256386ba7cddd67ea360b\" not found"}
{"level":"error","ts":"2026-11-02T22:28:50.944Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/298687b21bb9308a0390d1eccce98f0f3701b3448ec88414dc705044c62f7b35","error":"authconfigs.authorino.kuadrant.io \"298687b21bb9308a0390d1eccce98f0f3701b3448ec88414dc705044c62f7b35\" not found"}
{"level":"error","ts":"2026-11-02T22:28:50.998Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/07296ce2840ffecfcd20ccfbb88bae26607ad04b350c3e27f6a92965b50cc44a","error":"authconfigs.authorino.kuadrant.io \"07296ce2840ffecfcd20ccfbb88bae26607ad04b350c3e27f6a92965b50cc44a\" not found"}
{"level":"error","ts":"2026-11-02T22:28:51.053Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/e94800a9d3a799f286010bb4d55769112ca5d678d762741e0c71c1921017c69c","error":"authconfigs.authorino.kuadrant.io \"e94800a9d3a799f286010bb4d55769112ca5d678d762741e0c71c1921017c69c\" not found"}
{"level":"error","ts":"2026-11-02T22:28:51.107Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/0bcecc0d8a2f3bd07c6b4357ee2bf111ba3a5b96cdc7f4d5ff088093263a85f9","error":"authconfigs.authorino.kuadrant.io \"0bcecc0d8a2f3bd07c6b4357ee2bf111ba3a5b96cdc7f4d5ff088093263a85f9\" not found"}
{"level":"error","ts":"2026-11-02T22:28:51.164Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/903c98b0fff3cf1a47841a81663ba2415232166daafccec12bff78d7ecf1ad6f","error":"authconfigs.authorino.kuadrant.io \"903c98b0fff3cf1a47841a81663ba2415232166daafccec12bff78d7ecf1ad6f\" not found"}
{"level":"error","ts":"2026-11-02T22:28:51.219Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/28d296b0545dc8f7d84dfcef93b120823ee44a90209d1f46e520e8c4fbff297c","error":"authconfigs.authorino.kuadrant.io \"28d296b0545dc8f7d84dfcef93b120823ee44a90209d1f46e520e8c4fbff297c\" not found"}
{"level":"error","ts":"2026-11-02T22:28:51.273Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/dcd47998632ad52804f5314d21b106a956847b33837c74d48d5a29cc3b4024ad","error":"authconfigs.authorino.kuadrant.io \"dcd47998632ad52804f5314d21b106a956847b33837c74d48d5a29cc3b4024ad\" not found"}
{"level":"error","ts":"2026-11-02T22:28:51.328Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/b5b4080374db36030ad8d34f7c5ee8aaf7b0cfceb9180deca07da688e9219b20","error":"authconfigs.authorino.kuadrant.io \"b5b4080374db36030ad8d34f7c5ee8aaf7b0cfceb9180deca07da688e9219b20\" not found"}
{"level":"error","ts":"2026-11-02T22:28:51.383Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/be2ffbe198ef8e3efead04eb5c81cee5ced5b0ab3ea9d64aaa790c22f57de5ff","error":"authconfigs.authorino.kuadrant.io \"be2ffbe198ef8e3efead04eb5c81cee5ced5b0ab3ea9d64aaa790c22f57de5ff\" not found"}
{"level":"error","ts":"2026-11-02T22:28:51.432Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-shared-a-w4-7cde84","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T21:54:29Z","generation":8,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"30a49997-f3b8-4b9e-a63d-efe4d247c707\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:27:44Z"}],"name":"kuadrant-e2e-shared-a-w4-7cde84","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-a-w4-7cde84","uid":"30a49997-f3b8-4b9e-a63d-efe4d247c707"}],"resourceVersion":"130132","uid":"a9161c5c-8421-407e-b216-c0f311a76a78"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0f923fa7f17446f382fb056bef7c9cc2146361c32cb89e19da4e6397505de43c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-7cde84-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-7cde84\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-7cde84\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]}],\"name\":\"6fb04747cbba17c2d2edd73660c4e50eec6f0ee924099f26ff442586021553ed\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"150da2804d58820302b448e24151b1f189b717cd68a8c1e110fba61141165eb0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-7cde84-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-7cde84\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-7cde84\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]}],\"name\":\"e314acde8746b9db89412919be5da708b16f912df85d7b1e19c5983d2065f729\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"45531229ceac4cfcba16f0f8d809077fb7e19e248278c544ac9fd018c419ef18\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-7cde84-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-7cde84\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-7cde84\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]}],\"name\":\"5d1e4a29bea3f2db952d9e19481c737e780a5cc72dc0934c1c2012a39bc18efd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f6229ee2157250d6d160cdc978e612aa3a7c43bb558942020078c3f42c450c79\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-7cde84-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-7cde84\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-7cde84\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]}],\"name\":\"228840b91d117fcc6420f8e81c02a72767236079f030e5ad6e1f7df8d2bfef2f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"96cad25fbcf27b7341cae948477117cfaf58cb098cf23b68e9b61e9380b5dbab\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-7cde84-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-7cde84\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-7cde84\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]}],\"name\":\"7f37843572934e12cedf2d78614afd5eacc9ed1f0ea54fe933bb17625146accc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"75661500a5114b056fb7b7fa79b052930433ec107cb332756c581a2f0de24173\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-7cde84-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-7cde84\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-7cde84\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]}],\"name\":\"f6e55ef63865313913827adc1faf8eb8ccb447468294af4335a4df4ebb61a404\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-shared-a-w4-7cde84"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-shared-a-w4-7cde84\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:28:51.437Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/05dfe91984622f543d577d60ad0e98debc1b5bd07f1250f8f270652128b9a853","error":"authconfigs.authorino.kuadrant.io \"05dfe91984622f543d577d60ad0e98debc1b5bd07f1250f8f270652128b9a853\" not found"}
{"level":"error","ts":"2026-11-02T22:28:51.492Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/4c71f22ec48e1640858b5e13955ccc7284a723347433e1b6f730b142ce1fd0e1","error":"authconfigs.authorino.kuadrant.io \"4c71f22ec48e1640858b5e13955ccc7284a723347433e1b6f730b142ce1fd0e1\" not found"}
{"level":"error","ts":"2026-11-02T22:28:51.547Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/2c4a533eea3223851fc74430041650ade5b0f0bf93b147221445526acdd2138a","error":"authconfigs.authorino.kuadrant.io \"2c4a533eea3223851fc74430041650ade5b0f0bf93b147221445526acdd2138a\" not found"}
{"level":"error","ts":"2026-11-02T22:28:51.601Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/5350573b00b923007a376a9e1a94b10285846470cdf28852896168c05e85fa70","error":"authconfigs.authorino.kuadrant.io \"5350573b00b923007a376a9e1a94b10285846470cdf28852896168c05e85fa70\" not found"}
{"level":"error","ts":"2026-11-02T22:28:52.549Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-a-w3-97995b-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-a-w3-97995b-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:28:53.215Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T22:28:53.215Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T22:28:53.682Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"data-science-gateway","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"data-science-gateway\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:28:56Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-shared-b-w2-c7e71f","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-b-w2-c7e71f","reconcileID":"627a134c-f46e-40bc-bf05-1aebf342b986","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-shared-b-w2-c7e71f","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T22:28:57Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-b-w2-c7e71f","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T22:28:57Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T22:28:57Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-11-02T22:28:57Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T22:28:57Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-11-02T22:28:57Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-shared-b-w2-c7e71f","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-b-w2-c7e71f","reconcileID":"627a134c-f46e-40bc-bf05-1aebf342b986","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-shared-b-w2-c7e71f","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T22:28:57Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-b-w2-c7e71f","event":"DELETE"}
{"level":"info","ts":"2026-11-02T22:28:57Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-02T22:28:57Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-shared-b-w2-c7e71f\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-02T22:28:57Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T22:28:58Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-inf-b-cf2a53","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-b-cf2a53","reconcileID":"7cdd55f1-5e87-44a2-b446-217c3dd7ffce","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-inf-b-cf2a53","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T22:28:58Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-b-cf2a53","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T22:28:58Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T22:28:58Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-11-02T22:28:58Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T22:28:58Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-11-02T22:28:58Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-inf-b-cf2a53","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-b-cf2a53","reconcileID":"7cdd55f1-5e87-44a2-b446-217c3dd7ffce","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-inf-b-cf2a53","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T22:28:58Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-inf-b-cf2a53","event":"DELETE"}
{"level":"info","ts":"2026-11-02T22:28:58Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-02T22:28:58Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-inf-b-cf2a53\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-02T22:28:58Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T22:29:05.021Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["EnvoyFilter","TokenRateLimitPolicy","ConfigMap","AuthPolicy","Limitador","Gateway","AuthConfig","HTTPRoute"],"eventTypes":{"create":2,"delete":25,"update":6}}
{"level":"info","ts":"2026-11-02T22:29:05.306Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T22:29:07.464Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T22:29:07.558Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:29:07.558Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T22:29:11.363Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:29:11.370Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T22:29:11.381Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:29:11.381Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T22:29:11.363Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:29:11.384Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:29:11.544Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T22:29:14.072Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w2-6fa533","namespace":"e2e-models-e2e-worker-w2-6fa533","uid":"3a128bb2-de88-49aa-ab9e-c8626107a077","error":"tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w2-6fa533\" not found"}
{"level":"info","ts":"2026-11-02T22:29:14.371Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T22:29:14.371Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T22:29:15Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-shared-a-w4-7cde84","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-a-w4-7cde84","reconcileID":"843bd7b8-35f0-4a74-80c8-6af694561964","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-shared-a-w4-7cde84","namespace":"openshift-ingress"}
{"level":"error","ts":"2026-11-02T22:29:15.273Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-a-w4-7cde84","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-shared-a-w4-7cde84\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:29:15Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-a-w4-7cde84","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T22:29:15Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T22:29:15Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-11-02T22:29:15Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T22:29:15Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-11-02T22:29:15Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-shared-a-w4-7cde84","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-a-w4-7cde84","reconcileID":"843bd7b8-35f0-4a74-80c8-6af694561964","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-shared-a-w4-7cde84","namespace":"openshift-ingress"}
{"level":"error","ts":"2026-11-02T22:29:15Z","logger":"telemetry-policy-extension-controller","msg":"Reconciler error","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-shared-a-w4-7cde84","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-a-w4-7cde84","reconcileID":"d33d44a7-2277-430a-bcc3-d6123e3bb994","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-shared-a-w4-7cde84\" not found","stacktrace":"sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:353\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-02T22:29:15Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-a-w4-7cde84","event":"DELETE"}
{"level":"info","ts":"2026-11-02T22:29:15Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-02T22:29:15Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-shared-a-w4-7cde84\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-02T22:29:15Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T22:29:15.826Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Kuadrant","HTTPRoute","EnvoyFilter","AuthPolicy","Gateway","TokenRateLimitPolicy"],"eventTypes":{"delete":13,"update":1}}
{"level":"info","ts":"2026-11-02T22:29:16.022Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:29:16.042Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T22:29:19.033Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T22:29:19.251Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:29:19.251Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T22:29:19.543Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:29:19.633Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T22:29:23.851Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:29:23.854Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:29:23.862Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T22:29:23.871Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:29:23.871Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T22:29:23.923Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-11-02T22:29:23.972Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:29:23.972Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T22:29:24.003Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/4a53308e71fbbb856396e651af44b1538dffa452616a580a700fb2b56d6332f1","error":"authconfigs.authorino.kuadrant.io \"4a53308e71fbbb856396e651af44b1538dffa452616a580a700fb2b56d6332f1\" not found"}
{"level":"error","ts":"2026-11-02T22:29:24.058Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/5a40698293ed44103a2b127c08980b4704f79ba3d5f07cb6981daedc8d4d99d4","error":"authconfigs.authorino.kuadrant.io \"5a40698293ed44103a2b127c08980b4704f79ba3d5f07cb6981daedc8d4d99d4\" not found"}
{"level":"error","ts":"2026-11-02T22:29:24.112Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/1c842f011243ad9a03724d6985fbcc2786da0a851d4830084a6dd6535b142162","error":"authconfigs.authorino.kuadrant.io \"1c842f011243ad9a03724d6985fbcc2786da0a851d4830084a6dd6535b142162\" not found"}
{"level":"error","ts":"2026-11-02T22:29:24.170Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/0341dd3343c276503041c15c999e18fc35f75cca81eacac744dd9469ae745026","error":"authconfigs.authorino.kuadrant.io \"0341dd3343c276503041c15c999e18fc35f75cca81eacac744dd9469ae745026\" not found"}
{"level":"error","ts":"2026-11-02T22:29:24.246Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/678ba96c8e01f3819132ce94ffb60abe123db2e883a2d335ec0ae1a65eebc9c2","error":"authconfigs.authorino.kuadrant.io \"678ba96c8e01f3819132ce94ffb60abe123db2e883a2d335ec0ae1a65eebc9c2\" not found"}
{"level":"error","ts":"2026-11-02T22:29:24.336Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/054d560df1f705c436811daf8d1ea086ac0e3e8dc41620c9afc84b49127ca106","error":"authconfigs.authorino.kuadrant.io \"054d560df1f705c436811daf8d1ea086ac0e3e8dc41620c9afc84b49127ca106\" not found"}
{"level":"error","ts":"2026-11-02T22:29:24.391Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/7ed2ba1aeffbfe14d596981ced332ed955f46afacea1925e585ea9fdc0e6c4fc","error":"authconfigs.authorino.kuadrant.io \"7ed2ba1aeffbfe14d596981ced332ed955f46afacea1925e585ea9fdc0e6c4fc\" not found"}
{"level":"error","ts":"2026-11-02T22:29:24.445Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/5384f5c4ddc9ccb72784e0e07297d2dd640458e7b7a22716374ed0b8930f3320","error":"authconfigs.authorino.kuadrant.io \"5384f5c4ddc9ccb72784e0e07297d2dd640458e7b7a22716374ed0b8930f3320\" not found"}
{"level":"error","ts":"2026-11-02T22:29:24.500Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/17c8e0f32f1474abdd1596736289f0ee22b2ff3b2707aefff8f6535c03b8536a","error":"authconfigs.authorino.kuadrant.io \"17c8e0f32f1474abdd1596736289f0ee22b2ff3b2707aefff8f6535c03b8536a\" not found"}
{"level":"error","ts":"2026-11-02T22:29:24.545Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-shared-a-w4-7cde84","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T21:54:29Z","generation":9,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"30a49997-f3b8-4b9e-a63d-efe4d247c707\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:28:40Z"}],"name":"kuadrant-e2e-shared-a-w4-7cde84","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-a-w4-7cde84","uid":"30a49997-f3b8-4b9e-a63d-efe4d247c707"}],"resourceVersion":"131522","uid":"a9161c5c-8421-407e-b216-c0f311a76a78"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0f923fa7f17446f382fb056bef7c9cc2146361c32cb89e19da4e6397505de43c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-7cde84-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-7cde84\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-7cde84\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]}],\"name\":\"6fb04747cbba17c2d2edd73660c4e50eec6f0ee924099f26ff442586021553ed\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"150da2804d58820302b448e24151b1f189b717cd68a8c1e110fba61141165eb0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-7cde84-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-7cde84\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-7cde84\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]}],\"name\":\"e314acde8746b9db89412919be5da708b16f912df85d7b1e19c5983d2065f729\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"45531229ceac4cfcba16f0f8d809077fb7e19e248278c544ac9fd018c419ef18\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-7cde84-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-7cde84\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-7cde84\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]}],\"name\":\"5d1e4a29bea3f2db952d9e19481c737e780a5cc72dc0934c1c2012a39bc18efd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f6229ee2157250d6d160cdc978e612aa3a7c43bb558942020078c3f42c450c79\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-7cde84-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-7cde84\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-7cde84\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]}],\"name\":\"228840b91d117fcc6420f8e81c02a72767236079f030e5ad6e1f7df8d2bfef2f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"96cad25fbcf27b7341cae948477117cfaf58cb098cf23b68e9b61e9380b5dbab\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-7cde84-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-7cde84\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-7cde84\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]}],\"name\":\"7f37843572934e12cedf2d78614afd5eacc9ed1f0ea54fe933bb17625146accc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"75661500a5114b056fb7b7fa79b052930433ec107cb332756c581a2f0de24173\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w4-7cde84-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-7cde84\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__15070b1d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w4-7cde84\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w4-7cde84\"]}],\"name\":\"f6e55ef63865313913827adc1faf8eb8ccb447468294af4335a4df4ebb61a404\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}}],\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-shared-a-w4-7cde84"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-e2e-shared-a-w4-7cde84\" not found"}
{"level":"error","ts":"2026-11-02T22:29:24.554Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/12167602fd6f0121f28300ae64a13003d4a0fa7f5ff7d0cb33d38b9e60b0d728","error":"authconfigs.authorino.kuadrant.io \"12167602fd6f0121f28300ae64a13003d4a0fa7f5ff7d0cb33d38b9e60b0d728\" not found"}
{"level":"error","ts":"2026-11-02T22:29:24.609Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/c81789e1553bf7e7d1d0740e3a95011d3c200b400ce15c0a79e4cb90668180c5","error":"authconfigs.authorino.kuadrant.io \"c81789e1553bf7e7d1d0740e3a95011d3c200b400ce15c0a79e4cb90668180c5\" not found"}
{"level":"error","ts":"2026-11-02T22:29:24.663Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/cef0f4c4be2f6db7ef6ec330309895be984f5a86740e00b7ff2f97edfd998522","error":"authconfigs.authorino.kuadrant.io \"cef0f4c4be2f6db7ef6ec330309895be984f5a86740e00b7ff2f97edfd998522\" not found"}
{"level":"error","ts":"2026-11-02T22:29:25.101Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-shared-a-w0-6e535d","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T21:54:30Z","generation":8,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"bb413150-c71f-467a-b73c-fc346914ff7a\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:26:03Z"}],"name":"kuadrant-e2e-shared-a-w0-6e535d","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-a-w0-6e535d","uid":"bb413150-c71f-467a-b73c-fc346914ff7a"}],"resourceVersion":"127683","uid":"79ec4380-cbc0-4c66-b610-cdb28384077b"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6d702678bda1dfc9e3eeb362adcee5bc69be4839840717fadfcf3f540bbad15d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_3_per_1m__92ec8fe3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"987e1cbb71f3b73f\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w0-6e535d/maas-trlp-rate-test-model-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_3_per_1m__92ec8fe3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"987e1cbb71f3b73f\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w0-6e535d/maas-trlp-rate-test-model-6e535d\"]}],\"name\":\"8ccb66656d88cbc56ddfc1cdade2c6ade590ddfd8f834e284cfd4544915530dd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w0-6e535d/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6d702678bda1dfc9e3eeb362adcee5bc69be4839840717fadfcf3f540bbad15d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_3_per_1m__92ec8fe3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"987e1cbb71f3b73f\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w0-6e535d/maas-trlp-rate-test-model-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_3_per_1m__92ec8fe3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"987e1cbb71f3b73f\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w0-6e535d/maas-trlp-rate-test-model-6e535d\"]}],\"name\":\"57fa57a3c22d969731bb3e0e7b196f5e0d200359f9ed2a7b1165d9d152357db6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w0-6e535d/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6d702678bda1dfc9e3eeb362adcee5bc69be4839840717fadfcf3f540bbad15d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_3_per_1m__92ec8fe3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"987e1cbb71f3b73f\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w0-6e535d/maas-trlp-rate-test-model-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_3_per_1m__92ec8fe3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"987e1cbb71f3b73f\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w0-6e535d/maas-trlp-rate-test-model-6e535d\"]}],\"name\":\"625697231e3f5cbf71be2753d18743ad6080e6640edadbcbe1fd6a5ab9ff3124\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w0-6e535d/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6d702678bda1dfc9e3eeb362adcee5bc69be4839840717fadfcf3f540bbad15d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_3_per_1m__92ec8fe3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"987e1cbb71f3b73f\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w0-6e535d/maas-trlp-rate-test-model-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_3_per_1m__92ec8fe3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"987e1cbb71f3b73f\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w0-6e535d/maas-trlp-rate-test-model-6e535d\"]}],\"name\":\"627fb51e5fd1118f12e62d581e89f9ea85a52c751c25f1a92819f1261a6e611c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w0-6e535d/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6d702678bda1dfc9e3eeb362adcee5bc69be4839840717fadfcf3f540bbad15d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_3_per_1m__92ec8fe3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"987e1cbb71f3b73f\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w0-6e535d/maas-trlp-rate-test-model-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_3_per_1m__92ec8fe3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"987e1cbb71f3b73f\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w0-6e535d/maas-trlp-rate-test-model-6e535d\"]}],\"name\":\"5cb9df2ee0b41392658cf057b9b2ffe6e4930d1563e8a7f6c6ab1031d63fadfb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w0-6e535d/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6d702678bda1dfc9e3eeb362adcee5bc69be4839840717fadfcf3f540bbad15d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_3_per_1m__92ec8fe3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"987e1cbb71f3b73f\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w0-6e535d/maas-trlp-rate-test-model-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_3_per_1m__92ec8fe3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"987e1cbb71f3b73f\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w0-6e535d/maas-trlp-rate-test-model-6e535d\"]}],\"name\":\"b1e277f37353cd054251831852bb78e2291ed67be834eaa674ba095e0c0b1264\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w0-6e535d/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6d702678bda1dfc9e3eeb362adcee5bc69be4839840717fadfcf3f540bbad15d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_3_per_1m__92ec8fe3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"987e1cbb71f3b73f\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w0-6e535d/maas-trlp-rate-test-model-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_3_per_1m__92ec8fe3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"987e1cbb71f3b73f\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w0-6e535d/maas-trlp-rate-test-model-6e535d\"]}],\"name\":\"8fa6481b148596f034f36126a1148d4e876f65cab7ab2c22e8309f69eed3f5e6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w0-6e535d/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6d702678bda1dfc9e3eeb362adcee5bc69be4839840717fadfcf3f540bbad15d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_3_per_1m__92ec8fe3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"987e1cbb71f3b73f\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w0-6e535d/maas-trlp-rate-test-model-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_3_per_1m__92ec8fe3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"987e1cbb71f3b73f\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w0-6e535d/maas-trlp-rate-test-model-6e535d\"]}],\"name\":\"1c83a08230b976a64359fcaa38c73f1092134a98abfd261b0a0e983288240fbe\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w0-6e535d/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"376d56a711fbb2b29d7c46a8a0998936174b738443f0db294a13f85fd8478a94\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"3aa9e48facd88e18a7acef348feeaf654a1d4310d58727df558a9c5543ced772\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"92c755f42520a16c18887562f8b0dd82ce78b0c009a03cf56621703050a4589e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_3_per_1m__92ec8fe3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"987e1cbb71f3b73f\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w0-6e535d/maas-trlp-rate-test-model-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_3_per_1m__92ec8fe3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"987e1cbb71f3b73f\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w0-6e535d/maas-trlp-rate-test-model-6e535d\"]}],\"name\":\"d12fa4436543a3b2a715a59028e9bbcdedf2bfa4d33e5c27caea8e8f135d2d7d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-a-w0-6e535d/models/facebook/opt-125m/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ad5aa9665d52830893fb4af1a6c52222eff28c5437dcf9fe501cab6f82aeaea0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_3_per_1m__92ec8fe3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"987e1cbb71f3b73f\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w0-6e535d/maas-trlp-rate-test-model-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_3_per_1m__92ec8fe3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"987e1cbb71f3b73f\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w0-6e535d/maas-trlp-rate-test-model-6e535d\"]}],\"name\":\"e60fb22206c792ce9f8ec11d2dec26ff03e0d0c5a065444e4feaadc5464259fd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-a-w0-6e535d/models/facebook/opt-125m/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"04ef5a9f5a54464f8dc13ab6c0af24178bef36e48dd84e92297e1f685bae9a8a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_3_per_1m__92ec8fe3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"987e1cbb71f3b73f\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w0-6e535d/maas-trlp-rate-test-model-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_3_per_1m__92ec8fe3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"987e1cbb71f3b73f\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w0-6e535d/maas-trlp-rate-test-model-6e535d\"]}],\"name\":\"012b2529dc0c67174c800fee5f91edf075d0342bcc0a68c2dac7fd3aa49f3ed1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-a-w0-6e535d/models/facebook/opt-125m/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"85484301f7aa6f30a87b224096575af8d7beea83a8ccf5091f246a4cb028e31b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_3_per_1m__92ec8fe3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"987e1cbb71f3b73f\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w0-6e535d/maas-trlp-rate-test-model-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_3_per_1m__92ec8fe3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"987e1cbb71f3b73f\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w0-6e535d/maas-trlp-rate-test-model-6e535d\"]}],\"name\":\"2fde3be1dada350e13a9c66ba760a7177a36793874c94f94f769b2f43eed0fd9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-a-w0-6e535d/models/facebook/opt-125m/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c5421eebe7da7086c1d4756a4f69af5cdd7ec596e7f07e8aff73f29facff31ae\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_3_per_1m__92ec8fe3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"987e1cbb71f3b73f\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w0-6e535d/maas-trlp-rate-test-model-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_3_per_1m__92ec8fe3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"987e1cbb71f3b73f\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w0-6e535d/maas-trlp-rate-test-model-6e535d\"]}],\"name\":\"c9cedf5779f7eb020123e9816fa4cef99bf41c50a438f1c1266eece5e2fbdd70\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cee3ed5de102b63f4fd0d549002d21484e590243e6bb220ff26d56c71481f262\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_3_per_1m__92ec8fe3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"987e1cbb71f3b73f\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w0-6e535d/maas-trlp-rate-test-model-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_3_per_1m__92ec8fe3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"987e1cbb71f3b73f\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w0-6e535d/maas-trlp-rate-test-model-6e535d\"]}],\"name\":\"074049f4a840cf6d99622f94a7e8ca0e1f97df70b22ad5930ef4fa6b52b3aff7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ccba7a9b1f6fb13d16375041d5707e71f92b68b4e5eb52e231100015ff08ef4b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_3_per_1m__92ec8fe3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"987e1cbb71f3b73f\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w0-6e535d/maas-trlp-rate-test-model-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_3_per_1m__92ec8fe3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"987e1cbb71f3b73f\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w0-6e535d/maas-trlp-rate-test-model-6e535d\"]}],\"name\":\"0e334bd7093caaec5fe41b4441bdc10c104d2459071931de5a9ca3b102885991\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"55a7427f941cf70e3504be7b1faaabc3224d15aa575a45663edd720843ebc89b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_3_per_1m__92ec8fe3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"987e1cbb71f3b73f\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w0-6e535d/maas-trlp-rate-test-model-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_3_per_1m__92ec8fe3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"987e1cbb71f3b73f\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w0-6e535d/maas-trlp-rate-test-model-6e535d\"]}],\"name\":\"83d39926bc1c01831f6febd115eb15e8b306d7de81a2887a54cef686a8291839\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-a-w0-6e535d/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ae47fb19c324c072c578abb0ac24ae029fef313aee06a65794451952fe00b10b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_3_per_1m__92ec8fe3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"987e1cbb71f3b73f\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w0-6e535d/maas-trlp-rate-test-model-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_3_per_1m__92ec8fe3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"987e1cbb71f3b73f\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w0-6e535d/maas-trlp-rate-test-model-6e535d\"]}],\"name\":\"00d2ac54d79d1c2237a41915b66be868a4c6c1750ae37f03a32476856535518c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"059aa363c4f5743984f4a4750b299221d4153361bba88fb44779ada6b736d06a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_3_per_1m__92ec8fe3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"987e1cbb71f3b73f\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w0-6e535d/maas-trlp-rate-test-model-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_3_per_1m__92ec8fe3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"987e1cbb71f3b73f\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w0-6e535d/maas-trlp-rate-test-model-6e535d\"]}],\"name\":\"0a4df11db71d8d8ba29534b591e0a04826bda9a98dfdc5c7bfe4f61f4e3f1a66\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"65ad30c331bd08b64f99c2bfc9d23db3979d37b9d3b916cb76d08a0dfabf963a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"4593350858282f0ebeaf11b57850d5bccfa270a4b6088784a058e2d70b5cbe7c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"71e8c9bf81b77581f96b1cca4bb909b8434efbbb06bf9c9ec1aa5c8f412b9c76\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"01c09092684d0d3ed9db0ad6f53595f8d2c97286804d29e76075f2c30f05f44e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c3ead856f0c0807270869b6a467d9281b93eaaa8c65e788c4b6393073db2cbe8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"7d0e9eabd4ff8a0b65212f3d03a7b14a1e695503c8c41fb7cd6e844984ba7c69\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8b7e784474461510a9d9970d39fe03c297fc6f9a5f80873c40898bdfcb389e5f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"3cb722466e22fc9e58ad8f75bb3dbd6e1d2f9d75c3cfaafc5c6350857d59f964\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7482755e6f782100b8480fa82045aac768a6400e192241b0d0cf93403dad8edb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"af29fffcd438904723a318f8c7cd8dbe79f55578faf5560452874252825fdf46\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d03cda72cd19a4be8449b91e7c0874bc3615d892fbc822ada2024e8c1dc8bd56\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_3_per_1m__92ec8fe3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"987e1cbb71f3b73f\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w0-6e535d/maas-trlp-rate-test-model-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_3_per_1m__92ec8fe3\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"987e1cbb71f3b73f\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w0-6e535d/maas-trlp-rate-test-model-6e535d\"]}],\"name\":\"efb649db4f32937f9904ced050f9327159e7fd80ed89d902f14f6c5f64e02971\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w0-6e535d/models/facebook/opt-125m')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-shared-a-w0-6e535d"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-shared-a-w0-6e535d\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:29:25.527Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-shared-b-w0-0f0874","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T21:56:34Z","generation":8,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"31926cb6-a222-454e-b0b0-713de52d3591\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:26:26Z"}],"name":"kuadrant-e2e-shared-b-w0-0f0874","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-b-w0-0f0874","uid":"31926cb6-a222-454e-b0b0-713de52d3591"}],"resourceVersion":"128196","uid":"1ec69299-baab-478d-87f9-565d3c2b35f2"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f4ecce895af38f9134e1fa20d5bd1e91c0c47aeb2d6d3a1ff49cf2e9138234bb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w0-0f0874-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f8d9f01e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c1dfb932f199420e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w0-0f0874/rate-test-model-0f0874-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w0-0f0874/maas-trlp-rate-test-model-0f0874\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f8d9f01e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c1dfb932f199420e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w0-0f0874/rate-test-model-0f0874-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w0-0f0874/maas-trlp-rate-test-model-0f0874\"]}],\"name\":\"f1bc3aa257839735b72d8e6c3fc144ec6c1dc73459fdb537837465575f18b2f0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w0-0f0874/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f4ecce895af38f9134e1fa20d5bd1e91c0c47aeb2d6d3a1ff49cf2e9138234bb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w0-0f0874-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f8d9f01e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c1dfb932f199420e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w0-0f0874/rate-test-model-0f0874-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w0-0f0874/maas-trlp-rate-test-model-0f0874\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f8d9f01e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c1dfb932f199420e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w0-0f0874/rate-test-model-0f0874-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w0-0f0874/maas-trlp-rate-test-model-0f0874\"]}],\"name\":\"d8fbe86009857df4fb0f15b9dc7d16106edc95c6c09d60d9704b7deda6d5a8dc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w0-0f0874/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f4ecce895af38f9134e1fa20d5bd1e91c0c47aeb2d6d3a1ff49cf2e9138234bb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w0-0f0874-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f8d9f01e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c1dfb932f199420e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w0-0f0874/rate-test-model-0f0874-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w0-0f0874/maas-trlp-rate-test-model-0f0874\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f8d9f01e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c1dfb932f199420e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w0-0f0874/rate-test-model-0f0874-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w0-0f0874/maas-trlp-rate-test-model-0f0874\"]}],\"name\":\"501e3c49e6d3b014ba2c82f0fa7dba2e612263311dd23a5db395600be7a2fa0e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w0-0f0874/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f4ecce895af38f9134e1fa20d5bd1e91c0c47aeb2d6d3a1ff49cf2e9138234bb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w0-0f0874-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f8d9f01e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c1dfb932f199420e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w0-0f0874/rate-test-model-0f0874-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w0-0f0874/maas-trlp-rate-test-model-0f0874\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f8d9f01e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c1dfb932f199420e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w0-0f0874/rate-test-model-0f0874-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w0-0f0874/maas-trlp-rate-test-model-0f0874\"]}],\"name\":\"811a4ae2ed6ad7c0d00e4abeb5e49157f80cba8fdc6e8a0166a6f8c4b0cd3d50\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w0-0f0874/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f4ecce895af38f9134e1fa20d5bd1e91c0c47aeb2d6d3a1ff49cf2e9138234bb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w0-0f0874-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f8d9f01e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c1dfb932f199420e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w0-0f0874/rate-test-model-0f0874-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w0-0f0874/maas-trlp-rate-test-model-0f0874\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f8d9f01e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c1dfb932f199420e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w0-0f0874/rate-test-model-0f0874-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w0-0f0874/maas-trlp-rate-test-model-0f0874\"]}],\"name\":\"4e18b3b277404341b1f3f8a1f2e88b2bccad66a2bafe785d441d53d3cd30e8d6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w0-0f0874/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f4ecce895af38f9134e1fa20d5bd1e91c0c47aeb2d6d3a1ff49cf2e9138234bb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w0-0f0874-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f8d9f01e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c1dfb932f199420e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w0-0f0874/rate-test-model-0f0874-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w0-0f0874/maas-trlp-rate-test-model-0f0874\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f8d9f01e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c1dfb932f199420e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w0-0f0874/rate-test-model-0f0874-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w0-0f0874/maas-trlp-rate-test-model-0f0874\"]}],\"name\":\"92f2538e085558d8f00827c96b1d83d7a1a116f5b5a334daea3b7bf07dbacdf1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w0-0f0874/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f4ecce895af38f9134e1fa20d5bd1e91c0c47aeb2d6d3a1ff49cf2e9138234bb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w0-0f0874-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f8d9f01e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c1dfb932f199420e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w0-0f0874/rate-test-model-0f0874-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w0-0f0874/maas-trlp-rate-test-model-0f0874\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f8d9f01e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c1dfb932f199420e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w0-0f0874/rate-test-model-0f0874-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w0-0f0874/maas-trlp-rate-test-model-0f0874\"]}],\"name\":\"9c8a528937a478bc313e96885bc764aaaede336f3dc69ae80cf82a9efa74a2f8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w0-0f0874/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f4ecce895af38f9134e1fa20d5bd1e91c0c47aeb2d6d3a1ff49cf2e9138234bb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w0-0f0874-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f8d9f01e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c1dfb932f199420e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w0-0f0874/rate-test-model-0f0874-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w0-0f0874/maas-trlp-rate-test-model-0f0874\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f8d9f01e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c1dfb932f199420e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w0-0f0874/rate-test-model-0f0874-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w0-0f0874/maas-trlp-rate-test-model-0f0874\"]}],\"name\":\"00d8410e86cde919cc54d629ea04ae8baafa390000182d77a74b7d789f990e13\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w0-0f0874/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4676855aaad0efd1f263930f7407a2242dda7211d0408fa3820678f475f20874\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w0-0f0874-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w0-0f0874\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w0-0f0874\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]}],\"name\":\"3d902dff08fca5c2bb562975c1b916ca54e6236ecd9cc50b17e3b37999d911ec\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"21c045f9fd9a65bcf44bc04d3fcb17d52c1649c95ac1f90f68dd01492045074d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w0-0f0874-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f8d9f01e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c1dfb932f199420e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w0-0f0874/rate-test-model-0f0874-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w0-0f0874/maas-trlp-rate-test-model-0f0874\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f8d9f01e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c1dfb932f199420e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w0-0f0874/rate-test-model-0f0874-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w0-0f0874/maas-trlp-rate-test-model-0f0874\"]}],\"name\":\"6cf428aaa2dc71ea4856915d0cf8ecb9c08a80b8c29c87129167bb4a16665606\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w0-0f0874/models/facebook/opt-125m/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a9353902ff809c3953ab78fb1a74b0913862deabf4e36537f31dcb1d590b46dd\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w0-0f0874-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f8d9f01e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c1dfb932f199420e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w0-0f0874/rate-test-model-0f0874-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w0-0f0874/maas-trlp-rate-test-model-0f0874\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f8d9f01e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c1dfb932f199420e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w0-0f0874/rate-test-model-0f0874-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w0-0f0874/maas-trlp-rate-test-model-0f0874\"]}],\"name\":\"a264dd02805fc8a51bfb8c936ffdd72847bb1765f3d110b85c2768f05443afda\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w0-0f0874/models/facebook/opt-125m/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"16fa7701b7d425ecd2db71ef9158baee753a6f3a0a2da1c3b4f412045e679280\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w0-0f0874-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f8d9f01e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c1dfb932f199420e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w0-0f0874/rate-test-model-0f0874-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w0-0f0874/maas-trlp-rate-test-model-0f0874\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f8d9f01e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c1dfb932f199420e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w0-0f0874/rate-test-model-0f0874-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w0-0f0874/maas-trlp-rate-test-model-0f0874\"]}],\"name\":\"c7c1315e1212de44796bf5db7a14d4bf708d97107808592385c87d499a709603\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w0-0f0874/models/facebook/opt-125m/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"357c492c00cb28b26cd246d2e8f1f9086e6b25af6c039d953442c5371d3cf70a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w0-0f0874-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f8d9f01e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c1dfb932f199420e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w0-0f0874/rate-test-model-0f0874-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w0-0f0874/maas-trlp-rate-test-model-0f0874\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f8d9f01e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c1dfb932f199420e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w0-0f0874/rate-test-model-0f0874-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w0-0f0874/maas-trlp-rate-test-model-0f0874\"]}],\"name\":\"568cea022b471d5eaa239580526cfeefce102b0cec4ada3f626ec119befa46e5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w0-0f0874/models/facebook/opt-125m/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3d0d554392a2c25a1ce426beeffb3f2b91339d1b96f1197bf10fe0af0ece726b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w0-0f0874-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f8d9f01e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c1dfb932f199420e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w0-0f0874/rate-test-model-0f0874-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w0-0f0874/maas-trlp-rate-test-model-0f0874\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f8d9f01e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c1dfb932f199420e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w0-0f0874/rate-test-model-0f0874-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w0-0f0874/maas-trlp-rate-test-model-0f0874\"]}],\"name\":\"f99dbb2a9ac7f9fc9844cb75aafb20b5d552a3fe21e1f4b30f1b8865af1a2e01\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w0-0f0874/rate-test-model-0f0874/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a7d80a75dae47b36245f18223c45bf04ddce116b33459885543e64da9d9d1caa\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w0-0f0874-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f8d9f01e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c1dfb932f199420e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w0-0f0874/rate-test-model-0f0874-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w0-0f0874/maas-trlp-rate-test-model-0f0874\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f8d9f01e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c1dfb932f199420e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w0-0f0874/rate-test-model-0f0874-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w0-0f0874/maas-trlp-rate-test-model-0f0874\"]}],\"name\":\"db7b53871bc91c6ddf70340603a084050527e534b60cb2e7eb69efbfcfb1e081\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w0-0f0874/rate-test-model-0f0874/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"723ff56478b245706677de5d534bdca6f79a45abce147a872b1386591bf44cbc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w0-0f0874-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f8d9f01e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c1dfb932f199420e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w0-0f0874/rate-test-model-0f0874-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w0-0f0874/maas-trlp-rate-test-model-0f0874\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f8d9f01e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c1dfb932f199420e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w0-0f0874/rate-test-model-0f0874-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w0-0f0874/maas-trlp-rate-test-model-0f0874\"]}],\"name\":\"f8599e7c124b062def0c7f7b83f725b8b8b86d8000adde8e833fa8e8a1c8a89e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w0-0f0874/rate-test-model-0f0874/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aa5865acb61f14eec3bcbdde417b12bdef516ceb89d09786d23726919283c8f2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w0-0f0874-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f8d9f01e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c1dfb932f199420e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w0-0f0874/rate-test-model-0f0874-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w0-0f0874/maas-trlp-rate-test-model-0f0874\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f8d9f01e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c1dfb932f199420e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w0-0f0874/rate-test-model-0f0874-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w0-0f0874/maas-trlp-rate-test-model-0f0874\"]}],\"name\":\"baf642a38aa57280d122507d48e7cfc1d62e2620535e10a5d7de792c7096c527\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w0-0f0874/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"52afa67a4bb23da81788fa24144b809f70c5f20786bfc6a5c4e8bd0929485ee9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w0-0f0874-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f8d9f01e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c1dfb932f199420e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w0-0f0874/rate-test-model-0f0874-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w0-0f0874/maas-trlp-rate-test-model-0f0874\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f8d9f01e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c1dfb932f199420e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w0-0f0874/rate-test-model-0f0874-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w0-0f0874/maas-trlp-rate-test-model-0f0874\"]}],\"name\":\"5481bcc99b8eeb7759308383657544eda564adc03da5ca68cd69c71dbfd8a28d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w0-0f0874/rate-test-model-0f0874/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"48e95544e68fc50e4e4e36c8679af44644ecbfb2cf7df51e27a09f30472eda9e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w0-0f0874-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f8d9f01e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c1dfb932f199420e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w0-0f0874/rate-test-model-0f0874-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w0-0f0874/maas-trlp-rate-test-model-0f0874\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f8d9f01e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c1dfb932f199420e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w0-0f0874/rate-test-model-0f0874-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w0-0f0874/maas-trlp-rate-test-model-0f0874\"]}],\"name\":\"90b0838419e2a311bf6b3855ddc020bbf7d7271cde3a73842e21b6e4ec9238a3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w0-0f0874/rate-test-model-0f0874')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8ccf868b0c716a18e90e502ebb2284ce90d5ee3fcd5779be4d996fb8a3d03b43\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w0-0f0874-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w0-0f0874\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w0-0f0874\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]}],\"name\":\"e51fac9c5a01bb319b1deb20eaa60eeb3cb0f05fa44b2dfb2cac5ec6b7cbd8fd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"848b20842f79c8cc02bec7966c894853251e29e5c14c8a4cff729041c180e15c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w0-0f0874-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w0-0f0874\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w0-0f0874\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]}],\"name\":\"a73356366d107cd5992220a58c6f2b0f6bf70196a187bc3534c68088f7abd636\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b0dda7ce592fb57a979446129e21c491a217f4c5c9a704c19a519ee42c367e92\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w0-0f0874-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w0-0f0874\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w0-0f0874\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]}],\"name\":\"098f7ba551981a4029ff8c66c0d0234e632f325a01b723001668c0e56481bd87\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6e2c4c40ad28f1eeda9eca533706722536247311f5ede5be2cbe544e374719a6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w0-0f0874-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w0-0f0874\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w0-0f0874\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]}],\"name\":\"fd25786cbc9657425a1956e65052da9d0b96f50c6eca843a1c5af4671e05425e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ffaef4e77ab77e038e2181351f7ed710141739ce5f70351bf42c0606b9215e72\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w0-0f0874-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w0-0f0874\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w0-0f0874\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]}],\"name\":\"d6fb22990981f2cd0325455675dc804fada0a031b35d72d782173400f3a24d44\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"27c00f1160fee4edb42d2d932daa50752238a681b270e486550b0ccd674d7682\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w0-0f0874-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f8d9f01e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c1dfb932f199420e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w0-0f0874/rate-test-model-0f0874-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w0-0f0874/maas-trlp-rate-test-model-0f0874\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_100_per_1m__f8d9f01e\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"c1dfb932f199420e\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w0-0f0874/rate-test-model-0f0874-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w0-0f0874/maas-trlp-rate-test-model-0f0874\"]}],\"name\":\"afe57c20bcdcfe6cfb91f1003faa4368930cd0de9220bbf32c7c1fb390213c99\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w0-0f0874/models/facebook/opt-125m')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-shared-b-w0-0f0874"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-shared-b-w0-0f0874\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:29:25.699Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-a-w0-6e535d","namespace":"openshift-ingress","uid":"0eae774a-4032-4461-b2be-6f3edd911a80","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-a-w0-6e535d\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:29:25.756Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-a-w4-7cde84","namespace":"openshift-ingress","uid":"83e46bfa-f121-4136-adc9-a9e6690edeab","error":"tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-a-w4-7cde84\" not found"}
{"level":"error","ts":"2026-11-02T22:29:25.777Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-a-w0-6e535d-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-a-w0-6e535d-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:29:25.874Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-rate-test-model-0f0874","namespace":"ai-tenant-e2e-shared-b-w0-0f0874","uid":"7ed62117-0e2d-4962-9413-f43b21b067ff","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-rate-test-model-0f0874\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:29:26.048Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-b-w0-0f0874-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-b-w0-0f0874-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:29:26.049Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-b-w0-0f0874","namespace":"openshift-ingress","uid":"8b4ec7cb-daa9-467a-b2f6-528aa3d837fc","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-b-w0-0f0874\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:29:26.183Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-worker-w2-6fa533-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-worker-w2-6fa533-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:29:26.250Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-worker-w1-5f765a-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-worker-w1-5f765a-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:29:26.287Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w1-5f765a","namespace":"e2e-models-e2e-worker-w1-5f765a","uid":"7188eadc-9748-4be8-a5e2-d904cf5b6130","error":"tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w1-5f765a\" not found"}
{"level":"error","ts":"2026-11-02T22:29:26.522Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w2-6fa533","namespace":"e2e-models-e2e-worker-w2-6fa533","uid":"2ff73667-c2c3-4579-9503-b6ca098f1021","error":"tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w2-6fa533\" not found"}
{"level":"error","ts":"2026-11-02T22:29:26.523Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-a-w4-7cde84-maas-auth","namespace":"openshift-ingress","error":"authpolicies.kuadrant.io \"e2e-shared-a-w4-7cde84-maas-auth\" not found"}
{"level":"error","ts":"2026-11-02T22:29:26.702Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-rate-test-model-6e535d","namespace":"ai-tenant-e2e-shared-a-w0-6e535d","uid":"ef045d39-e1ce-48de-b7b4-3a01035ea0ed","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-rate-test-model-6e535d\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:29:26.938Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w2-6fa533","namespace":"e2e-models-e2e-worker-w2-6fa533","uid":"3a128bb2-de88-49aa-ab9e-c8626107a077","error":"tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w2-6fa533\" not found"}
{"level":"info","ts":"2026-11-02T22:29:27.176Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T22:29:27.176Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T22:29:27.241Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"rate-test-model-0f0874-kserve-route","namespace":"ai-tenant-e2e-shared-b-w0-0f0874","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"rate-test-model-0f0874-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:29:27.725Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"rate-test-model-6e535d-kserve-route","namespace":"ai-tenant-e2e-shared-a-w0-6e535d","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"rate-test-model-6e535d-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:29:27.752Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"data-science-gateway","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"data-science-gateway\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:29:27.811Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-b-w3-a1d751","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-shared-b-w3-a1d751\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:29:27.928Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-a-w4-7cde84","error":"gateways.gateway.networking.k8s.io \"e2e-shared-a-w4-7cde84\" not found"}
{"level":"info","ts":"2026-11-02T22:29:32Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-shared-b-w4-58ca7f","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-b-w4-58ca7f","reconcileID":"4b0cb374-efef-4388-b84e-fb74cc37b43a","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-shared-b-w4-58ca7f","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T22:29:33Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-b-w4-58ca7f","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T22:29:33Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T22:29:33Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-11-02T22:29:33Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T22:29:33Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-11-02T22:29:33Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-shared-b-w4-58ca7f","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-b-w4-58ca7f","reconcileID":"4b0cb374-efef-4388-b84e-fb74cc37b43a","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-shared-b-w4-58ca7f","namespace":"openshift-ingress"}
{"level":"error","ts":"2026-11-02T22:29:33Z","logger":"telemetry-policy-extension-controller","msg":"Reconciler error","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-shared-b-w4-58ca7f","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-b-w4-58ca7f","reconcileID":"7a943624-cb68-4062-9d03-3f9dcee6332b","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-shared-b-w4-58ca7f\" not found","stacktrace":"sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:353\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-02T22:29:33Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-b-w4-58ca7f","event":"DELETE"}
{"level":"info","ts":"2026-11-02T22:29:33Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-02T22:29:33Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-shared-b-w4-58ca7f\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-02T22:29:33Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T22:29:34Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-worker-w2-6fa533","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-worker-w2-6fa533","reconcileID":"11004201-5a46-4170-af1f-ff22b62af70e","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-worker-w2-6fa533","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T22:29:34Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-worker-w2-6fa533","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T22:29:34Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T22:29:34Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-11-02T22:29:34Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T22:29:34Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-11-02T22:29:34Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-worker-w2-6fa533","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-worker-w2-6fa533","reconcileID":"11004201-5a46-4170-af1f-ff22b62af70e","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-worker-w2-6fa533","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T22:29:34Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-worker-w2-6fa533","event":"DELETE"}
{"level":"info","ts":"2026-11-02T22:29:34Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-02T22:29:34Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-worker-w2-6fa533\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-02T22:29:34Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T22:29:35Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-worker-w1-5f765a","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-worker-w1-5f765a","reconcileID":"6882883d-e3a6-4416-a6b5-a1a593e94bbc","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-worker-w1-5f765a","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T22:29:35Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-worker-w1-5f765a","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T22:29:35Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T22:29:35Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-11-02T22:29:35Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T22:29:35Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-11-02T22:29:35Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-worker-w1-5f765a","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-worker-w1-5f765a","reconcileID":"6882883d-e3a6-4416-a6b5-a1a593e94bbc","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-worker-w1-5f765a","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T22:29:35Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-worker-w1-5f765a","event":"DELETE"}
{"level":"info","ts":"2026-11-02T22:29:35Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-02T22:29:35Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-worker-w1-5f765a\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-02T22:29:35Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T22:29:38.448Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthPolicy","EnvoyFilter","ConfigMap","Gateway","HTTPRoute","TokenRateLimitPolicy","Limitador","Kuadrant","AuthConfig"],"eventTypes":{"create":1,"delete":22,"update":17}}
{"level":"info","ts":"2026-11-02T22:29:38.704Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:29:38.744Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T22:29:41.825Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T22:29:41.941Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T22:29:42.023Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:29:42.023Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T22:29:42.037Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:29:45.931Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:29:45.932Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:29:45.938Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T22:29:45.939Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:29:45.944Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:29:45.944Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-02T22:29:46.040Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to delete envoyfilter object","envoyfilter":"openshift-ingress/kuadrant-ratelimiting-e2e-shared-b-w4-58ca7f","error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-shared-b-w4-58ca7f\" not found"}
{"level":"info","ts":"2026-11-02T22:29:46.048Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T22:29:46.083Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to delete envoyfilter object","envoyfilter":"openshift-ingress/kuadrant-auth-e2e-shared-b-w4-58ca7f","error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-shared-b-w4-58ca7f\" not found"}
{"level":"error","ts":"2026-11-02T22:29:47.458Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to delete envoyfilter object","gateway":"openshift-ingress/e2e-shared-b-w4-58ca7f","envoyfilter":"openshift-ingress/kuadrant-e2e-shared-b-w4-58ca7f","error":"envoyfilters.networking.istio.io \"kuadrant-e2e-shared-b-w4-58ca7f\" not found"}
{"level":"error","ts":"2026-11-02T22:29:57.814Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-a-w3-97995b-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-a-w3-97995b-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:29:57.851Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-worker-w1-5f765a","namespace":"openshift-ingress","uid":"61d218f4-e9a7-4418-a32d-90a2c51e6642","error":"tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-worker-w1-5f765a\" not found"}
{"level":"error","ts":"2026-11-02T22:29:57.923Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-worker-w1-5f765a-maas-auth","namespace":"openshift-ingress","error":"authpolicies.kuadrant.io \"e2e-worker-w1-5f765a-maas-auth\" not found"}
{"level":"error","ts":"2026-11-02T22:29:58.273Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-worker-w2-6fa533-maas-auth","namespace":"openshift-ingress","error":"authpolicies.kuadrant.io \"e2e-worker-w2-6fa533-maas-auth\" not found"}
{"level":"error","ts":"2026-11-02T22:29:58.340Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-worker-w4-d6cb38-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-worker-w4-d6cb38-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:29:58.528Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w4-d6cb38","namespace":"e2e-models-e2e-worker-w4-d6cb38","uid":"486176e6-7786-40c4-9ce0-6f4a68b408b2","error":"tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w4-d6cb38\" not found"}
{"level":"error","ts":"2026-11-02T22:29:58.567Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-b-w4-58ca7f-maas-auth","namespace":"openshift-ingress","error":"authpolicies.kuadrant.io \"e2e-shared-b-w4-58ca7f-maas-auth\" not found"}
{"level":"error","ts":"2026-11-02T22:29:58.585Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-rate-test-model-0f0874","namespace":"ai-tenant-e2e-shared-b-w0-0f0874","uid":"7ed62117-0e2d-4962-9413-f43b21b067ff","error":"tokenratelimitpolicies.kuadrant.io \"maas-trlp-rate-test-model-0f0874\" not found"}
{"level":"info","ts":"2026-11-02T22:29:58.771Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T22:29:58.771Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T22:29:58.828Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-b-w4-58ca7f","error":"gateways.gateway.networking.k8s.io \"e2e-shared-b-w4-58ca7f\" not found"}
{"level":"error","ts":"2026-11-02T22:29:58.883Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"distinct-w2-6fa533-kserve-route","namespace":"e2e-models-e2e-worker-w2-6fa533","error":"httproutes.gateway.networking.k8s.io \"distinct-w2-6fa533-kserve-route\" not found"}
{"level":"error","ts":"2026-11-02T22:29:58.982Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"premium-w2-6fa533-kserve-route","namespace":"e2e-models-e2e-worker-w2-6fa533","error":"httproutes.gateway.networking.k8s.io \"premium-w2-6fa533-kserve-route\" not found"}
{"level":"error","ts":"2026-11-02T22:29:59.079Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"simulator-w1-5f765a-kserve-route","namespace":"e2e-models-e2e-worker-w1-5f765a","error":"httproutes.gateway.networking.k8s.io \"simulator-w1-5f765a-kserve-route\" not found"}
{"level":"error","ts":"2026-11-02T22:29:59.127Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-worker-w1-5f765a","error":"gateways.gateway.networking.k8s.io \"e2e-worker-w1-5f765a\" not found"}
{"level":"error","ts":"2026-11-02T22:29:59.149Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"distinct-2-w2-6fa533-kserve-route","namespace":"e2e-models-e2e-worker-w2-6fa533","error":"httproutes.gateway.networking.k8s.io \"distinct-2-w2-6fa533-kserve-route\" not found"}
{"level":"error","ts":"2026-11-02T22:29:59.266Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"simulator-w2-6fa533-kserve-route","namespace":"e2e-models-e2e-worker-w2-6fa533","error":"httproutes.gateway.networking.k8s.io \"simulator-w2-6fa533-kserve-route\" not found"}
{"level":"error","ts":"2026-11-02T22:29:59.485Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"rate-test-model-6e535d-kserve-route","namespace":"ai-tenant-e2e-shared-a-w0-6e535d","error":"httproutes.gateway.networking.k8s.io \"rate-test-model-6e535d-kserve-route\" not found"}
{"level":"error","ts":"2026-11-02T22:29:59.543Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-a-w0-6e535d","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-shared-a-w0-6e535d\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:29:59.598Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-worker-w2-6fa533","error":"gateways.gateway.networking.k8s.io \"e2e-worker-w2-6fa533\" not found"}
{"level":"error","ts":"2026-11-02T22:29:59.623Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"premium-w1-5f765a-kserve-route","namespace":"e2e-models-e2e-worker-w1-5f765a","error":"httproutes.gateway.networking.k8s.io \"premium-w1-5f765a-kserve-route\" not found"}
{"level":"info","ts":"2026-11-02T22:30:00.067Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Kuadrant","Gateway","TokenRateLimitPolicy","HTTPRoute"],"eventTypes":{"delete":7,"update":4}}
{"level":"info","ts":"2026-11-02T22:30:00.216Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:30:00.237Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T22:30:03.242Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T22:30:03.438Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:30:03.438Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T22:30:03.523Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:30:03.531Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T22:30:06.976Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:30:07.023Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:30:07.024Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:30:07.026Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:30:07.026Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T22:30:07.031Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"error","ts":"2026-11-02T22:30:07.078Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to delete envoyfilter object","envoyfilter":"openshift-ingress/kuadrant-ratelimiting-e2e-worker-w2-6fa533","error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-worker-w2-6fa533\" not found"}
{"level":"error","ts":"2026-11-02T22:30:07.132Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to delete envoyfilter object","envoyfilter":"openshift-ingress/kuadrant-auth-e2e-shared-b-w4-58ca7f","error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-shared-b-w4-58ca7f\" not found"}
{"level":"error","ts":"2026-11-02T22:30:07.135Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:30:07.135Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T22:30:07.142Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-02T21:22:56Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:24:53Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:24:53Z"}],"name":"f1edf5f89fd287762fbbefa668581cdc8f1877a3f31497227c537000670166d9","namespace":"kuadrant-system","resourceVersion":"32290","uid":"eae88240-25dc-4250-a071-53e278bfc1b1"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f1edf5f89fd287762fbbefa668581cdc8f1877a3f31497227c537000670166d9"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:22:56Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:22:56Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["f1edf5f89fd287762fbbefa668581cdc8f1877a3f31497227c537000670166d9"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"f1edf5f89fd287762fbbefa668581cdc8f1877a3f31497227c537000670166d9\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:07.185Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to delete envoyfilter object","envoyfilter":"openshift-ingress/kuadrant-ratelimiting-e2e-shared-b-w4-58ca7f","error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-shared-b-w4-58ca7f\" not found"}
{"level":"error","ts":"2026-11-02T22:30:07.204Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-02T21:24:06Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:24:51Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:24:52Z"}],"name":"8309dc44d5088e48040255bf86dbc622de08fc216837cd0027a69bdf179a9d2a","namespace":"kuadrant-system","resourceVersion":"32205","uid":"34f78ee4-5b76-4995-ae3b-70dcc117049c"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["8309dc44d5088e48040255bf86dbc622de08fc216837cd0027a69bdf179a9d2a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:24:06Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:24:06Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["8309dc44d5088e48040255bf86dbc622de08fc216837cd0027a69bdf179a9d2a"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"8309dc44d5088e48040255bf86dbc622de08fc216837cd0027a69bdf179a9d2a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:07.265Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-02T21:26:25Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:26:25Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:26:25Z"}],"name":"371e486415502802484cc345e68be13e0a37a1abb38f2f6c8cce9f8e79b8d9c1","namespace":"kuadrant-system","resourceVersion":"34592","uid":"8c70ad08-c1db-4f91-b3e6-5abc40d12251"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["371e486415502802484cc345e68be13e0a37a1abb38f2f6c8cce9f8e79b8d9c1"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:26:25Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:26:25Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["371e486415502802484cc345e68be13e0a37a1abb38f2f6c8cce9f8e79b8d9c1"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"371e486415502802484cc345e68be13e0a37a1abb38f2f6c8cce9f8e79b8d9c1\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:07.326Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-02T21:27:22Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:27:22Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:27:22Z"}],"name":"39a9f89f974929e5c36b7ca16af0fe122642ef82605ca091ecae9f1aab1c8c39","namespace":"kuadrant-system","resourceVersion":"35782","uid":"7a19f8b0-5be3-4ad2-acbe-bbee302eeb55"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["39a9f89f974929e5c36b7ca16af0fe122642ef82605ca091ecae9f1aab1c8c39"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-5f765a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-5f765a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:27:22Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:27:22Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["39a9f89f974929e5c36b7ca16af0fe122642ef82605ca091ecae9f1aab1c8c39"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"39a9f89f974929e5c36b7ca16af0fe122642ef82605ca091ecae9f1aab1c8c39\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:07.423Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-02T21:22:55Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:24:52Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:24:52Z"}],"name":"319a8bd03b55a51284dd6790058e026879ed8db3e6d527dedb4a9314473afa5b","namespace":"kuadrant-system","resourceVersion":"32230","uid":"1487d295-adda-413d-8f22-3359facea285"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["319a8bd03b55a51284dd6790058e026879ed8db3e6d527dedb4a9314473afa5b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:22:55Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:22:55Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["319a8bd03b55a51284dd6790058e026879ed8db3e6d527dedb4a9314473afa5b"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"319a8bd03b55a51284dd6790058e026879ed8db3e6d527dedb4a9314473afa5b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:07.536Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-worker-w1-5f765a","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T21:22:08Z","generation":13,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"4caf3c5b-8145-48de-a05b-6a1b9a102f00\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:30:18Z"}],"name":"kuadrant-e2e-worker-w1-5f765a","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-worker-w1-5f765a","uid":"4caf3c5b-8145-48de-a05b-6a1b9a102f00"}],"resourceVersion":"40809","uid":"fb3e4914-c809-4feb-81f5-a0a468b56725"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bcf0aab5299349f1dd1df89a10a558ad5617afdfb0f30d972811f3dbb51b1ea5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"f2c753e74bbc5983406d967abd1143e62400e0f08a2e36f6ffa42c06a3a6974c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/simulator-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"db6f9ff18eeb49f1421400a53d101cb100b1a88466190b46fb6dbed22a42e073\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"eedd7a1bac5c7747d7137dccbdafefbc4f76edb1acf806e0399e7d01c0c93443\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/premium-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0623abc228b11818faa4a08b26d906ef498cb9511f2bcee2bcd7c9e8dbb0a23a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"0a44edd91442d2ddfe39cb24e50368dfc1e81bad179d3235d38e40f25e9d22ae\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"99ce90aab60d81af668145560f9879cd2b5941652fd3e18c3d45856709a0948e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"91d7b5395adff9d28bf7ef05c8e81f9bd73a716e4072d28f8624ff5f9381a8fe\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-2-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bcf0aab5299349f1dd1df89a10a558ad5617afdfb0f30d972811f3dbb51b1ea5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"76a34f19bf7079dd4104caff1731257297b843b61401a91d00b1a27ccab63fd7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/simulator-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"db6f9ff18eeb49f1421400a53d101cb100b1a88466190b46fb6dbed22a42e073\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"263fa7af352a917ec5f565f1287ed3339005bf0c3ba787dcb8a5e539d84cfaff\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/premium-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0623abc228b11818faa4a08b26d906ef498cb9511f2bcee2bcd7c9e8dbb0a23a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"e78483f4191a6de2a454384113672ed5dcab6ca23c10f3e5052c523e46b7a77c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"99ce90aab60d81af668145560f9879cd2b5941652fd3e18c3d45856709a0948e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"601fd1e14b5e1e1044cd1ad2841f6c4703624cbd2a380dedacb373ba7867c1eb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-2-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bcf0aab5299349f1dd1df89a10a558ad5617afdfb0f30d972811f3dbb51b1ea5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"3451d924df135b44fe4e7857db1417971e78cee0d322dc55f2d9dcfc1a98438c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/simulator-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"db6f9ff18eeb49f1421400a53d101cb100b1a88466190b46fb6dbed22a42e073\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"c12741fd641c86bf88bbd47e58d2e5d62933e3e0f320cf13ec7d52df7a394c29\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/premium-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0623abc228b11818faa4a08b26d906ef498cb9511f2bcee2bcd7c9e8dbb0a23a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"7d42ed92cf0df2b010ce6bb7fe8510b6b214aa6493d82bbe3bdd85788b9ced2d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"99ce90aab60d81af668145560f9879cd2b5941652fd3e18c3d45856709a0948e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"89e9e9283f23750b835cfc41e1a3e8f29103f8fe9ceff7e9517fedfa07286e72\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-2-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bcf0aab5299349f1dd1df89a10a558ad5617afdfb0f30d972811f3dbb51b1ea5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"70ba0b522bbd69a6ed9f77952d20b92d482b03854cc92dbb7d522bd33335c96d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/simulator-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"db6f9ff18eeb49f1421400a53d101cb100b1a88466190b46fb6dbed22a42e073\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"65d2403634b5ea32b46b6ea0b85de94e33a3af4a2416095b99fbdb18350add91\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/premium-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0623abc228b11818faa4a08b26d906ef498cb9511f2bcee2bcd7c9e8dbb0a23a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"f16ad623eef6c3389dd02c8e5699fc3224f733fcfdf7f5e04c94d15bb259d565\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"99ce90aab60d81af668145560f9879cd2b5941652fd3e18c3d45856709a0948e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"31f5ec2b96aaa4e6b31984c22b75d9d621a704605d13ed2d59121449937c911d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-2-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bcf0aab5299349f1dd1df89a10a558ad5617afdfb0f30d972811f3dbb51b1ea5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"ba40310e6c4dc6ab4a0b4c712eda89883762afc9beb70d4b7c23b27f69b9ab49\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/simulator-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"db6f9ff18eeb49f1421400a53d101cb100b1a88466190b46fb6dbed22a42e073\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"bd657b2cf110d146eb81bf7b91f3184e0028cf98e5195ef2ddb8f508863741de\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/premium-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0623abc228b11818faa4a08b26d906ef498cb9511f2bcee2bcd7c9e8dbb0a23a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"2f0dfd729a81441e924bd38747be17f316e3b9b9e9528ea0a39238207dd25e7f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"99ce90aab60d81af668145560f9879cd2b5941652fd3e18c3d45856709a0948e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"d373660753c800ef6dc88aa9dcf376944988375525f3908104ef1f83260983ff\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-2-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bcf0aab5299349f1dd1df89a10a558ad5617afdfb0f30d972811f3dbb51b1ea5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"d637ac7d402bcd26ac6f88370d996d05abc8c7982ed2c2cc4095675044806a8e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/simulator-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bcf0aab5299349f1dd1df89a10a558ad5617afdfb0f30d972811f3dbb51b1ea5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"30abcde41a2149187abd00b7dbf1da4982d5f53b5da1288f5b95a0d579abbd6a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/simulator-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"db6f9ff18eeb49f1421400a53d101cb100b1a88466190b46fb6dbed22a42e073\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"e253a93d7a1e997f4ec04774e63bac26b7573119884a469fa9cadfdd694f2c86\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/premium-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"db6f9ff18eeb49f1421400a53d101cb100b1a88466190b46fb6dbed22a42e073\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"857e58268f515ca3e78ba5dd4b121c1c64a1556ffa6fb72ca451501f13fd956c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/premium-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0623abc228b11818faa4a08b26d906ef498cb9511f2bcee2bcd7c9e8dbb0a23a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"d6e34b9866f1888f862664b06edada2fc5b06428a00da8529b16758a3eda81bd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0623abc228b11818faa4a08b26d906ef498cb9511f2bcee2bcd7c9e8dbb0a23a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"d8a7afed6f125f1efe48eb9763d5f6da06382ed5c648453e53d16207a819a353\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"99ce90aab60d81af668145560f9879cd2b5941652fd3e18c3d45856709a0948e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"4e6de9db11e4f53c670f806b7f8fa9eef7623d7a93fac0088e6bc4808c690024\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-2-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"99ce90aab60d81af668145560f9879cd2b5941652fd3e18c3d45856709a0948e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"e4a3e27b6d899463b5db743e92f4f3eea337802f422e60f3725234174543f7ad\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-2-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bcf0aab5299349f1dd1df89a10a558ad5617afdfb0f30d972811f3dbb51b1ea5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"c06ce02686be6c949fde11dd46005249ce969a6a4cd5979e062f2fd0e328306e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/simulator-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"db6f9ff18eeb49f1421400a53d101cb100b1a88466190b46fb6dbed22a42e073\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"a5c2e2f330e8d4b7f1cc2fd43eb290bf161724714abfed900324fd2909e2a064\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/premium-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0623abc228b11818faa4a08b26d906ef498cb9511f2bcee2bcd7c9e8dbb0a23a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"f32d2c346b05e35d553dca7fe2805eee4c7886686071be499c78e95d284e8bd5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"99ce90aab60d81af668145560f9879cd2b5941652fd3e18c3d45856709a0948e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"6f1d479dd9b2c444c7bbd9d0b29aa4d86c30e494765ff79074f52d3018d29503\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-2-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8614fe473acb7380c1bbcefbfc7ddc49bdb08a20998450fd852a13de53bb8a12\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"5340f589ec7e8ec67c1190312eeca907b744df43dafe4398f0722d074bfb32b9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-2-w1-5f765a/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"58ba249888c7ebfedfcb5aec9df19d4b07d2856710ac2163dcc961a176311fa9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"4d61c78710f351b5667f692e1f8792c5724b52f7fc998511134665312fdd896f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/simulator-w1-5f765a/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9fa5392cc7c0130bb8596420fcb1a79f07b3d804fb9e4de459f680cdcfd5dcfc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"b1d7cdd38dbaf49bd08c0343391886f319979629ab66d478079771f78f733a35\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-w1-5f765a/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2aaf9242e876623422852fe471269a2d268f4d784b14c7ab37ec9f34c17f3060\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"f201dec897e559ed36b9a30f0bbf86c43aae129e674ef36595083bda93e4b839\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/premium-w1-5f765a/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"36a5aec7d5b7178c754711c0ad90ec391fbc4764ff98bc952ff9d4d46a3e1fad\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"e1ac9296595d90737d084f76147f4acec9440f2802b7b4ad18409fe9de33bb5e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-2-w1-5f765a/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c19827aa458f939a86c4dbefda3dabc4f554898dbb7e2f92b488060e9e90b5cc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"6d546403540eabf244c73a602659986050165bca90bc795de701a61411a1c48e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/simulator-w1-5f765a/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"922492b3fb118d2a03b9019d5fd7a1e7fc6f7f5e4559c5e1a0ef89b6f41e6c00\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"5cbb9e2f75cce25ddb3c2b6eb86ac94a59b3619ba9df40d1b5dd3580109ca3cc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-w1-5f765a/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"37f7dad0ca5234ce11642187ba11e681aa288a9b2a62a6d47b06de5fa5c385ed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"ec08733aeb0db1141aa8a8a511c7859111cf54e374fddf2e382a4616e38a9f7d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-2-w1-5f765a/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"784ccec783ba11c98817fe5af2849f9f4970be19046e351a067c85add913f548\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"9327d3b7df136b8c0fed4aaa35057ac8d1022305472875ccc8c55a524105fb1a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/simulator-w1-5f765a/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"beb0d5e916dc078abcaba4ea5b4d8012d5c2d8edfd07ca54d585bfe44d7c605a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"8cff0046c214e842687a3a284fe4fabc8a45eb2579168ac47aa1b4908bd95fc4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/premium-w1-5f765a/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"39a9f89f974929e5c36b7ca16af0fe122642ef82605ca091ecae9f1aab1c8c39\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"633ba07e8fd8d505f7f6918d4c95117ed7435ee10e97f4b5b67ea8fb88d406a9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-2-w1-5f765a/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5bc63b4c1a02d51f1462172790f7018aec7db9fb8a2a61024ca7c15aac9065b4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"2bdf38e0b22608328672d2ed39e7a6336f89c14fb615a48fda4a36a65c185b32\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/simulator-w1-5f765a/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6ceeddb720a82c7a3a1051f6517a47c73f8528f97b9e67d8dd2f7dd9419967e1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"73c4b3ba76c71b5ac2b369625b3de4081ddfaca2a924b7a8741f70090acba47b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-w1-5f765a/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b8fb7aae7cac121f592817a5e9754983e04e46d9e4226183153bf83b778fffdd\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"b288a64704f96ac78878f6909232d8598eef54cca0d7adc2629cac87b6802414\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/premium-w1-5f765a/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8f0923ad4223ef053267784d904817130eaaaa279092e9f9f1500d0325c2e6a7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"127ad269f06b6d28319f2bb527c4cb8c00c67080e95ba7a4c5aae51849cf6881\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-w1-5f765a/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9f6fc629fa43de74b0fb261de7e8b46fbdfe4f21235446879cd916210856d6f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"3345e3b0c95bd559e9c6ce41f622270b0d9eed1deb3d862eb2d4fad368905626\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/premium-w1-5f765a/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4afb168c7cbb67555e268bc246b8eeeba53cda69691eb181663c1375ab099775\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"c917df68cc69647c025db7eb577471c675040ae5aa7ec4537927ac6f148031ea\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-2-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"719394d8154dd624eedc306180a33baa4128531f223bc2727d0376601dd634f6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"94c5946d9d9c3cc245ba073b8c7a87c64029cba185e4d624d2145ef119722e87\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/simulator-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6cbb9b4408bb48fa5c471c9684ef41f50ebbc4e85135af89ff2781ab48666f2a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"7aaa0a43baf33eeaf52534a90f734bbc375ee8f202c1994adc991d076f599c57\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"796ce8085bd3851fe6a6d0c9b4c29504c70e44da1ae3ea663bfc85d308b1e5b1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"d7eb7b84f6936309cd84db740a6f755286a5345ec159a7046e2c3f3126780262\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4139e076413d5d9d1fd2b594b83d854cc771dfa28886f3f67439ec043220dd9f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"0b53b3ab98bfc66b662cb3ccde6535694ee9e681e165e011925491f011e74e55\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"505545a95fce131db80f848e9990387e6b3e42a2f7e2375f56bbc07efcac9723\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"3f3727d24e2cdb2256f9ce1aa9d7daf02e123ff83dd7745a54bf0be968b8f9fd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/premium-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bd641664cfab5eecac33b1ff0c46f78597ed896bbc4c7a81487d56141be11715\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"c6d9f4f268ffd7b969efc4b42666a18e7b4e74fa0efcee36ff06291b64cdd07f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9112a3b536f3eb5f79a5b52d0ee8a7a26d3700b295f3ce2775128d2841f01ff4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"f08d8256a9bbcb38779e30702529b4c292d4f2775e4ae9817b47fa8337570bcb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ddbb47f4f9dda290c11f442f07feec9b2e64a236ec2c98dd4fb16a3796302ba3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"fb5e9f944ff60517f890fed5aa51a590589ee84870b6b00ffb1d187e035ed1c3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0768841c9057075fe648e2fa67028e1fc0bee839efdd3e78e081dac6a9e13397\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"2e7b2a851ead1f1cbcc5f6106eac7e445acafba2c4c4ad4a5a56639d6af03796\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7f1003cf42290c9494548cc907c9d6b31f90160185f5f9a729a625709fd1fb40\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"7de1fcf03a98bd9434df66c8e2bbabb8a6758cfd8b4c1bc07707e0cd17f3a70b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b7e1694df51b77341405c6097e6d1487bf70a48e8a95816d2cfc62e5ddd6a999\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"e45d437fabc94b7146571bcd5ac6f2fee56e43a9f023c9e1e15d67d077bb0cff\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9178bfcf79bd6f1164069b245bef389ffaa38dddce2763e94a3e39d83454aa7f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"2e3472e08ab25f673a6a47899dd2756fa7246fcafa45a33d1cfbd451f1a6da2b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"106dc24382c96b56f69df1e4bfaa0455678809d57faded1081bc4e26a642d4a0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"922243bc7c6610ec5ba0285d821a4e92cf6386c7e495914f5a3fe8f9160a0647\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4ff864a27b8c6cdd9a746e87a7d53b4055daacec9650360ef6d48d5964395d3f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"b6f9cb2cdae82e814be4f1c67b0c2f3da01ef6645a272400a2fe7577eb5815ff\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0b8fd96f5e30886bce6ea837ac57b2f3d77783c525b1de469227d248ca2a1d6e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"9ad77601cac881a53e95a12cc3d1e21e0beee1d4e9757eaa68fbb36f70dbe5e2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"dc6825eadf840da0185447dcfb22803683fc39051aa637aea7a66d081b192bf7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"4ed033a41f89a0f23149658aeb2f5cbe79d4d5b179ddf0addaf56898cfb91f45\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e1e7c7c242c339c99da1caa3f217a7bd53ffc78a71bee9a0e898d1f0b8471fb3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"00a6f26194c6932f8037cd0201f950c67a9b8fbee2e5ed3817f9a97812c711c2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b0ee4efc66d9a6e357c482407ac7794ac3e2e51168e28a743b633a36b12f1489\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"4f607540ea8ad5f65e31b3b8bf068f37a827d58181018c53d169b4c83e69fc48\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c4c89ab332c30b38dc4f16ef73fecdbd0ef26ff23424b1e8fd0d18c2d45cf73d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"892cea79034a9b0e44e5d14d2ace5c60fa5e183f87a7ffb536724af7425a469d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6ac0410a29c97032cc673c8f56fb055dcd84c1040f73657459b7f1183a6ef131\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"777413beddd80a2dbe7efbaba4adc804e5a12db4f911e0e22a0ea59643cf8a40\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9d278f3acef96193a8d6a95bb17fda6beacb6c6949e61147bbb0a9f984d383ca\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"c89ebfbf5d6c50d68e0202a4a7f2450fb6de7656dcb639d8a2d40d475718ebc7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8e06ac6cbf5999144a3b0f3b2584acaac3b4eb8d03d892bc45e03712448c4a9c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"e52e079eb305353b58c669f26348af185ff2ff22d378b7c80663f6bbaa04aa50\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f7254b99580aca11d813d05cebe8fd0d083eab4978ed55c24131cbd3917e5e39\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"a5339e879056a8880ff59d0bd2b4a470fa93075d67e5851ae7b49fba2bef41e6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b6a8f91d1ffdf775c75f2a1c84bb520696572aea4d3ece8ed9123766f347b2eb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"7edb3db3dee9ba3102857080aca6e9bec53bbe738951ad9a83ba0cb19f036f1e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/simulator-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"eadff6644620dd26a92e8dd1076b97db8fef2224eb03b70ce4e7ee1ef8dc0b30\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"41b87dde831c23a98bbe55369e4882c3bfbc1b8dcecce6cd22b590fe3e2fd450\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/premium-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b4056adace047bf2186763869c2f6a0524a9534ef874733d3868dfd41db1a7c9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"bc833d07dbe8f000644c82cba26ec9f2ce483a0cd86141971709f215bd14e019\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-w1-5f765a')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"98aca426d9ec5ae558219406a36e9375b2e6291ddc5e73bd3960b21edfe258cd\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w1-5f765a-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__6cd75491\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w1-5f765a\"]}],\"name\":\"8e27ae43b5f0896611602b3ee9b020104ca8fa9588c510a3aa8b4c406a47912b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w1-5f765a/models/e2e/distinct-2-w1-5f765a')\"]}}],\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-worker-w1-5f765a"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-e2e-worker-w1-5f765a\" not found"}
{"level":"error","ts":"2026-11-02T22:30:07.590Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-02T21:24:18Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:24:54Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:24:54Z"}],"name":"2aaf9242e876623422852fe471269a2d268f4d784b14c7ab37ec9f34c17f3060","namespace":"kuadrant-system","resourceVersion":"32301","uid":"a9a2398a-bf15-416a-985b-4bff0ad577bb"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["2aaf9242e876623422852fe471269a2d268f4d784b14c7ab37ec9f34c17f3060"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-5f765a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-5f765a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:24:19Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:24:19Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["2aaf9242e876623422852fe471269a2d268f4d784b14c7ab37ec9f34c17f3060"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"2aaf9242e876623422852fe471269a2d268f4d784b14c7ab37ec9f34c17f3060\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:07.655Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route#v1-completions-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"d382a9a5e68a63cf824ae7421c24f285af4eba4b4e83a5df42b6213da00221b7","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d382a9a5e68a63cf824ae7421c24f285af4eba4b4e83a5df42b6213da00221b7"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-a1d751.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-a1d751.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"d382a9a5e68a63cf824ae7421c24f285af4eba4b4e83a5df42b6213da00221b7\" already exists"}
{"level":"error","ts":"2026-11-02T22:30:07.716Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-02T21:26:25Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:26:25Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:26:26Z"}],"name":"e199374b1d053d8a1ea2fb463b47f0da1b100cb9029acd61282384f0bb2553a2","namespace":"kuadrant-system","resourceVersion":"34601","uid":"df566402-a48e-4c70-985b-82ea89e5d77f"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["e199374b1d053d8a1ea2fb463b47f0da1b100cb9029acd61282384f0bb2553a2"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:26:26Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:26:26Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["e199374b1d053d8a1ea2fb463b47f0da1b100cb9029acd61282384f0bb2553a2"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"e199374b1d053d8a1ea2fb463b47f0da1b100cb9029acd61282384f0bb2553a2\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:07.768Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-worker-w2-6fa533","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T21:21:58Z","generation":14,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"350cbfc3-ae8f-47d8-bf88-3bc797a06de4\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:30:18Z"}],"name":"kuadrant-e2e-worker-w2-6fa533","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-worker-w2-6fa533","uid":"350cbfc3-ae8f-47d8-bf88-3bc797a06de4"}],"resourceVersion":"40802","uid":"e9c29fe8-1b7a-4730-9bc2-e4f3e80147bd"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2538346ffaabe171687c406d12f294530661f7690a04d14ab2327034447b1886\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]}],\"name\":\"fc3c7a9daa18c716699d2f1fa233a5848a5d36cd60feee59a35bb57159d77252\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"df8548d2a100989756489c2811783626f3836ef18d08ba8c81bfb6b9e9ef9c28\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]}],\"name\":\"983a86a79f65831a149f35f3c7673bbfb37560154023198d82ebb8965ed48c8e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/premium-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"13cb74b6bdfe9b2af39effc13c9d5ade5172cb10a5930c6aefbe733c0ab0cad4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]}],\"name\":\"462645ad06b45e6f5c9824c64f8ebc4010534cdeadc425c4ab2c9b0594a88a7d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b565990bc269af90f4e0533dedaf97fc37dc70b037af910a7605358eda2713f5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]}],\"name\":\"b369d9c3b4e9e1fbdb75c9e353f7e25f066823d31fb733c322ac2192463d58e1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-2-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2538346ffaabe171687c406d12f294530661f7690a04d14ab2327034447b1886\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]}],\"name\":\"53b8e179280ac5286bf38489ea72372b11c85a8c387359bf689ebecff1663d36\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"df8548d2a100989756489c2811783626f3836ef18d08ba8c81bfb6b9e9ef9c28\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]}],\"name\":\"c166f75566a6849f94f19ff1eaf52bbfeb65e132db0ce99439215a5fba3cf50f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/premium-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"13cb74b6bdfe9b2af39effc13c9d5ade5172cb10a5930c6aefbe733c0ab0cad4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]}],\"name\":\"2eb901a322f6f85745b1b216f71a9aeaf7eef69af5cc7ad9aead13448f127634\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b565990bc269af90f4e0533dedaf97fc37dc70b037af910a7605358eda2713f5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]}],\"name\":\"fae945183d4744cfc72f99d3814545646a9a87e750465f9b67476229ff21e62f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-2-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2538346ffaabe171687c406d12f294530661f7690a04d14ab2327034447b1886\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]}],\"name\":\"89b4eca3220447cd92c83c9c71f9e61e645c1f746a07d9b87eac9b2d4af27f2a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"df8548d2a100989756489c2811783626f3836ef18d08ba8c81bfb6b9e9ef9c28\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]}],\"name\":\"82b649105e404b52dbe59777c528effe8ddcaf390c919bc52a045d6654c17d27\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/premium-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"13cb74b6bdfe9b2af39effc13c9d5ade5172cb10a5930c6aefbe733c0ab0cad4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]}],\"name\":\"0491f04b3838b4a997ad42c2f3b87b5bc525f5236ef6a51647a0af61e52bf52d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b565990bc269af90f4e0533dedaf97fc37dc70b037af910a7605358eda2713f5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]}],\"name\":\"e160eef909b8d94a314732c333511d40579117e325a0f92347c702a5ee49c702\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-2-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2538346ffaabe171687c406d12f294530661f7690a04d14ab2327034447b1886\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]}],\"name\":\"0f54f971c3b78f7352580f77fc5be3e00c2117ef445b417be77bf67ea75539a5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"df8548d2a100989756489c2811783626f3836ef18d08ba8c81bfb6b9e9ef9c28\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]}],\"name\":\"616030c276c95a5326d811265a5516c30019307d032046e4dbf9c60aed89bb9f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/premium-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"13cb74b6bdfe9b2af39effc13c9d5ade5172cb10a5930c6aefbe733c0ab0cad4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]}],\"name\":\"60974e3173a2c5fa225357d66a1c4055fbb2b76b845de70e5504acc58902d471\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b565990bc269af90f4e0533dedaf97fc37dc70b037af910a7605358eda2713f5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]}],\"name\":\"18b6544f1fecef176364e89f35a905f48ff233680f0d7e6adfd1caf2b5f57048\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-2-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2538346ffaabe171687c406d12f294530661f7690a04d14ab2327034447b1886\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]}],\"name\":\"6982a3a190cf8786b034f1d39a14b07dab2e5311ed66344e600b389726798c72\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"df8548d2a100989756489c2811783626f3836ef18d08ba8c81bfb6b9e9ef9c28\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]}],\"name\":\"d8b01a7d8bf17be310055802641797f595c1e7290b01b91e2b87cf0300418b94\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/premium-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"13cb74b6bdfe9b2af39effc13c9d5ade5172cb10a5930c6aefbe733c0ab0cad4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]}],\"name\":\"28c14a49b36fb1c2749324536c3bd478da8cea176c30e855a8c62d376476a248\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b565990bc269af90f4e0533dedaf97fc37dc70b037af910a7605358eda2713f5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]}],\"name\":\"d42afd956ea2d4dcd0f0aaadc1669934e404dadfe3651ba4498df28db6f58683\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-2-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2538346ffaabe171687c406d12f294530661f7690a04d14ab2327034447b1886\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]}],\"name\":\"87456404dc6fbf2160a52ba615889680b0c5cf40dc6100bb0e888288606dff25\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2538346ffaabe171687c406d12f294530661f7690a04d14ab2327034447b1886\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]}],\"name\":\"8b9c2ea6de06bba9ed1ba2a65e99d1500ef45630a372914ecf445da73d74600a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"df8548d2a100989756489c2811783626f3836ef18d08ba8c81bfb6b9e9ef9c28\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]}],\"name\":\"9222b1bebeb91f5bc797ef6f55e59f628b5f90c3da7305c7a50abb490cf18e24\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/premium-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"df8548d2a100989756489c2811783626f3836ef18d08ba8c81bfb6b9e9ef9c28\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]}],\"name\":\"63ba67de9ead24d6aab10a349447139ea4c7227426ee6072b8939e91ccf0ed30\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/premium-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"13cb74b6bdfe9b2af39effc13c9d5ade5172cb10a5930c6aefbe733c0ab0cad4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]}],\"name\":\"b23898184efef7f96fc649e5d2902d9e6f7d32805be8858eb5f57e88696a09d3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"13cb74b6bdfe9b2af39effc13c9d5ade5172cb10a5930c6aefbe733c0ab0cad4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]}],\"name\":\"652be1bab4f56953c3da93778aeff670b21e92a5d993934466d89aaed158b5b6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b565990bc269af90f4e0533dedaf97fc37dc70b037af910a7605358eda2713f5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]}],\"name\":\"e11de01e8f11e362fe12a9bcc574088487751f93b5de75b1bd8c99739acc40b0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-2-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b565990bc269af90f4e0533dedaf97fc37dc70b037af910a7605358eda2713f5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]}],\"name\":\"4672868f1e2492bd2ac79be6374bbac36317364afff96ce0c9c7ac3d568f0b14\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-2-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2538346ffaabe171687c406d12f294530661f7690a04d14ab2327034447b1886\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]}],\"name\":\"d58c446a6a9364595eaae0256bc0befa6f57ed0387674ac1d6970632cb6b41f0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"df8548d2a100989756489c2811783626f3836ef18d08ba8c81bfb6b9e9ef9c28\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]}],\"name\":\"6e120ade3c6d3506708dea5d54e9bc2fd6306ec4718a0c11f9c0a89c0ea6f1cd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/premium-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"13cb74b6bdfe9b2af39effc13c9d5ade5172cb10a5930c6aefbe733c0ab0cad4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]}],\"name\":\"f9f60e3c0c3c06fefd218a3662bf2dac472c1d5acfd112579332b16c2386f504\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b565990bc269af90f4e0533dedaf97fc37dc70b037af910a7605358eda2713f5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]}],\"name\":\"6f55ce1a1c1254c42ba8a4204eaa5d732a42974a08d182b225b6ac98681f141a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-2-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c17d6c6438d8754832a843b7a082fa7fc719ecd30696a3551f3ca815dd52f28b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]}],\"name\":\"fcc5f235388ea2c13a59ae86bacfc4eb4fab79468e3ee8c91a602bb5eeeec1c9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-2-w2-6fa533/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8abe3e629bd34674437803d6e54a0cb90fe0d0df12d2eac23f0b40d2f4990b37\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]}],\"name\":\"ccb67df939c7a3278e2bb82db8d5dc418650599ab46b4bd1d8fe07cf9bb459d0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"371e486415502802484cc345e68be13e0a37a1abb38f2f6c8cce9f8e79b8d9c1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]}],\"name\":\"b41e21a5fb7ad8cd75dbaa2def82137084248aef58468ce3d04ebccec2987b3b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-w2-6fa533/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8f50bf1a21545f68eb583e07935b8b0da52bbc4743a8bc67c4d9545b76da56af\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]}],\"name\":\"7206c2870629f698a99d45c9e7140cc1334b531b1ad5a3c88c147fac40e793b2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/premium-w2-6fa533/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d4fbd382871bb4f5406c37842f4848012cdca0b01e2d7698dc28e396dc18659d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]}],\"name\":\"4924ec7c564baa67e51d989aa281cf4421dc82ba2910dd5cbc5e8ec66fd31e46\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-2-w2-6fa533/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"503064d3f84a23711f1dad5e35d11ef1efceaefb2204608d180ef8d886666ffa\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]}],\"name\":\"1036f7f4f8b7c68faa7a499350cf496a96528b515b125a726c7e904d5297c1e6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e199374b1d053d8a1ea2fb463b47f0da1b100cb9029acd61282384f0bb2553a2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]}],\"name\":\"fc0e1b2816287c18a95319a2d0a9379a9f7bf931fff586f75645e37973bc0009\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-w2-6fa533/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b3a9fbda204f0b6bfe85682d0fee9fd7a9712977e22af554d2d82ba07f1a075a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]}],\"name\":\"e94cca1d60d77f1db698aae8d99dc62d60279b8e5de4556def17f51ea3d8b77b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-2-w2-6fa533/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"41e99bc62a2ac4e8034135f4b655088597f627c66b2efc4627394d148bc2b0ce\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]}],\"name\":\"b2fa16adeef96749257d873656ef49327fe454d7ba806ae3a8a73ec44c8a092d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2f2531e01fa8fc0031706fadbba0c1818c30681dcf9d2c65b1c7c23230ea3a32\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]}],\"name\":\"d04838d25723911d554e0017a035ebf67253923630681f27a1c93b44878b1bcc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/premium-w2-6fa533/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7be093b94c77d8e466548a812b2fd67ba6e4cdbef2e705474d1a124d26a40f56\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]}],\"name\":\"89ba01e718f4b0e60188b8031e9bd1e3cf1d64712b57d397151cd36a5d6214df\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-2-w2-6fa533/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f1edf5f89fd287762fbbefa668581cdc8f1877a3f31497227c537000670166d9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]}],\"name\":\"dbf8e642e7e029e70e317d8df7b5d12be0fc1f008d29ff415d7291c09924eecb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cf13f5a3da5f1ddbc441422b55ececcb0ffd227c7be1c942dc1d4c428387bca0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]}],\"name\":\"0aa6387a836e4d80af5fd5a2d66846f1a40192a89e137f80c52334aa6d868a1c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-w2-6fa533/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"afe9746e0af749da011756561a859419e447efc535f5e3f3773b1d18a5b5a9ac\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]}],\"name\":\"7ae7a5b24207da4f6cb3659a8b6639f53e96a876f02aaa1f0a8b92813f856ad7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/premium-w2-6fa533/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"739e19d51d8fbdeccfc8bc7587afd12132239f688ec6cf8d9586f242a71087f7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]}],\"name\":\"5f4124bfb1cf4c49006c1e2d45346f89a11b72e563d9f8e2d4df054bb65c496c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-w2-6fa533/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8309dc44d5088e48040255bf86dbc622de08fc216837cd0027a69bdf179a9d2a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]}],\"name\":\"206d678ecc5400943db26abb21afd48a2ffc6fee651aa73c8301a56858221aa0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/premium-w2-6fa533/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8f577e4cdeda37406cbf43b607fe4ff7a6bd85c0d3b2c53a45b82a9207f437f9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]}],\"name\":\"7cdf48530943053e434f696a48871881d26809d6cd1a88e8b6daa617fd34d36f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-2-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"206e50a9b0e5f83281f994d9f1d85f92406e3544297c47017c081f763b10dd96\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]}],\"name\":\"1d9b68bda9fa73e5f8e8ac869771d602c5f128903fd22e64db2370f9749a3113\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6ed7710bfd4535612b60aefac40ff2eebbe50fc666cc75f29a23130bdd6ea269\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]}],\"name\":\"1245658c93fce9ced820408e5e090ae4dd51a7c56161a6cfb1ef978beecc3557\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"313f15eb64d50822c9c91871179d7a6ffa3111f658f213fdc0612575f480add7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]}],\"name\":\"eb5df92dd93dfd3d0bc54e95c455fd8d583232e993ed8aed3db80f624312b066\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"62457e23e29ce9b4e8380d685c5e9e84bc5137e91486a6f9c1c9e352ca3a021c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]}],\"name\":\"957121ddf9ee4c2793cec71a8576e07ee1925a201f93c8de02b6fce446d010d8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1ce9b189744d237515a1896d038a3437e8e31669b01937d8cf3a067728ee7e82\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]}],\"name\":\"672be8f3fbaf802659dc395e46e1b17c7ab1515e557eab74f4c7d2c055ad4cf7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/premium-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"881b63d46f0e94053b88caefbfd71fdab183199879cb564ccb3671b6189fcc2e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]}],\"name\":\"4e3e10829c680ef4fa33002314a596e964d519ea2f3cd6331d666a22cfb597e5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0947683a63afc3251194a3b586cb934b1350dcaa171c4fd826d6773a00d5cf2a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]}],\"name\":\"88202ce79ddf6dca9b8c8b1fbc0aa013155bc9975075ee9158a09c6708287af4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"66eb2a66302c20c8061f062df1542c7ad1db513c8b1988f81768f7d266f6665c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]}],\"name\":\"64c175753cea5698cd255c8a903061deed215a3afcc403ae39f57d7b0f7600be\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fd7deaf8530c822c1b10ef4c1b0887086bc840af6d5c7a730508ddcb6e179095\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]}],\"name\":\"14655ca6105b9121c6e780127a21626d2e779082f0ea2674b0d77647d247a24c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5ea067858e444716d33ddecbe718b086e12804ce72bba0a6f135b64fb1bb1c60\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]}],\"name\":\"c88bc53da3544fc41175edc07ced29960aa58c4f7ebf17609eb30f993b862ccf\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"828fe179b1caaef8c4abb4ba71cbe53ab31fc04108a1194889605dd8100c90f1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]}],\"name\":\"f249401e68d6dcd41e2325910ee9db0254c3afa92a19923e1751980966a4694d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"60ca770315801fd35b67ab23639ba4ac6a344fcf95fe492c267cc87cb90ce14f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]}],\"name\":\"d7f0af7e7ca785bc5de89e740ff47459e16eb3ba9360c1eee59d6d8d2f7389bd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6d6f6c08f92b4cefaa6a997643ec612cf9c62df4fa750dd0f5d4c3d50d40d2bb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]}],\"name\":\"daf823a39b0f169fe5f258178380bcf0b3e996152ebcc401fb21de178f041b24\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5cddd3e1918c7df14f710eb09cebc745d043be6f81e6c1e1f2a3803e2f0c6513\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]}],\"name\":\"b1d5e4fa434bbb80c0f5baf3d8ee1797394841413a8f28625f4e0c9d2388764b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1f83c46a7c87c216ad3b7a3697a1ad6c518cb36972a910efbc3c7eed6ab3956a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]}],\"name\":\"496ec6213c84428bc1374936695dcb9246c04c80a4460a92e53220e4641a7116\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e701c3e95fd6d7e3e60b9f162039289bbc904c42df899db9436b6ad7538d1ffc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]}],\"name\":\"576f13852617450ef4f108d2d8c65426c74c6f743bd5e3d6530d746e72633fbc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"25cb748ea88f201b192c863c4e2fb40e5931cd9cfed0d04ae104e35dbe48f38b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]}],\"name\":\"c49c039641c1cdbec2a8f5cc805b4b722943e1336d082080571a2f2fcb073186\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ad04b751b35d313ca76c5057f5e800aa0d5504bc27298aa1762dd803d351bff2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]}],\"name\":\"a24ccfd407372af3bd4160c32a086ddd01bc5d92e15a1f783cdc3f7d8f642124\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3ecbc6560d7cb2e5396471349d24b95ff664f3b33dfc188e590c2b772721287c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]}],\"name\":\"2e058e1b6b4635806a5e2b8fb08fed6fd11db7595be6907f89a86777a30aa9b5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f27c742360d050f8cfba473367fd8076f0a6abdf57b30c6116d8b1fa7559bcc0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]}],\"name\":\"b7571ee2e0ac1a2c804f33ccb2108d7694841ff5c0b7595435bea59672db0c41\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"319a8bd03b55a51284dd6790058e026879ed8db3e6d527dedb4a9314473afa5b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]}],\"name\":\"ac54aac970a6722b49c3410bffc6b58a3832c579aa7c3629ff80507ab769f2d3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8be72fdf7a1e6b1379ac7dc12f7c40286d882ef14376e9fd3e726b2fb781546c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]}],\"name\":\"ac78bc480a068b655886c2d9dd75e3a680756398111216d2be7e8a3e730e4206\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"23d2f913b5bde1ed64144a38680e6282220982f4f5ea1167fabdda3234dbc67e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]}],\"name\":\"c6c6e62fb02ec82dd2ad63c3690b3887e0701c293e1871ee382d92ea80f88f66\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"edbbdcfc920b88151941be1a4c41ad8be6a38bd6beddae7387db202bc3e9b302\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]}],\"name\":\"15153104d9c89c44b59d96d9d8825fe62d21af5bd4db90b6c300fa53823a0ef0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/simulator-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bf3fa706be871596c50143869f253e98ce7aa463d723d2f419d378a041dbfbe5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]}],\"name\":\"4e925c4610a758f575689b807fc7a61cef2c3891e2cf0a1c1074186e65a2e8fd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/premium-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f09ce0bd9bc651317469310c8a604d792e7c7c55751d184a920638cf66ba0dd5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]}],\"name\":\"499fc57e7a454d5bcd94feeb06b43584bb9133eb048e9ee5f20041a16d87ebaa\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-w2-6fa533')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bc33498b2dcdc2f8d2612aa17c0e640458a4442c9d7f2ad45303aeb15b5bccb9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w2-6fa533-maas-auth\"]}],\"name\":\"7ad42a3389048956d61fafc75400a2a68540cd2e35da26f1e7b80db45868f7dd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w2-6fa533/models/e2e/distinct-2-w2-6fa533')\"]}}],\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-worker-w2-6fa533"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-e2e-worker-w2-6fa533\" not found"}
{"level":"error","ts":"2026-11-02T22:30:07.777Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-02T21:24:07Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:24:54Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:24:54Z"}],"name":"6d6f6c08f92b4cefaa6a997643ec612cf9c62df4fa750dd0f5d4c3d50d40d2bb","namespace":"kuadrant-system","resourceVersion":"32310","uid":"bdc50943-61fe-4762-a529-30a02db78338"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["6d6f6c08f92b4cefaa6a997643ec612cf9c62df4fa750dd0f5d4c3d50d40d2bb"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:24:07Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:24:07Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["6d6f6c08f92b4cefaa6a997643ec612cf9c62df4fa750dd0f5d4c3d50d40d2bb"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"6d6f6c08f92b4cefaa6a997643ec612cf9c62df4fa750dd0f5d4c3d50d40d2bb\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:07.838Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-02T21:27:21Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:27:21Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:27:22Z"}],"name":"ddbb47f4f9dda290c11f442f07feec9b2e64a236ec2c98dd4fb16a3796302ba3","namespace":"kuadrant-system","resourceVersion":"35784","uid":"0481531c-4235-4456-af8e-567195393f8a"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["ddbb47f4f9dda290c11f442f07feec9b2e64a236ec2c98dd4fb16a3796302ba3"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-5f765a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-5f765a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:27:22Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:27:22Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["ddbb47f4f9dda290c11f442f07feec9b2e64a236ec2c98dd4fb16a3796302ba3"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"ddbb47f4f9dda290c11f442f07feec9b2e64a236ec2c98dd4fb16a3796302ba3\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:07.904Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route#v1-model-routing"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"fd6cf0f18f21a2b21b869fb35862696f9d65f6371aaab90e03f0600806862db9","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["fd6cf0f18f21a2b21b869fb35862696f9d65f6371aaab90e03f0600806862db9"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-a1d751.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-a1d751.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"fd6cf0f18f21a2b21b869fb35862696f9d65f6371aaab90e03f0600806862db9\" already exists"}
{"level":"error","ts":"2026-11-02T22:30:07.965Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-02T21:26:10Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:26:10Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:26:11Z"}],"name":"922492b3fb118d2a03b9019d5fd7a1e7fc6f7f5e4559c5e1a0ef89b6f41e6c00","namespace":"kuadrant-system","resourceVersion":"34159","uid":"ef7169bb-7532-450a-8d52-2bdd74929da0"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["922492b3fb118d2a03b9019d5fd7a1e7fc6f7f5e4559c5e1a0ef89b6f41e6c00"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-5f765a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-5f765a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:26:11Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:26:11Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["922492b3fb118d2a03b9019d5fd7a1e7fc6f7f5e4559c5e1a0ef89b6f41e6c00"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"922492b3fb118d2a03b9019d5fd7a1e7fc6f7f5e4559c5e1a0ef89b6f41e6c00\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:07.978Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-shared-a-w0-6e535d","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T21:54:30Z","generation":9,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"bb413150-c71f-467a-b73c-fc346914ff7a\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:29:12Z"}],"name":"kuadrant-e2e-shared-a-w0-6e535d","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-a-w0-6e535d","uid":"bb413150-c71f-467a-b73c-fc346914ff7a"}],"resourceVersion":"132262","uid":"79ec4380-cbc0-4c66-b610-cdb28384077b"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6d702678bda1dfc9e3eeb362adcee5bc69be4839840717fadfcf3f540bbad15d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"8ccb66656d88cbc56ddfc1cdade2c6ade590ddfd8f834e284cfd4544915530dd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w0-6e535d/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6d702678bda1dfc9e3eeb362adcee5bc69be4839840717fadfcf3f540bbad15d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"57fa57a3c22d969731bb3e0e7b196f5e0d200359f9ed2a7b1165d9d152357db6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w0-6e535d/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6d702678bda1dfc9e3eeb362adcee5bc69be4839840717fadfcf3f540bbad15d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"625697231e3f5cbf71be2753d18743ad6080e6640edadbcbe1fd6a5ab9ff3124\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w0-6e535d/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6d702678bda1dfc9e3eeb362adcee5bc69be4839840717fadfcf3f540bbad15d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"627fb51e5fd1118f12e62d581e89f9ea85a52c751c25f1a92819f1261a6e611c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w0-6e535d/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6d702678bda1dfc9e3eeb362adcee5bc69be4839840717fadfcf3f540bbad15d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"5cb9df2ee0b41392658cf057b9b2ffe6e4930d1563e8a7f6c6ab1031d63fadfb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w0-6e535d/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6d702678bda1dfc9e3eeb362adcee5bc69be4839840717fadfcf3f540bbad15d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"b1e277f37353cd054251831852bb78e2291ed67be834eaa674ba095e0c0b1264\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w0-6e535d/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6d702678bda1dfc9e3eeb362adcee5bc69be4839840717fadfcf3f540bbad15d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"8fa6481b148596f034f36126a1148d4e876f65cab7ab2c22e8309f69eed3f5e6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w0-6e535d/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6d702678bda1dfc9e3eeb362adcee5bc69be4839840717fadfcf3f540bbad15d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"1c83a08230b976a64359fcaa38c73f1092134a98abfd261b0a0e983288240fbe\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w0-6e535d/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"376d56a711fbb2b29d7c46a8a0998936174b738443f0db294a13f85fd8478a94\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"3aa9e48facd88e18a7acef348feeaf654a1d4310d58727df558a9c5543ced772\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"92c755f42520a16c18887562f8b0dd82ce78b0c009a03cf56621703050a4589e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"d12fa4436543a3b2a715a59028e9bbcdedf2bfa4d33e5c27caea8e8f135d2d7d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-a-w0-6e535d/models/facebook/opt-125m/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ad5aa9665d52830893fb4af1a6c52222eff28c5437dcf9fe501cab6f82aeaea0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"e60fb22206c792ce9f8ec11d2dec26ff03e0d0c5a065444e4feaadc5464259fd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-a-w0-6e535d/models/facebook/opt-125m/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"04ef5a9f5a54464f8dc13ab6c0af24178bef36e48dd84e92297e1f685bae9a8a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"012b2529dc0c67174c800fee5f91edf075d0342bcc0a68c2dac7fd3aa49f3ed1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-a-w0-6e535d/models/facebook/opt-125m/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"85484301f7aa6f30a87b224096575af8d7beea83a8ccf5091f246a4cb028e31b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"2fde3be1dada350e13a9c66ba760a7177a36793874c94f94f769b2f43eed0fd9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-a-w0-6e535d/models/facebook/opt-125m/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c5421eebe7da7086c1d4756a4f69af5cdd7ec596e7f07e8aff73f29facff31ae\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"c9cedf5779f7eb020123e9816fa4cef99bf41c50a438f1c1266eece5e2fbdd70\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cee3ed5de102b63f4fd0d549002d21484e590243e6bb220ff26d56c71481f262\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"074049f4a840cf6d99622f94a7e8ca0e1f97df70b22ad5930ef4fa6b52b3aff7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ccba7a9b1f6fb13d16375041d5707e71f92b68b4e5eb52e231100015ff08ef4b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"0e334bd7093caaec5fe41b4441bdc10c104d2459071931de5a9ca3b102885991\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"55a7427f941cf70e3504be7b1faaabc3224d15aa575a45663edd720843ebc89b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"83d39926bc1c01831f6febd115eb15e8b306d7de81a2887a54cef686a8291839\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-a-w0-6e535d/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ae47fb19c324c072c578abb0ac24ae029fef313aee06a65794451952fe00b10b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"00d2ac54d79d1c2237a41915b66be868a4c6c1750ae37f03a32476856535518c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"059aa363c4f5743984f4a4750b299221d4153361bba88fb44779ada6b736d06a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"0a4df11db71d8d8ba29534b591e0a04826bda9a98dfdc5c7bfe4f61f4e3f1a66\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"65ad30c331bd08b64f99c2bfc9d23db3979d37b9d3b916cb76d08a0dfabf963a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"4593350858282f0ebeaf11b57850d5bccfa270a4b6088784a058e2d70b5cbe7c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"71e8c9bf81b77581f96b1cca4bb909b8434efbbb06bf9c9ec1aa5c8f412b9c76\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"01c09092684d0d3ed9db0ad6f53595f8d2c97286804d29e76075f2c30f05f44e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c3ead856f0c0807270869b6a467d9281b93eaaa8c65e788c4b6393073db2cbe8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"7d0e9eabd4ff8a0b65212f3d03a7b14a1e695503c8c41fb7cd6e844984ba7c69\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8b7e784474461510a9d9970d39fe03c297fc6f9a5f80873c40898bdfcb389e5f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"3cb722466e22fc9e58ad8f75bb3dbd6e1d2f9d75c3cfaafc5c6350857d59f964\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7482755e6f782100b8480fa82045aac768a6400e192241b0d0cf93403dad8edb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"af29fffcd438904723a318f8c7cd8dbe79f55578faf5560452874252825fdf46\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d03cda72cd19a4be8449b91e7c0874bc3615d892fbc822ada2024e8c1dc8bd56\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"efb649db4f32937f9904ced050f9327159e7fd80ed89d902f14f6c5f64e02971\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w0-6e535d/models/facebook/opt-125m')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-shared-a-w0-6e535d"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-shared-a-w0-6e535d\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:08.026Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d#rule-1"},"creationTimestamp":"2026-11-02T21:54:29Z","generation":6,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:26:27Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:26:27Z"}],"name":"7482755e6f782100b8480fa82045aac768a6400e192241b0d0cf93403dad8edb","namespace":"kuadrant-system","resourceVersion":"128249","uid":"8f03f824-a6f8-42fb-be62-97bedf901cac"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["7482755e6f782100b8480fa82045aac768a6400e192241b0d0cf93403dad8edb"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:04:44Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:04:44Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["7482755e6f782100b8480fa82045aac768a6400e192241b0d0cf93403dad8edb"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"7482755e6f782100b8480fa82045aac768a6400e192241b0d0cf93403dad8edb\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:08.086Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-02T21:26:09Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:26:09Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:26:10Z"}],"name":"8f0923ad4223ef053267784d904817130eaaaa279092e9f9f1500d0325c2e6a7","namespace":"kuadrant-system","resourceVersion":"34116","uid":"625539e6-22c1-4aba-8abf-ad253210b7ac"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["8f0923ad4223ef053267784d904817130eaaaa279092e9f9f1500d0325c2e6a7"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-5f765a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-5f765a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:26:10Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:26:10Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["8f0923ad4223ef053267784d904817130eaaaa279092e9f9f1500d0325c2e6a7"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"8f0923ad4223ef053267784d904817130eaaaa279092e9f9f1500d0325c2e6a7\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:08.147Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-02T21:27:21Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:27:21Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:27:21Z"}],"name":"99ce90aab60d81af668145560f9879cd2b5941652fd3e18c3d45856709a0948e","namespace":"kuadrant-system","resourceVersion":"35763","uid":"05d4d778-a525-4ba2-9f7a-d97c2474f1a2"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["99ce90aab60d81af668145560f9879cd2b5941652fd3e18c3d45856709a0948e"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-5f765a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-5f765a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:27:21Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:27:21Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["99ce90aab60d81af668145560f9879cd2b5941652fd3e18c3d45856709a0948e"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"99ce90aab60d81af668145560f9879cd2b5941652fd3e18c3d45856709a0948e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:08.209Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w0-0f0874/rate-test-model-0f0874-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w0-0f0874/rate-test-model-0f0874-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-02T22:21:57Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:27:45Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:27:46Z"}],"name":"aa5865acb61f14eec3bcbdde417b12bdef516ceb89d09786d23726919283c8f2","namespace":"kuadrant-system","resourceVersion":"130196","uid":"9cf3aabe-cacf-48fa-9cb2-3ffd71397ba6"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["aa5865acb61f14eec3bcbdde417b12bdef516ceb89d09786d23726919283c8f2"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:21:58Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:21:58Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["aa5865acb61f14eec3bcbdde417b12bdef516ceb89d09786d23726919283c8f2"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"aa5865acb61f14eec3bcbdde417b12bdef516ceb89d09786d23726919283c8f2\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:08.271Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-02T21:27:59Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:27:59Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:27:59Z"}],"name":"66eb2a66302c20c8061f062df1542c7ad1db513c8b1988f81768f7d266f6665c","namespace":"kuadrant-system","resourceVersion":"36593","uid":"89bfe239-bff5-4df8-a1b4-fe0dfc2aac9d"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["66eb2a66302c20c8061f062df1542c7ad1db513c8b1988f81768f7d266f6665c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:27:59Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:27:59Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["66eb2a66302c20c8061f062df1542c7ad1db513c8b1988f81768f7d266f6665c"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"66eb2a66302c20c8061f062df1542c7ad1db513c8b1988f81768f7d266f6665c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:08.332Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d#rule-6"},"creationTimestamp":"2026-11-02T21:54:29Z","generation":6,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:26:27Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:26:27Z"}],"name":"376d56a711fbb2b29d7c46a8a0998936174b738443f0db294a13f85fd8478a94","namespace":"kuadrant-system","resourceVersion":"128260","uid":"87249339-368d-4d8c-8467-fde5ee5d92d7"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["376d56a711fbb2b29d7c46a8a0998936174b738443f0db294a13f85fd8478a94"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:23:00Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:23:00Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["376d56a711fbb2b29d7c46a8a0998936174b738443f0db294a13f85fd8478a94"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"376d56a711fbb2b29d7c46a8a0998936174b738443f0db294a13f85fd8478a94\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:08.337Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-shared-b-w3-a1d751","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T21:56:05Z","generation":4,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"b4f450f8-3314-4538-8376-5bc4682213ba\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:03:44Z"}],"name":"kuadrant-e2e-shared-b-w3-a1d751","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-b-w3-a1d751","uid":"b4f450f8-3314-4538-8376-5bc4682213ba"}],"resourceVersion":"95898","uid":"f193cccb-926b-43ad-b8dd-0f35a235191b"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fd6cf0f18f21a2b21b869fb35862696f9d65f6371aaab90e03f0600806862db9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]}],\"name\":\"b4f5dc508462935c59141642eb690c679074d18c598722aa3348703ebb49251c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w3-a1d751/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fd6cf0f18f21a2b21b869fb35862696f9d65f6371aaab90e03f0600806862db9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]}],\"name\":\"ea40f06b359e26e9f95fc2c8e156fb14aec66b3738478bbb9e9e9110be4baf61\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w3-a1d751/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fd6cf0f18f21a2b21b869fb35862696f9d65f6371aaab90e03f0600806862db9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]}],\"name\":\"af1a36d8b543a16bd969a4908547157c03ad6f16a3e06fa7ba81f634b8ac2571\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w3-a1d751/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fd6cf0f18f21a2b21b869fb35862696f9d65f6371aaab90e03f0600806862db9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]}],\"name\":\"b00bb8d8f42b0a1f4760bf5a6416af2cef0f8f8103c38765d8a912de36d2ba3e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w3-a1d751/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fd6cf0f18f21a2b21b869fb35862696f9d65f6371aaab90e03f0600806862db9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]}],\"name\":\"bcb4ee38c297fd81d1ba36ca91c6f43533ae03bcf32de74dee7773bb5b2cb53b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w3-a1d751/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fd6cf0f18f21a2b21b869fb35862696f9d65f6371aaab90e03f0600806862db9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]}],\"name\":\"99d79bd58a3e5e09b5c11b892fea548b7b9173be1aa16ee4751b8ebe6ee5e1f6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w3-a1d751/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fd6cf0f18f21a2b21b869fb35862696f9d65f6371aaab90e03f0600806862db9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]}],\"name\":\"5379ce2935360da6445a4624ebb0fffb1d4681ffb42315b2e61e5399dfb808fb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w3-a1d751/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fd6cf0f18f21a2b21b869fb35862696f9d65f6371aaab90e03f0600806862db9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]}],\"name\":\"24a78e9d4e679465e27f213ebfa01f64bc96922ad78fdc53cff071ac5b6a81dc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w3-a1d751/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e5c3e46343f841520ecdb272dac135e882471a34b6fbd1dfe102bb1535df2522\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-a1d751\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-a1d751\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]}],\"name\":\"4309e9a901e490b5923f5e9c24699d2e857cbb6dc20e790330c076d768763498\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b12682b1a488a7777939851e73abef802241193375e49cf718828297da8cb2c2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]}],\"name\":\"1640fd99e1d2b5698216be3f60d3664af2cabf1f24f0bb1fa79f6e2fe9f23ef6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w3-a1d751/models/facebook/opt-125m/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8023c7d6d2d950131dbdfdd9ebb5c95e52dfae5d4dfaf93b8b4ae57eb45d2bcf\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]}],\"name\":\"b054987892c955e1d106dccbc458226a6328c226c09a2075550d9a35d2d6e3a4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w3-a1d751/models/facebook/opt-125m/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"37b98d0f2b528bd5adf68cd626d0bcbb32ae39493dca90dfc95c91c903cb7a9b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]}],\"name\":\"aa0eb8235785812dd27690bb9a938fe5b32045914dff123e9378cf1bf90996a6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w3-a1d751/models/facebook/opt-125m/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f1aeb859c1579aea92c81f985aec98129102bab0482185da8dd5e38bfdab1f31\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]}],\"name\":\"6aa791d210e1f26083ea6e82b46ed8801291f17c0406c9508e404ae9421e045d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w3-a1d751/models/facebook/opt-125m/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f37aa79ec4a1199a49abd3f63dd4c9505bbd959bba56de7e4c8dad6c144af205\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]}],\"name\":\"ee86408dcc7c307eeb7e62f03ad79696c1aed2e21d972e66f5a46e737a42c8e1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d382a9a5e68a63cf824ae7421c24f285af4eba4b4e83a5df42b6213da00221b7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]}],\"name\":\"271e920a6bd7d30bded719b07e051f15b025a118a8675eaf26d6baadbe4d283b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"30ba4ccdfea25c5f1ebce6f1499d547e64179efb055f133b434843801331620f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]}],\"name\":\"00d9079f672c491f076316c8c4b048c87702c283bdebf80e975d415f1df6d2ee\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w3-a1d751/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"649eae6f669005f50b60c0a593259354e3a301dc59d4543707d5cc441ea578ed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]}],\"name\":\"e0a0969004be7bfb9d1683a46a3327aa5144255b817ecc80e408763e6c41f64c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9593847662171f6a7915c575284c678f049381a1160493b136f5566f61950b7f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]}],\"name\":\"6c679088602dd9ea796b046684f1d25f72a7bc96a91c5c604003243da035aa90\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1db7db8718ec954ecf16b0d35140cb8a1c89f0173590ed683bbb861f8380c6f1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]}],\"name\":\"fe031e9e78874e208226b8d363abc95f5f91493550d1e9fbb78ca7091c5e267f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9ed0ddd0e1ea68b359e326fba62a585324a528f116f0bf6d3f085360f79ed877\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-a1d751\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-a1d751\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]}],\"name\":\"7017ce065aadb4ec3cd123f3de90d4b298418b4cb0d6f2943ce905f0b6fa1973\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3e1c5c0bad150c663f60d190f6837f1f47449a9fb1dd0f8b15a5a049a5785836\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-a1d751\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-a1d751\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]}],\"name\":\"4b9629b6a0dc02e424027c37c202c248a532fff8b8cebe3888b35f432e4237a0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"45692dd8f986fdd88aa79ac3fde6dd1db9cc5cbaa9003e3fe62a6a019e62eb23\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-a1d751\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-a1d751\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]}],\"name\":\"8762492ec17ca2d96d70f7661ea91bc6dd105b52e7f7927e5f87422dad69cdf1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"54678c70bb572c34d6f6ed39e879f5beb1891cc61c4ee64dec6d9d3d0ed9c115\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-a1d751\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-a1d751\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]}],\"name\":\"6e67ae0eecb22274f490861a930e85a9d3cf386bb0d1179f4c67c60e1ed8eb2c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"afffab50bac2693d1a47a43cedfba11a37634e625c51a64f41e14d037dc9bc9a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-a1d751\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-a1d751\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]}],\"name\":\"5df45cb848791fb94dcb78fb658eb490c82f995f9d95444c8a546b5cddad1a1b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0b94d900a5cdf5c531935a5db6b720c905f8b8e2c62caaf31136dacaca42afc8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]}],\"name\":\"95a9fdd052d64ba5b84de723c48968a3ca284a89256c7757f5ce2db19a3f11c6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w3-a1d751/models/facebook/opt-125m')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-shared-b-w3-a1d751"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-shared-b-w3-a1d751\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:08.393Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-02T21:24:07Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:24:50Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:24:50Z"}],"name":"bf3fa706be871596c50143869f253e98ce7aa463d723d2f419d378a041dbfbe5","namespace":"kuadrant-system","resourceVersion":"32117","uid":"e1bfb363-a9e3-40f4-ade4-657b44ba3f40"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["bf3fa706be871596c50143869f253e98ce7aa463d723d2f419d378a041dbfbe5"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:24:07Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:24:07Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["bf3fa706be871596c50143869f253e98ce7aa463d723d2f419d378a041dbfbe5"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"bf3fa706be871596c50143869f253e98ce7aa463d723d2f419d378a041dbfbe5\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:08.455Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-02T21:23:13Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:24:53Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:24:53Z"}],"name":"9178bfcf79bd6f1164069b245bef389ffaa38dddce2763e94a3e39d83454aa7f","namespace":"kuadrant-system","resourceVersion":"32258","uid":"3fa26236-8967-4741-a1b7-88f7ba45e6d6"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["9178bfcf79bd6f1164069b245bef389ffaa38dddce2763e94a3e39d83454aa7f"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-5f765a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-5f765a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:23:13Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:23:13Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["9178bfcf79bd6f1164069b245bef389ffaa38dddce2763e94a3e39d83454aa7f"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"9178bfcf79bd6f1164069b245bef389ffaa38dddce2763e94a3e39d83454aa7f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:08.509Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to delete envoyfilter object","gateway":"openshift-ingress/e2e-shared-b-w4-58ca7f","envoyfilter":"openshift-ingress/kuadrant-e2e-shared-b-w4-58ca7f","error":"envoyfilters.networking.istio.io \"kuadrant-e2e-shared-b-w4-58ca7f\" not found"}
{"level":"error","ts":"2026-11-02T22:30:08.516Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-02T21:26:10Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:26:10Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:26:10Z"}],"name":"9fa5392cc7c0130bb8596420fcb1a79f07b3d804fb9e4de459f680cdcfd5dcfc","namespace":"kuadrant-system","resourceVersion":"34138","uid":"dbd994c5-d1dc-4655-b5ed-e6a402e2077b"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["9fa5392cc7c0130bb8596420fcb1a79f07b3d804fb9e4de459f680cdcfd5dcfc"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-5f765a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-5f765a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:26:10Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:26:10Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["9fa5392cc7c0130bb8596420fcb1a79f07b3d804fb9e4de459f680cdcfd5dcfc"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"9fa5392cc7c0130bb8596420fcb1a79f07b3d804fb9e4de459f680cdcfd5dcfc\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:08.582Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route#v1-responses-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"649eae6f669005f50b60c0a593259354e3a301dc59d4543707d5cc441ea578ed","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["649eae6f669005f50b60c0a593259354e3a301dc59d4543707d5cc441ea578ed"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-a1d751.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-a1d751.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"649eae6f669005f50b60c0a593259354e3a301dc59d4543707d5cc441ea578ed\" already exists"}
{"level":"error","ts":"2026-11-02T22:30:08.644Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-02T21:26:24Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:26:24Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:26:24Z"}],"name":"ad04b751b35d313ca76c5057f5e800aa0d5504bc27298aa1762dd803d351bff2","namespace":"kuadrant-system","resourceVersion":"34541","uid":"7c48e5c7-6cee-4465-abf6-08d0cdb480b3"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["ad04b751b35d313ca76c5057f5e800aa0d5504bc27298aa1762dd803d351bff2"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:26:24Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:26:24Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["ad04b751b35d313ca76c5057f5e800aa0d5504bc27298aa1762dd803d351bff2"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"ad04b751b35d313ca76c5057f5e800aa0d5504bc27298aa1762dd803d351bff2\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:08.709Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-02T21:23:14Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:24:51Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:24:52Z"}],"name":"9d278f3acef96193a8d6a95bb17fda6beacb6c6949e61147bbb0a9f984d383ca","namespace":"kuadrant-system","resourceVersion":"32197","uid":"80c5c767-85bd-4363-9ead-02507cb9a387"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["9d278f3acef96193a8d6a95bb17fda6beacb6c6949e61147bbb0a9f984d383ca"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-5f765a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-5f765a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:24:52Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:24:52Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["9d278f3acef96193a8d6a95bb17fda6beacb6c6949e61147bbb0a9f984d383ca"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"9d278f3acef96193a8d6a95bb17fda6beacb6c6949e61147bbb0a9f984d383ca\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:08.770Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d#rule-3"},"creationTimestamp":"2026-11-02T21:54:30Z","generation":6,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:26:27Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:26:27Z"}],"name":"c3ead856f0c0807270869b6a467d9281b93eaaa8c65e788c4b6393073db2cbe8","namespace":"kuadrant-system","resourceVersion":"128272","uid":"f849a86d-55d5-4304-af00-b79e8250f69e"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["c3ead856f0c0807270869b6a467d9281b93eaaa8c65e788c4b6393073db2cbe8"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:54:31Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:54:31Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["c3ead856f0c0807270869b6a467d9281b93eaaa8c65e788c4b6393073db2cbe8"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"c3ead856f0c0807270869b6a467d9281b93eaaa8c65e788c4b6393073db2cbe8\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:08.832Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w0-0f0874","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w0-0f0874#rule-4"},"creationTimestamp":"2026-11-02T21:56:34Z","generation":6,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:27:45Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:27:45Z"}],"name":"6e2c4c40ad28f1eeda9eca533706722536247311f5ede5be2cbe544e374719a6","namespace":"kuadrant-system","resourceVersion":"130181","uid":"0f063dfd-17bc-49a3-923a-24c33cc81a1b"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["6e2c4c40ad28f1eeda9eca533706722536247311f5ede5be2cbe544e374719a6"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:26:02Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:26:02Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["6e2c4c40ad28f1eeda9eca533706722536247311f5ede5be2cbe544e374719a6"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"6e2c4c40ad28f1eeda9eca533706722536247311f5ede5be2cbe544e374719a6\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:08.893Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d#rule-2"},"creationTimestamp":"2026-11-02T21:54:29Z","generation":6,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:26:27Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:26:27Z"}],"name":"65ad30c331bd08b64f99c2bfc9d23db3979d37b9d3b916cb76d08a0dfabf963a","namespace":"kuadrant-system","resourceVersion":"128258","uid":"6ff8c85b-eced-417f-a7cc-ef673cbc30f6"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["65ad30c331bd08b64f99c2bfc9d23db3979d37b9d3b916cb76d08a0dfabf963a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:54:30Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:54:30Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["65ad30c331bd08b64f99c2bfc9d23db3979d37b9d3b916cb76d08a0dfabf963a"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"65ad30c331bd08b64f99c2bfc9d23db3979d37b9d3b916cb76d08a0dfabf963a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:08.955Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w0-0f0874/rate-test-model-0f0874-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w0-0f0874/rate-test-model-0f0874-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-02T22:21:57Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:27:43Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:27:44Z"}],"name":"723ff56478b245706677de5d534bdca6f79a45abce147a872b1386591bf44cbc","namespace":"kuadrant-system","resourceVersion":"130090","uid":"4ff3bc89-1fc6-43b3-9ac7-9dfb02d10af6"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["723ff56478b245706677de5d534bdca6f79a45abce147a872b1386591bf44cbc"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:21:57Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:21:57Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["723ff56478b245706677de5d534bdca6f79a45abce147a872b1386591bf44cbc"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"723ff56478b245706677de5d534bdca6f79a45abce147a872b1386591bf44cbc\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:09.017Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-02T22:20:06Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:26:26Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:26:26Z"}],"name":"6d702678bda1dfc9e3eeb362adcee5bc69be4839840717fadfcf3f540bbad15d","namespace":"kuadrant-system","resourceVersion":"128223","uid":"1789057c-8a63-447d-893c-e05d61bbde02"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["6d702678bda1dfc9e3eeb362adcee5bc69be4839840717fadfcf3f540bbad15d"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:20:06Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:20:06Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["6d702678bda1dfc9e3eeb362adcee5bc69be4839840717fadfcf3f540bbad15d"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"6d702678bda1dfc9e3eeb362adcee5bc69be4839840717fadfcf3f540bbad15d\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:09.083Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"30ba4ccdfea25c5f1ebce6f1499d547e64179efb055f133b434843801331620f","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["30ba4ccdfea25c5f1ebce6f1499d547e64179efb055f133b434843801331620f"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-a1d751.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-a1d751.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"30ba4ccdfea25c5f1ebce6f1499d547e64179efb055f133b434843801331620f\" already exists"}
{"level":"error","ts":"2026-11-02T22:30:09.144Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-02T22:20:06Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:26:26Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:26:26Z"}],"name":"c5421eebe7da7086c1d4756a4f69af5cdd7ec596e7f07e8aff73f29facff31ae","namespace":"kuadrant-system","resourceVersion":"128203","uid":"c45d1f70-0e64-4202-909b-5966c2c9ef62"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["c5421eebe7da7086c1d4756a4f69af5cdd7ec596e7f07e8aff73f29facff31ae"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:20:07Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:20:07Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["c5421eebe7da7086c1d4756a4f69af5cdd7ec596e7f07e8aff73f29facff31ae"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"c5421eebe7da7086c1d4756a4f69af5cdd7ec596e7f07e8aff73f29facff31ae\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:09.206Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-02T21:26:25Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:26:25Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:26:25Z"}],"name":"8be72fdf7a1e6b1379ac7dc12f7c40286d882ef14376e9fd3e726b2fb781546c","namespace":"kuadrant-system","resourceVersion":"34578","uid":"fa9800bd-d0e4-4ce8-99a6-b440039bd1f8"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["8be72fdf7a1e6b1379ac7dc12f7c40286d882ef14376e9fd3e726b2fb781546c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:26:25Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:26:25Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["8be72fdf7a1e6b1379ac7dc12f7c40286d882ef14376e9fd3e726b2fb781546c"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"8be72fdf7a1e6b1379ac7dc12f7c40286d882ef14376e9fd3e726b2fb781546c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:09.268Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w0-0f0874","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w0-0f0874#rule-1"},"creationTimestamp":"2026-11-02T21:56:34Z","generation":6,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:27:45Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:27:45Z"}],"name":"ffaef4e77ab77e038e2181351f7ed710141739ce5f70351bf42c0606b9215e72","namespace":"kuadrant-system","resourceVersion":"130169","uid":"0ae00e90-2d9e-4cd3-9880-e48b0f30deaa"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["ffaef4e77ab77e038e2181351f7ed710141739ce5f70351bf42c0606b9215e72"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:24:04Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:24:04Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["ffaef4e77ab77e038e2181351f7ed710141739ce5f70351bf42c0606b9215e72"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"ffaef4e77ab77e038e2181351f7ed710141739ce5f70351bf42c0606b9215e72\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:09.333Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-02T21:24:05Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:24:52Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:24:53Z"}],"name":"afe9746e0af749da011756561a859419e447efc535f5e3f3773b1d18a5b5a9ac","namespace":"kuadrant-system","resourceVersion":"32248","uid":"d17a53f4-8744-4eb3-b0ee-c9effefc7522"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["afe9746e0af749da011756561a859419e447efc535f5e3f3773b1d18a5b5a9ac"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:24:06Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:24:06Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["afe9746e0af749da011756561a859419e447efc535f5e3f3773b1d18a5b5a9ac"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"afe9746e0af749da011756561a859419e447efc535f5e3f3773b1d18a5b5a9ac\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:09.394Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w0-0f0874","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w0-0f0874#rule-5"},"creationTimestamp":"2026-11-02T21:56:33Z","generation":6,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:27:45Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:27:46Z"}],"name":"848b20842f79c8cc02bec7966c894853251e29e5c14c8a4cff729041c180e15c","namespace":"kuadrant-system","resourceVersion":"130189","uid":"6384ebbc-a9ea-4bb7-a3b1-750a047b299f"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["848b20842f79c8cc02bec7966c894853251e29e5c14c8a4cff729041c180e15c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:56:34Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:56:34Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["848b20842f79c8cc02bec7966c894853251e29e5c14c8a4cff729041c180e15c"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"848b20842f79c8cc02bec7966c894853251e29e5c14c8a4cff729041c180e15c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:09.455Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-02T22:20:06Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:26:25Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:26:25Z"}],"name":"ccba7a9b1f6fb13d16375041d5707e71f92b68b4e5eb52e231100015ff08ef4b","namespace":"kuadrant-system","resourceVersion":"128189","uid":"36d52290-3df0-4d2c-b495-2d8263932ee9"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["ccba7a9b1f6fb13d16375041d5707e71f92b68b4e5eb52e231100015ff08ef4b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:20:06Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:20:06Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["ccba7a9b1f6fb13d16375041d5707e71f92b68b4e5eb52e231100015ff08ef4b"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"ccba7a9b1f6fb13d16375041d5707e71f92b68b4e5eb52e231100015ff08ef4b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:09.516Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-02T21:26:25Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:26:25Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:26:26Z"}],"name":"f09ce0bd9bc651317469310c8a604d792e7c7c55751d184a920638cf66ba0dd5","namespace":"kuadrant-system","resourceVersion":"34621","uid":"a82e1e6d-6f96-48a5-a50e-bfa458ea93ea"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f09ce0bd9bc651317469310c8a604d792e7c7c55751d184a920638cf66ba0dd5"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:26:26Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:26:26Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["f09ce0bd9bc651317469310c8a604d792e7c7c55751d184a920638cf66ba0dd5"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"f09ce0bd9bc651317469310c8a604d792e7c7c55751d184a920638cf66ba0dd5\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:09.578Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-02T22:20:06Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:26:26Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:26:27Z"}],"name":"059aa363c4f5743984f4a4750b299221d4153361bba88fb44779ada6b736d06a","namespace":"kuadrant-system","resourceVersion":"128244","uid":"e424df59-5ab9-4499-97ec-7da8d58e1930"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["059aa363c4f5743984f4a4750b299221d4153361bba88fb44779ada6b736d06a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:23:02Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:23:02Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["059aa363c4f5743984f4a4750b299221d4153361bba88fb44779ada6b736d06a"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"059aa363c4f5743984f4a4750b299221d4153361bba88fb44779ada6b736d06a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:09.640Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w0-0f0874/rate-test-model-0f0874-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w0-0f0874/rate-test-model-0f0874-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-02T22:21:56Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:27:45Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:27:45Z"}],"name":"27c00f1160fee4edb42d2d932daa50752238a681b270e486550b0ccd674d7682","namespace":"kuadrant-system","resourceVersion":"130172","uid":"440185d5-df09-4c11-8ad7-931acebd941c"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["27c00f1160fee4edb42d2d932daa50752238a681b270e486550b0ccd674d7682"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:21:57Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:21:57Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["27c00f1160fee4edb42d2d932daa50752238a681b270e486550b0ccd674d7682"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"27c00f1160fee4edb42d2d932daa50752238a681b270e486550b0ccd674d7682\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:09.702Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w0-0f0874","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w0-0f0874#rule-3"},"creationTimestamp":"2026-11-02T21:56:34Z","generation":6,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:27:44Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:27:44Z"}],"name":"b0dda7ce592fb57a979446129e21c491a217f4c5c9a704c19a519ee42c367e92","namespace":"kuadrant-system","resourceVersion":"130115","uid":"d48b3d18-33ed-4660-af27-b3404ed9ef2e"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["b0dda7ce592fb57a979446129e21c491a217f4c5c9a704c19a519ee42c367e92"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:04:47Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:04:47Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["b0dda7ce592fb57a979446129e21c491a217f4c5c9a704c19a519ee42c367e92"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"b0dda7ce592fb57a979446129e21c491a217f4c5c9a704c19a519ee42c367e92\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:09.763Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-02T21:23:13Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:24:52Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:24:53Z"}],"name":"5bc63b4c1a02d51f1462172790f7018aec7db9fb8a2a61024ca7c15aac9065b4","namespace":"kuadrant-system","resourceVersion":"32245","uid":"55c27321-3d74-419f-81fc-2b3d7c7563da"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["5bc63b4c1a02d51f1462172790f7018aec7db9fb8a2a61024ca7c15aac9065b4"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-5f765a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-5f765a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:23:13Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:23:13Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["5bc63b4c1a02d51f1462172790f7018aec7db9fb8a2a61024ca7c15aac9065b4"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"5bc63b4c1a02d51f1462172790f7018aec7db9fb8a2a61024ca7c15aac9065b4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:09.826Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-02T21:24:19Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:24:53Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:24:54Z"}],"name":"f7254b99580aca11d813d05cebe8fd0d083eab4978ed55c24131cbd3917e5e39","namespace":"kuadrant-system","resourceVersion":"32293","uid":"ef0dcb81-013e-4770-98af-dfd8712cc95a"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f7254b99580aca11d813d05cebe8fd0d083eab4978ed55c24131cbd3917e5e39"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-5f765a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-5f765a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:24:19Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:24:19Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["f7254b99580aca11d813d05cebe8fd0d083eab4978ed55c24131cbd3917e5e39"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"f7254b99580aca11d813d05cebe8fd0d083eab4978ed55c24131cbd3917e5e39\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:09.886Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w0-0f0874/rate-test-model-0f0874-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w0-0f0874/rate-test-model-0f0874-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-02T22:21:56Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:27:44Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:27:44Z"}],"name":"f4ecce895af38f9134e1fa20d5bd1e91c0c47aeb2d6d3a1ff49cf2e9138234bb","namespace":"kuadrant-system","resourceVersion":"130120","uid":"565a05e6-140a-46e5-a246-a6d43bf9a776"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f4ecce895af38f9134e1fa20d5bd1e91c0c47aeb2d6d3a1ff49cf2e9138234bb"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:21:57Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:21:57Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["f4ecce895af38f9134e1fa20d5bd1e91c0c47aeb2d6d3a1ff49cf2e9138234bb"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"f4ecce895af38f9134e1fa20d5bd1e91c0c47aeb2d6d3a1ff49cf2e9138234bb\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:09.948Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-02T21:27:58Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:27:58Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:27:59Z"}],"name":"b565990bc269af90f4e0533dedaf97fc37dc70b037af910a7605358eda2713f5","namespace":"kuadrant-system","resourceVersion":"36569","uid":"ba636785-dc33-4025-82d7-0cbe62e898b0"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["b565990bc269af90f4e0533dedaf97fc37dc70b037af910a7605358eda2713f5"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:27:59Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:27:59Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["b565990bc269af90f4e0533dedaf97fc37dc70b037af910a7605358eda2713f5"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"b565990bc269af90f4e0533dedaf97fc37dc70b037af910a7605358eda2713f5\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:10.011Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w0-0f0874/rate-test-model-0f0874-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w0-0f0874/rate-test-model-0f0874-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-02T22:21:57Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:27:44Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:27:44Z"}],"name":"52afa67a4bb23da81788fa24144b809f70c5f20786bfc6a5c4e8bd0929485ee9","namespace":"kuadrant-system","resourceVersion":"130123","uid":"6bfddea9-7e58-47d1-88cf-b785ff066054"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["52afa67a4bb23da81788fa24144b809f70c5f20786bfc6a5c4e8bd0929485ee9"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:21:57Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:21:57Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["52afa67a4bb23da81788fa24144b809f70c5f20786bfc6a5c4e8bd0929485ee9"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"52afa67a4bb23da81788fa24144b809f70c5f20786bfc6a5c4e8bd0929485ee9\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:10.077Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route#v1-completions-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"8023c7d6d2d950131dbdfdd9ebb5c95e52dfae5d4dfaf93b8b4ae57eb45d2bcf","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["8023c7d6d2d950131dbdfdd9ebb5c95e52dfae5d4dfaf93b8b4ae57eb45d2bcf"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-a1d751.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-a1d751.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"8023c7d6d2d950131dbdfdd9ebb5c95e52dfae5d4dfaf93b8b4ae57eb45d2bcf\" already exists"}
{"level":"error","ts":"2026-11-02T22:30:10.144Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"b12682b1a488a7777939851e73abef802241193375e49cf718828297da8cb2c2","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["b12682b1a488a7777939851e73abef802241193375e49cf718828297da8cb2c2"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-a1d751.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-a1d751.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"b12682b1a488a7777939851e73abef802241193375e49cf718828297da8cb2c2\" already exists"}
{"level":"error","ts":"2026-11-02T22:30:10.205Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-02T21:24:05Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:24:52Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:24:52Z"}],"name":"df8548d2a100989756489c2811783626f3836ef18d08ba8c81bfb6b9e9ef9c28","namespace":"kuadrant-system","resourceVersion":"32241","uid":"df5b51e3-37cf-4c78-9dc1-6d5826fa0fc1"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["df8548d2a100989756489c2811783626f3836ef18d08ba8c81bfb6b9e9ef9c28"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:24:05Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:24:05Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["df8548d2a100989756489c2811783626f3836ef18d08ba8c81bfb6b9e9ef9c28"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"df8548d2a100989756489c2811783626f3836ef18d08ba8c81bfb6b9e9ef9c28\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:10.268Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-02T21:26:24Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:26:24Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:26:24Z"}],"name":"cf13f5a3da5f1ddbc441422b55ececcb0ffd227c7be1c942dc1d4c428387bca0","namespace":"kuadrant-system","resourceVersion":"34549","uid":"bccd0169-1e8f-43b7-9772-66e895e61bc5"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["cf13f5a3da5f1ddbc441422b55ececcb0ffd227c7be1c942dc1d4c428387bca0"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:26:24Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:26:24Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["cf13f5a3da5f1ddbc441422b55ececcb0ffd227c7be1c942dc1d4c428387bca0"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"cf13f5a3da5f1ddbc441422b55ececcb0ffd227c7be1c942dc1d4c428387bca0\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:10.331Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-02T21:23:13Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:24:52Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:24:52Z"}],"name":"4139e076413d5d9d1fd2b594b83d854cc771dfa28886f3f67439ec043220dd9f","namespace":"kuadrant-system","resourceVersion":"32216","uid":"580672ea-4a97-4a8d-9a56-1305bab47d98"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["4139e076413d5d9d1fd2b594b83d854cc771dfa28886f3f67439ec043220dd9f"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-5f765a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-5f765a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:23:15Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:23:15Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["4139e076413d5d9d1fd2b594b83d854cc771dfa28886f3f67439ec043220dd9f"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"4139e076413d5d9d1fd2b594b83d854cc771dfa28886f3f67439ec043220dd9f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:10.393Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w0-0f0874/rate-test-model-0f0874-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w0-0f0874/rate-test-model-0f0874-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-02T22:21:58Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:27:44Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:27:44Z"}],"name":"48e95544e68fc50e4e4e36c8679af44644ecbfb2cf7df51e27a09f30472eda9e","namespace":"kuadrant-system","resourceVersion":"130131","uid":"d54ae2b4-349d-4cea-9bd2-48806259b9ff"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["48e95544e68fc50e4e4e36c8679af44644ecbfb2cf7df51e27a09f30472eda9e"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:26:02Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:26:02Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["48e95544e68fc50e4e4e36c8679af44644ecbfb2cf7df51e27a09f30472eda9e"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"48e95544e68fc50e4e4e36c8679af44644ecbfb2cf7df51e27a09f30472eda9e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:10.455Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-02T22:20:06Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:26:25Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:26:25Z"}],"name":"d03cda72cd19a4be8449b91e7c0874bc3615d892fbc822ada2024e8c1dc8bd56","namespace":"kuadrant-system","resourceVersion":"128173","uid":"2a88e818-5b7e-4d9f-92f0-4d73775d87cc"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d03cda72cd19a4be8449b91e7c0874bc3615d892fbc822ada2024e8c1dc8bd56"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:26:25Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:26:25Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["d03cda72cd19a4be8449b91e7c0874bc3615d892fbc822ada2024e8c1dc8bd56"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"d03cda72cd19a4be8449b91e7c0874bc3615d892fbc822ada2024e8c1dc8bd56\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:10.517Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w0-0f0874","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w0-0f0874#rule-6"},"creationTimestamp":"2026-11-02T21:56:34Z","generation":6,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:27:44Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:27:44Z"}],"name":"4676855aaad0efd1f263930f7407a2242dda7211d0408fa3820678f475f20874","namespace":"kuadrant-system","resourceVersion":"130111","uid":"e3d62d4f-d4b7-4603-a0dd-991806014450"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["4676855aaad0efd1f263930f7407a2242dda7211d0408fa3820678f475f20874"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:56:34Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:56:34Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["4676855aaad0efd1f263930f7407a2242dda7211d0408fa3820678f475f20874"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"4676855aaad0efd1f263930f7407a2242dda7211d0408fa3820678f475f20874\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:10.579Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-02T21:27:21Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:27:21Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:27:21Z"}],"name":"6ac0410a29c97032cc673c8f56fb055dcd84c1040f73657459b7f1183a6ef131","namespace":"kuadrant-system","resourceVersion":"35747","uid":"2010f8bb-517c-4a88-ba6d-38fdee888c6c"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["6ac0410a29c97032cc673c8f56fb055dcd84c1040f73657459b7f1183a6ef131"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-5f765a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-5f765a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:27:21Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:27:21Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["6ac0410a29c97032cc673c8f56fb055dcd84c1040f73657459b7f1183a6ef131"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"6ac0410a29c97032cc673c8f56fb055dcd84c1040f73657459b7f1183a6ef131\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:10.640Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w0-0f0874/rate-test-model-0f0874-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w0-0f0874/rate-test-model-0f0874-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-02T22:21:57Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:27:44Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:27:44Z"}],"name":"a9353902ff809c3953ab78fb1a74b0913862deabf4e36537f31dcb1d590b46dd","namespace":"kuadrant-system","resourceVersion":"130101","uid":"9ceba798-2b52-481b-8fad-fc477041f889"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a9353902ff809c3953ab78fb1a74b0913862deabf4e36537f31dcb1d590b46dd"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:21:57Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:21:57Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["a9353902ff809c3953ab78fb1a74b0913862deabf4e36537f31dcb1d590b46dd"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a9353902ff809c3953ab78fb1a74b0913862deabf4e36537f31dcb1d590b46dd\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:10.705Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route#v1-chat-completions-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"f37aa79ec4a1199a49abd3f63dd4c9505bbd959bba56de7e4c8dad6c144af205","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f37aa79ec4a1199a49abd3f63dd4c9505bbd959bba56de7e4c8dad6c144af205"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-a1d751.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-a1d751.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"f37aa79ec4a1199a49abd3f63dd4c9505bbd959bba56de7e4c8dad6c144af205\" already exists"}
{"level":"error","ts":"2026-11-02T22:30:10.770Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route#v1-responses-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"37b98d0f2b528bd5adf68cd626d0bcbb32ae39493dca90dfc95c91c903cb7a9b","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["37b98d0f2b528bd5adf68cd626d0bcbb32ae39493dca90dfc95c91c903cb7a9b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-a1d751.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-a1d751.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"37b98d0f2b528bd5adf68cd626d0bcbb32ae39493dca90dfc95c91c903cb7a9b\" already exists"}
{"level":"error","ts":"2026-11-02T22:30:10.831Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-02T21:26:10Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:26:10Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:26:10Z"}],"name":"6cbb9b4408bb48fa5c471c9684ef41f50ebbc4e85135af89ff2781ab48666f2a","namespace":"kuadrant-system","resourceVersion":"34151","uid":"34a5c18a-8aa4-427d-bad4-ce3c86ab4c20"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["6cbb9b4408bb48fa5c471c9684ef41f50ebbc4e85135af89ff2781ab48666f2a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-5f765a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-5f765a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:26:10Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:26:10Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["6cbb9b4408bb48fa5c471c9684ef41f50ebbc4e85135af89ff2781ab48666f2a"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"6cbb9b4408bb48fa5c471c9684ef41f50ebbc4e85135af89ff2781ab48666f2a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:10.892Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-02T21:23:14Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:24:53Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:24:53Z"}],"name":"719394d8154dd624eedc306180a33baa4128531f223bc2727d0376601dd634f6","namespace":"kuadrant-system","resourceVersion":"32276","uid":"f7085071-ed24-485e-9414-cd08dfa886fd"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["719394d8154dd624eedc306180a33baa4128531f223bc2727d0376601dd634f6"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-5f765a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-5f765a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:23:14Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:23:14Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["719394d8154dd624eedc306180a33baa4128531f223bc2727d0376601dd634f6"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"719394d8154dd624eedc306180a33baa4128531f223bc2727d0376601dd634f6\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:10.953Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-02T21:24:06Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:24:50Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:24:50Z"}],"name":"23d2f913b5bde1ed64144a38680e6282220982f4f5ea1167fabdda3234dbc67e","namespace":"kuadrant-system","resourceVersion":"32133","uid":"7328b88e-1a5d-42c7-a33a-12a96e6fd672"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["23d2f913b5bde1ed64144a38680e6282220982f4f5ea1167fabdda3234dbc67e"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:24:06Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:24:06Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["23d2f913b5bde1ed64144a38680e6282220982f4f5ea1167fabdda3234dbc67e"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"23d2f913b5bde1ed64144a38680e6282220982f4f5ea1167fabdda3234dbc67e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:11.015Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-02T21:22:56Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:24:51Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:24:52Z"}],"name":"fd7deaf8530c822c1b10ef4c1b0887086bc840af6d5c7a730508ddcb6e179095","namespace":"kuadrant-system","resourceVersion":"32211","uid":"8401c861-9034-41f7-86ed-17eacaf9e152"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["fd7deaf8530c822c1b10ef4c1b0887086bc840af6d5c7a730508ddcb6e179095"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:22:56Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:22:56Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["fd7deaf8530c822c1b10ef4c1b0887086bc840af6d5c7a730508ddcb6e179095"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"fd7deaf8530c822c1b10ef4c1b0887086bc840af6d5c7a730508ddcb6e179095\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:11.076Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d#rule-5"},"creationTimestamp":"2026-11-02T21:54:29Z","generation":6,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:26:26Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:26:26Z"}],"name":"71e8c9bf81b77581f96b1cca4bb909b8434efbbb06bf9c9ec1aa5c8f412b9c76","namespace":"kuadrant-system","resourceVersion":"128201","uid":"8e3bdfbd-1c5f-4bb7-8e05-2f58902e4b45"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["71e8c9bf81b77581f96b1cca4bb909b8434efbbb06bf9c9ec1aa5c8f412b9c76"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:23:03Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:23:03Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["71e8c9bf81b77581f96b1cca4bb909b8434efbbb06bf9c9ec1aa5c8f412b9c76"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"71e8c9bf81b77581f96b1cca4bb909b8434efbbb06bf9c9ec1aa5c8f412b9c76\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:11.137Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-02T21:24:06Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:24:52Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:24:53Z"}],"name":"2f2531e01fa8fc0031706fadbba0c1818c30681dcf9d2c65b1c7c23230ea3a32","namespace":"kuadrant-system","resourceVersion":"32243","uid":"5d7dc631-afe4-4cf4-8255-ab287e66ac34"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["2f2531e01fa8fc0031706fadbba0c1818c30681dcf9d2c65b1c7c23230ea3a32"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:24:06Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:24:06Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["2f2531e01fa8fc0031706fadbba0c1818c30681dcf9d2c65b1c7c23230ea3a32"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"2f2531e01fa8fc0031706fadbba0c1818c30681dcf9d2c65b1c7c23230ea3a32\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:11.198Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-02T21:24:06Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:24:50Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:24:50Z"}],"name":"25cb748ea88f201b192c863c4e2fb40e5931cd9cfed0d04ae104e35dbe48f38b","namespace":"kuadrant-system","resourceVersion":"32113","uid":"d68fd257-32f5-4497-8b5c-6cc0410089a6"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["25cb748ea88f201b192c863c4e2fb40e5931cd9cfed0d04ae104e35dbe48f38b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:24:50Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:24:50Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["25cb748ea88f201b192c863c4e2fb40e5931cd9cfed0d04ae104e35dbe48f38b"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"25cb748ea88f201b192c863c4e2fb40e5931cd9cfed0d04ae104e35dbe48f38b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:11.259Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d#rule-4"},"creationTimestamp":"2026-11-02T21:54:29Z","generation":6,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:26:26Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:26:26Z"}],"name":"8b7e784474461510a9d9970d39fe03c297fc6f9a5f80873c40898bdfcb389e5f","namespace":"kuadrant-system","resourceVersion":"128206","uid":"f7425df0-2e92-4ae4-8201-ef2b895a8fa6"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["8b7e784474461510a9d9970d39fe03c297fc6f9a5f80873c40898bdfcb389e5f"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:01:19Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:01:19Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["8b7e784474461510a9d9970d39fe03c297fc6f9a5f80873c40898bdfcb389e5f"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"8b7e784474461510a9d9970d39fe03c297fc6f9a5f80873c40898bdfcb389e5f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:11.320Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-02T21:22:55Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:24:51Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:24:51Z"}],"name":"62457e23e29ce9b4e8380d685c5e9e84bc5137e91486a6f9c1c9e352ca3a021c","namespace":"kuadrant-system","resourceVersion":"32182","uid":"936dbe6b-e36f-400f-acdf-7cc9a61cfb98"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["62457e23e29ce9b4e8380d685c5e9e84bc5137e91486a6f9c1c9e352ca3a021c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:22:55Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:22:55Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["62457e23e29ce9b4e8380d685c5e9e84bc5137e91486a6f9c1c9e352ca3a021c"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"62457e23e29ce9b4e8380d685c5e9e84bc5137e91486a6f9c1c9e352ca3a021c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:11.382Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-02T22:20:06Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:26:26Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:26:26Z"}],"name":"85484301f7aa6f30a87b224096575af8d7beea83a8ccf5091f246a4cb028e31b","namespace":"kuadrant-system","resourceVersion":"128226","uid":"5da18c5c-0e1c-4cbb-ab01-5de3690348a2"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["85484301f7aa6f30a87b224096575af8d7beea83a8ccf5091f246a4cb028e31b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:20:07Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:20:07Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["85484301f7aa6f30a87b224096575af8d7beea83a8ccf5091f246a4cb028e31b"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"85484301f7aa6f30a87b224096575af8d7beea83a8ccf5091f246a4cb028e31b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:11.444Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-02T21:22:55Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:24:50Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:24:51Z"}],"name":"edbbdcfc920b88151941be1a4c41ad8be6a38bd6beddae7387db202bc3e9b302","namespace":"kuadrant-system","resourceVersion":"32161","uid":"70cbc54b-4023-42fa-99a1-5ed001f95e04"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["edbbdcfc920b88151941be1a4c41ad8be6a38bd6beddae7387db202bc3e9b302"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:24:51Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:24:51Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["edbbdcfc920b88151941be1a4c41ad8be6a38bd6beddae7387db202bc3e9b302"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"edbbdcfc920b88151941be1a4c41ad8be6a38bd6beddae7387db202bc3e9b302\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:11.506Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-02T21:22:56Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:24:52Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:24:52Z"}],"name":"206e50a9b0e5f83281f994d9f1d85f92406e3544297c47017c081f763b10dd96","namespace":"kuadrant-system","resourceVersion":"32218","uid":"476cf3fd-2228-43d0-b096-c1a4ea6ef6dc"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["206e50a9b0e5f83281f994d9f1d85f92406e3544297c47017c081f763b10dd96"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:22:56Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:22:56Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["206e50a9b0e5f83281f994d9f1d85f92406e3544297c47017c081f763b10dd96"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"206e50a9b0e5f83281f994d9f1d85f92406e3544297c47017c081f763b10dd96\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:11.568Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-02T21:27:22Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:27:22Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:27:22Z"}],"name":"8614fe473acb7380c1bbcefbfc7ddc49bdb08a20998450fd852a13de53bb8a12","namespace":"kuadrant-system","resourceVersion":"35787","uid":"9b6b870d-53a7-491d-b9de-ff8208baa9a9"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["8614fe473acb7380c1bbcefbfc7ddc49bdb08a20998450fd852a13de53bb8a12"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-5f765a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-5f765a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:27:22Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:27:22Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["8614fe473acb7380c1bbcefbfc7ddc49bdb08a20998450fd852a13de53bb8a12"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"8614fe473acb7380c1bbcefbfc7ddc49bdb08a20998450fd852a13de53bb8a12\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:11.629Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-02T21:26:10Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:26:10Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:26:10Z"}],"name":"7f1003cf42290c9494548cc907c9d6b31f90160185f5f9a729a625709fd1fb40","namespace":"kuadrant-system","resourceVersion":"34119","uid":"558a0bd9-ffad-4d87-be89-8b05c7ce1953"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["7f1003cf42290c9494548cc907c9d6b31f90160185f5f9a729a625709fd1fb40"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-5f765a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-5f765a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:26:10Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:26:10Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["7f1003cf42290c9494548cc907c9d6b31f90160185f5f9a729a625709fd1fb40"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"7f1003cf42290c9494548cc907c9d6b31f90160185f5f9a729a625709fd1fb40\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:11.690Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-02T22:20:06Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:26:27Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:26:27Z"}],"name":"92c755f42520a16c18887562f8b0dd82ce78b0c009a03cf56621703050a4589e","namespace":"kuadrant-system","resourceVersion":"128262","uid":"4f805ed8-566a-4c96-a876-680723a87aff"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["92c755f42520a16c18887562f8b0dd82ce78b0c009a03cf56621703050a4589e"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:20:06Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:20:06Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["92c755f42520a16c18887562f8b0dd82ce78b0c009a03cf56621703050a4589e"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"92c755f42520a16c18887562f8b0dd82ce78b0c009a03cf56621703050a4589e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:11.751Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-02T21:24:19Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:24:50Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:24:50Z"}],"name":"eadff6644620dd26a92e8dd1076b97db8fef2224eb03b70ce4e7ee1ef8dc0b30","namespace":"kuadrant-system","resourceVersion":"32129","uid":"e0e6175a-d793-401f-9e82-05a1a0af50b1"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["eadff6644620dd26a92e8dd1076b97db8fef2224eb03b70ce4e7ee1ef8dc0b30"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-5f765a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-5f765a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:24:20Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:24:20Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["eadff6644620dd26a92e8dd1076b97db8fef2224eb03b70ce4e7ee1ef8dc0b30"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"eadff6644620dd26a92e8dd1076b97db8fef2224eb03b70ce4e7ee1ef8dc0b30\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:11.812Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-02T21:27:59Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:27:59Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:27:59Z"}],"name":"828fe179b1caaef8c4abb4ba71cbe53ab31fc04108a1194889605dd8100c90f1","namespace":"kuadrant-system","resourceVersion":"36579","uid":"1f07dead-a4e1-4333-b00e-57cadeddc58f"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["828fe179b1caaef8c4abb4ba71cbe53ab31fc04108a1194889605dd8100c90f1"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:27:59Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:27:59Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["828fe179b1caaef8c4abb4ba71cbe53ab31fc04108a1194889605dd8100c90f1"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"828fe179b1caaef8c4abb4ba71cbe53ab31fc04108a1194889605dd8100c90f1\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:11.873Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-02T21:27:22Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:27:22Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:27:22Z"}],"name":"796ce8085bd3851fe6a6d0c9b4c29504c70e44da1ae3ea663bfc85d308b1e5b1","namespace":"kuadrant-system","resourceVersion":"35812","uid":"760abd62-e9bd-4acb-9088-2484e0184b2f"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["796ce8085bd3851fe6a6d0c9b4c29504c70e44da1ae3ea663bfc85d308b1e5b1"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-5f765a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-5f765a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:27:22Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:27:22Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["796ce8085bd3851fe6a6d0c9b4c29504c70e44da1ae3ea663bfc85d308b1e5b1"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"796ce8085bd3851fe6a6d0c9b4c29504c70e44da1ae3ea663bfc85d308b1e5b1\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:11.935Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-02T21:26:09Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:26:09Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:26:10Z"}],"name":"0623abc228b11818faa4a08b26d906ef498cb9511f2bcee2bcd7c9e8dbb0a23a","namespace":"kuadrant-system","resourceVersion":"34114","uid":"dc07afca-fc6a-433f-8e7a-3413000ba48a"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["0623abc228b11818faa4a08b26d906ef498cb9511f2bcee2bcd7c9e8dbb0a23a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-5f765a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-5f765a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:26:10Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:26:10Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["0623abc228b11818faa4a08b26d906ef498cb9511f2bcee2bcd7c9e8dbb0a23a"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"0623abc228b11818faa4a08b26d906ef498cb9511f2bcee2bcd7c9e8dbb0a23a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:11.996Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w0-0f0874/rate-test-model-0f0874-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w0-0f0874/rate-test-model-0f0874-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-02T22:21:56Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:27:44Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:27:45Z"}],"name":"21c045f9fd9a65bcf44bc04d3fcb17d52c1649c95ac1f90f68dd01492045074d","namespace":"kuadrant-system","resourceVersion":"130145","uid":"e0cf3311-db06-4066-9ec6-cbd372974947"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["21c045f9fd9a65bcf44bc04d3fcb17d52c1649c95ac1f90f68dd01492045074d"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:21:56Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:21:56Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["21c045f9fd9a65bcf44bc04d3fcb17d52c1649c95ac1f90f68dd01492045074d"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"21c045f9fd9a65bcf44bc04d3fcb17d52c1649c95ac1f90f68dd01492045074d\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:12.057Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-02T21:24:05Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:24:51Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:24:52Z"}],"name":"3ecbc6560d7cb2e5396471349d24b95ff664f3b33dfc188e590c2b772721287c","namespace":"kuadrant-system","resourceVersion":"32195","uid":"5c49ca35-f029-4c62-899f-3f85795536b9"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["3ecbc6560d7cb2e5396471349d24b95ff664f3b33dfc188e590c2b772721287c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:24:06Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:24:06Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["3ecbc6560d7cb2e5396471349d24b95ff664f3b33dfc188e590c2b772721287c"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"3ecbc6560d7cb2e5396471349d24b95ff664f3b33dfc188e590c2b772721287c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:12.123Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route#v1-messages-publisher-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"f1aeb859c1579aea92c81f985aec98129102bab0482185da8dd5e38bfdab1f31","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f1aeb859c1579aea92c81f985aec98129102bab0482185da8dd5e38bfdab1f31"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-a1d751.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-a1d751.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"f1aeb859c1579aea92c81f985aec98129102bab0482185da8dd5e38bfdab1f31\" already exists"}
{"level":"error","ts":"2026-11-02T22:30:12.184Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-02T21:23:14Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:24:51Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:24:52Z"}],"name":"c19827aa458f939a86c4dbefda3dabc4f554898dbb7e2f92b488060e9e90b5cc","namespace":"kuadrant-system","resourceVersion":"32199","uid":"b6fbbb1b-7e93-4852-b25d-989bb276740b"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["c19827aa458f939a86c4dbefda3dabc4f554898dbb7e2f92b488060e9e90b5cc"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-5f765a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-5f765a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:23:14Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:23:14Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["c19827aa458f939a86c4dbefda3dabc4f554898dbb7e2f92b488060e9e90b5cc"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"c19827aa458f939a86c4dbefda3dabc4f554898dbb7e2f92b488060e9e90b5cc\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:12.245Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-02T21:26:24Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:26:24Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:26:24Z"}],"name":"6ed7710bfd4535612b60aefac40ff2eebbe50fc666cc75f29a23130bdd6ea269","namespace":"kuadrant-system","resourceVersion":"34551","uid":"80225d5d-49a6-45fd-ada4-0ac6386dcbd1"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["6ed7710bfd4535612b60aefac40ff2eebbe50fc666cc75f29a23130bdd6ea269"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:26:24Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:26:24Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["6ed7710bfd4535612b60aefac40ff2eebbe50fc666cc75f29a23130bdd6ea269"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"6ed7710bfd4535612b60aefac40ff2eebbe50fc666cc75f29a23130bdd6ea269\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:12.307Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-02T21:26:10Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:26:10Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:26:10Z"}],"name":"bd641664cfab5eecac33b1ff0c46f78597ed896bbc4c7a81487d56141be11715","namespace":"kuadrant-system","resourceVersion":"34141","uid":"60f8f64e-d010-4440-9186-4f7883fe22b7"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["bd641664cfab5eecac33b1ff0c46f78597ed896bbc4c7a81487d56141be11715"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-5f765a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-5f765a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:26:10Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:26:10Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["bd641664cfab5eecac33b1ff0c46f78597ed896bbc4c7a81487d56141be11715"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"bd641664cfab5eecac33b1ff0c46f78597ed896bbc4c7a81487d56141be11715\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:12.369Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-02T21:26:24Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:26:24Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:26:25Z"}],"name":"e701c3e95fd6d7e3e60b9f162039289bbc904c42df899db9436b6ad7538d1ffc","namespace":"kuadrant-system","resourceVersion":"34554","uid":"d7fc0295-cc14-4202-8eab-010ef53aa67e"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["e701c3e95fd6d7e3e60b9f162039289bbc904c42df899db9436b6ad7538d1ffc"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:26:25Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:26:25Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["e701c3e95fd6d7e3e60b9f162039289bbc904c42df899db9436b6ad7538d1ffc"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"e701c3e95fd6d7e3e60b9f162039289bbc904c42df899db9436b6ad7538d1ffc\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:12.430Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w0-0f0874/rate-test-model-0f0874-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w0-0f0874/rate-test-model-0f0874-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-02T22:21:57Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:27:43Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:27:43Z"}],"name":"357c492c00cb28b26cd246d2e8f1f9086e6b25af6c039d953442c5371d3cf70a","namespace":"kuadrant-system","resourceVersion":"130084","uid":"0c7bf5de-371a-4758-9a1a-0b433aacd43a"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["357c492c00cb28b26cd246d2e8f1f9086e6b25af6c039d953442c5371d3cf70a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:27:43Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:27:43Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["357c492c00cb28b26cd246d2e8f1f9086e6b25af6c039d953442c5371d3cf70a"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"357c492c00cb28b26cd246d2e8f1f9086e6b25af6c039d953442c5371d3cf70a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:12.503Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-02T21:26:10Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:26:10Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:26:11Z"}],"name":"b4056adace047bf2186763869c2f6a0524a9534ef874733d3868dfd41db1a7c9","namespace":"kuadrant-system","resourceVersion":"34164","uid":"64897f31-3b2d-4928-9b9a-41ea900880c6"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["b4056adace047bf2186763869c2f6a0524a9534ef874733d3868dfd41db1a7c9"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-5f765a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-5f765a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:26:11Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:26:11Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["b4056adace047bf2186763869c2f6a0524a9534ef874733d3868dfd41db1a7c9"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"b4056adace047bf2186763869c2f6a0524a9534ef874733d3868dfd41db1a7c9\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:12.583Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w0-0f0874","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w0-0f0874#rule-2"},"creationTimestamp":"2026-11-02T21:56:34Z","generation":6,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:27:44Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:27:44Z"}],"name":"8ccf868b0c716a18e90e502ebb2284ce90d5ee3fcd5779be4d996fb8a3d03b43","namespace":"kuadrant-system","resourceVersion":"130107","uid":"0a0ee5ce-0c48-4c2d-85b6-4991d695d43a"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["8ccf868b0c716a18e90e502ebb2284ce90d5ee3fcd5779be4d996fb8a3d03b43"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:24:05Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:24:05Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["8ccf868b0c716a18e90e502ebb2284ce90d5ee3fcd5779be4d996fb8a3d03b43"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"8ccf868b0c716a18e90e502ebb2284ce90d5ee3fcd5779be4d996fb8a3d03b43\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:12.645Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-02T21:22:56Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:24:53Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:24:53Z"}],"name":"8abe3e629bd34674437803d6e54a0cb90fe0d0df12d2eac23f0b40d2f4990b37","namespace":"kuadrant-system","resourceVersion":"32279","uid":"b8c3580e-0274-48d3-a8f2-9f4895bfaf6a"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["8abe3e629bd34674437803d6e54a0cb90fe0d0df12d2eac23f0b40d2f4990b37"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:22:56Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:22:56Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["8abe3e629bd34674437803d6e54a0cb90fe0d0df12d2eac23f0b40d2f4990b37"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"8abe3e629bd34674437803d6e54a0cb90fe0d0df12d2eac23f0b40d2f4990b37\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:12.706Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-02T21:27:59Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:27:59Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:28:00Z"}],"name":"f27c742360d050f8cfba473367fd8076f0a6abdf57b30c6116d8b1fa7559bcc0","namespace":"kuadrant-system","resourceVersion":"36617","uid":"79dec2a1-3e87-468d-a3dd-43a0724b9ff2"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f27c742360d050f8cfba473367fd8076f0a6abdf57b30c6116d8b1fa7559bcc0"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:28:00Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:28:00Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["f27c742360d050f8cfba473367fd8076f0a6abdf57b30c6116d8b1fa7559bcc0"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"f27c742360d050f8cfba473367fd8076f0a6abdf57b30c6116d8b1fa7559bcc0\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:12.768Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-02T21:27:59Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:27:59Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:27:59Z"}],"name":"bc33498b2dcdc2f8d2612aa17c0e640458a4442c9d7f2ad45303aeb15b5bccb9","namespace":"kuadrant-system","resourceVersion":"36576","uid":"9c514f85-b383-45bf-84b0-9685b4e6d1cf"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["bc33498b2dcdc2f8d2612aa17c0e640458a4442c9d7f2ad45303aeb15b5bccb9"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:27:59Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:27:59Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["bc33498b2dcdc2f8d2612aa17c0e640458a4442c9d7f2ad45303aeb15b5bccb9"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"bc33498b2dcdc2f8d2612aa17c0e640458a4442c9d7f2ad45303aeb15b5bccb9\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:12.829Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-02T21:22:55Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:24:51Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:24:52Z"}],"name":"2538346ffaabe171687c406d12f294530661f7690a04d14ab2327034447b1886","namespace":"kuadrant-system","resourceVersion":"32233","uid":"05cb975f-d02e-4951-9333-3f89f3ef288b"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["2538346ffaabe171687c406d12f294530661f7690a04d14ab2327034447b1886"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:24:52Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:24:52Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["2538346ffaabe171687c406d12f294530661f7690a04d14ab2327034447b1886"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"2538346ffaabe171687c406d12f294530661f7690a04d14ab2327034447b1886\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:12.891Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-02T21:24:06Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:24:52Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:24:53Z"}],"name":"1ce9b189744d237515a1896d038a3437e8e31669b01937d8cf3a067728ee7e82","namespace":"kuadrant-system","resourceVersion":"32253","uid":"eec4db85-03c1-411c-b38a-54812141e9a2"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["1ce9b189744d237515a1896d038a3437e8e31669b01937d8cf3a067728ee7e82"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:24:07Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:24:07Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["1ce9b189744d237515a1896d038a3437e8e31669b01937d8cf3a067728ee7e82"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"1ce9b189744d237515a1896d038a3437e8e31669b01937d8cf3a067728ee7e82\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:12.952Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-02T21:27:59Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:27:59Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:27:59Z"}],"name":"313f15eb64d50822c9c91871179d7a6ffa3111f658f213fdc0612575f480add7","namespace":"kuadrant-system","resourceVersion":"36599","uid":"5f10db8f-2a6c-4f81-8173-aa3fab58e3b6"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["313f15eb64d50822c9c91871179d7a6ffa3111f658f213fdc0612575f480add7"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:27:59Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:27:59Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["313f15eb64d50822c9c91871179d7a6ffa3111f658f213fdc0612575f480add7"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"313f15eb64d50822c9c91871179d7a6ffa3111f658f213fdc0612575f480add7\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:13.014Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-02T21:27:59Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:27:59Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:27:59Z"}],"name":"c17d6c6438d8754832a843b7a082fa7fc719ecd30696a3551f3ca815dd52f28b","namespace":"kuadrant-system","resourceVersion":"36572","uid":"07a6a67c-69be-46bf-982c-9e38b2d187d7"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["c17d6c6438d8754832a843b7a082fa7fc719ecd30696a3551f3ca815dd52f28b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:27:59Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:27:59Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["c17d6c6438d8754832a843b7a082fa7fc719ecd30696a3551f3ca815dd52f28b"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"c17d6c6438d8754832a843b7a082fa7fc719ecd30696a3551f3ca815dd52f28b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:13.075Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-02T21:24:19Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:24:53Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:24:53Z"}],"name":"c4c89ab332c30b38dc4f16ef73fecdbd0ef26ff23424b1e8fd0d18c2d45cf73d","namespace":"kuadrant-system","resourceVersion":"32268","uid":"5ef5fade-8635-41bf-be84-bb58229371f5"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["c4c89ab332c30b38dc4f16ef73fecdbd0ef26ff23424b1e8fd0d18c2d45cf73d"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-5f765a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-5f765a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:24:19Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:24:19Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["c4c89ab332c30b38dc4f16ef73fecdbd0ef26ff23424b1e8fd0d18c2d45cf73d"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"c4c89ab332c30b38dc4f16ef73fecdbd0ef26ff23424b1e8fd0d18c2d45cf73d\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:13.136Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-02T21:27:21Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:27:21Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:27:21Z"}],"name":"4ff864a27b8c6cdd9a746e87a7d53b4055daacec9650360ef6d48d5964395d3f","namespace":"kuadrant-system","resourceVersion":"35750","uid":"02094cf0-cc79-4096-8673-aefec2d6f201"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["4ff864a27b8c6cdd9a746e87a7d53b4055daacec9650360ef6d48d5964395d3f"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-5f765a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-5f765a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:27:21Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:27:21Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["4ff864a27b8c6cdd9a746e87a7d53b4055daacec9650360ef6d48d5964395d3f"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"4ff864a27b8c6cdd9a746e87a7d53b4055daacec9650360ef6d48d5964395d3f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:13.198Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-02T21:24:19Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:24:54Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:24:54Z"}],"name":"e1e7c7c242c339c99da1caa3f217a7bd53ffc78a71bee9a0e898d1f0b8471fb3","namespace":"kuadrant-system","resourceVersion":"32306","uid":"6eb75529-bcfd-43e6-8f31-95eb78b3d93f"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["e1e7c7c242c339c99da1caa3f217a7bd53ffc78a71bee9a0e898d1f0b8471fb3"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-5f765a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-5f765a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:24:20Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:24:20Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["e1e7c7c242c339c99da1caa3f217a7bd53ffc78a71bee9a0e898d1f0b8471fb3"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"e1e7c7c242c339c99da1caa3f217a7bd53ffc78a71bee9a0e898d1f0b8471fb3\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:13.259Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-02T21:27:21Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:27:21Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:27:21Z"}],"name":"b7e1694df51b77341405c6097e6d1487bf70a48e8a95816d2cfc62e5ddd6a999","namespace":"kuadrant-system","resourceVersion":"35770","uid":"121f0471-4d0e-4c06-9ab8-b622698abacc"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["b7e1694df51b77341405c6097e6d1487bf70a48e8a95816d2cfc62e5ddd6a999"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-5f765a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-5f765a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:27:21Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:27:21Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["b7e1694df51b77341405c6097e6d1487bf70a48e8a95816d2cfc62e5ddd6a999"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"b7e1694df51b77341405c6097e6d1487bf70a48e8a95816d2cfc62e5ddd6a999\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:13.320Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-02T21:24:19Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:24:52Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:24:52Z"}],"name":"9f6fc629fa43de74b0fb261de7e8b46fbdfe4f21235446879cd916210856d6f0","namespace":"kuadrant-system","resourceVersion":"32224","uid":"8f18ff86-38a2-433c-b455-9e97eae9d591"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["9f6fc629fa43de74b0fb261de7e8b46fbdfe4f21235446879cd916210856d6f0"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-5f765a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-5f765a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:24:19Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:24:19Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["9f6fc629fa43de74b0fb261de7e8b46fbdfe4f21235446879cd916210856d6f0"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"9f6fc629fa43de74b0fb261de7e8b46fbdfe4f21235446879cd916210856d6f0\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:13.386Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route#v1-messages-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"9593847662171f6a7915c575284c678f049381a1160493b136f5566f61950b7f","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["9593847662171f6a7915c575284c678f049381a1160493b136f5566f61950b7f"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-a1d751.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-a1d751.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"9593847662171f6a7915c575284c678f049381a1160493b136f5566f61950b7f\" already exists"}
{"level":"error","ts":"2026-11-02T22:30:13.450Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w0-0f0874/rate-test-model-0f0874-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w0-0f0874/rate-test-model-0f0874-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-02T22:21:58Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:27:43Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:27:43Z"}],"name":"16fa7701b7d425ecd2db71ef9158baee753a6f3a0a2da1c3b4f412045e679280","namespace":"kuadrant-system","resourceVersion":"130088","uid":"482db935-1ba8-421c-b4b5-5cc3a13666a7"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["16fa7701b7d425ecd2db71ef9158baee753a6f3a0a2da1c3b4f412045e679280"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:27:43Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:27:43Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["16fa7701b7d425ecd2db71ef9158baee753a6f3a0a2da1c3b4f412045e679280"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"16fa7701b7d425ecd2db71ef9158baee753a6f3a0a2da1c3b4f412045e679280\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:13.512Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-02T21:27:59Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:27:59Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:28:00Z"}],"name":"5cddd3e1918c7df14f710eb09cebc745d043be6f81e6c1e1f2a3803e2f0c6513","namespace":"kuadrant-system","resourceVersion":"36606","uid":"95a5912e-a9d4-4dfa-9434-305810a99bee"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["5cddd3e1918c7df14f710eb09cebc745d043be6f81e6c1e1f2a3803e2f0c6513"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:27:59Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:27:59Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["5cddd3e1918c7df14f710eb09cebc745d043be6f81e6c1e1f2a3803e2f0c6513"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"5cddd3e1918c7df14f710eb09cebc745d043be6f81e6c1e1f2a3803e2f0c6513\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:13.575Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-02T21:23:13Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:24:51Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:24:51Z"}],"name":"58ba249888c7ebfedfcb5aec9df19d4b07d2856710ac2163dcc961a176311fa9","namespace":"kuadrant-system","resourceVersion":"32174","uid":"be557877-5eca-4c50-80be-9718677685c9"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["58ba249888c7ebfedfcb5aec9df19d4b07d2856710ac2163dcc961a176311fa9"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-5f765a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-5f765a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:23:13Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:23:13Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["58ba249888c7ebfedfcb5aec9df19d4b07d2856710ac2163dcc961a176311fa9"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"58ba249888c7ebfedfcb5aec9df19d4b07d2856710ac2163dcc961a176311fa9\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:13.642Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route#v1-catch-all-path"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"1db7db8718ec954ecf16b0d35140cb8a1c89f0173590ed683bbb861f8380c6f1","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["1db7db8718ec954ecf16b0d35140cb8a1c89f0173590ed683bbb861f8380c6f1"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-a1d751.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-a1d751.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"1db7db8718ec954ecf16b0d35140cb8a1c89f0173590ed683bbb861f8380c6f1\" already exists"}
{"level":"info","ts":"2026-11-02T22:30:13Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-worker-w4-d6cb38","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-worker-w4-d6cb38","reconcileID":"c4ebfbe8-cf77-4b8b-a6c4-5a9119565a11","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-worker-w4-d6cb38","namespace":"openshift-ingress"}
{"level":"error","ts":"2026-11-02T22:30:13.703Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-02T21:23:13Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:24:54Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:24:54Z"}],"name":"784ccec783ba11c98817fe5af2849f9f4970be19046e351a067c85add913f548","namespace":"kuadrant-system","resourceVersion":"32325","uid":"43ab3219-5378-49ee-bb5c-e54ae5a3039b"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["784ccec783ba11c98817fe5af2849f9f4970be19046e351a067c85add913f548"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-5f765a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-5f765a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:24:54Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:24:54Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["784ccec783ba11c98817fe5af2849f9f4970be19046e351a067c85add913f548"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"784ccec783ba11c98817fe5af2849f9f4970be19046e351a067c85add913f548\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:30:13Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-worker-w4-d6cb38","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T22:30:13Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T22:30:13Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-11-02T22:30:13Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"error","ts":"2026-11-02T22:30:13.766Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-02T21:23:13Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:24:52Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:24:52Z"}],"name":"bcf0aab5299349f1dd1df89a10a558ad5617afdfb0f30d972811f3dbb51b1ea5","namespace":"kuadrant-system","resourceVersion":"32238","uid":"af65fdcb-b20a-487d-a3c5-63b107bde1d1"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["bcf0aab5299349f1dd1df89a10a558ad5617afdfb0f30d972811f3dbb51b1ea5"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-5f765a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-5f765a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:23:13Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:23:13Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["bcf0aab5299349f1dd1df89a10a558ad5617afdfb0f30d972811f3dbb51b1ea5"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"bcf0aab5299349f1dd1df89a10a558ad5617afdfb0f30d972811f3dbb51b1ea5\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:13.827Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-02T21:26:24Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:26:24Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:26:24Z"}],"name":"5ea067858e444716d33ddecbe718b086e12804ce72bba0a6f135b64fb1bb1c60","namespace":"kuadrant-system","resourceVersion":"34543","uid":"ecd02177-c9a4-4467-b399-7b17c140d9f7"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["5ea067858e444716d33ddecbe718b086e12804ce72bba0a6f135b64fb1bb1c60"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:26:24Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:26:24Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["5ea067858e444716d33ddecbe718b086e12804ce72bba0a6f135b64fb1bb1c60"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"5ea067858e444716d33ddecbe718b086e12804ce72bba0a6f135b64fb1bb1c60\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:30:13Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-11-02T22:30:13Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-worker-w4-d6cb38","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-worker-w4-d6cb38","reconcileID":"c4ebfbe8-cf77-4b8b-a6c4-5a9119565a11","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-worker-w4-d6cb38","namespace":"openshift-ingress"}
{"level":"error","ts":"2026-11-02T22:30:13.890Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-02T21:26:10Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:26:10Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:26:10Z"}],"name":"8e06ac6cbf5999144a3b0f3b2584acaac3b4eb8d03d892bc45e03712448c4a9c","namespace":"kuadrant-system","resourceVersion":"34146","uid":"07ca1be0-f0da-41be-bc04-f2a164ffde5c"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["8e06ac6cbf5999144a3b0f3b2584acaac3b4eb8d03d892bc45e03712448c4a9c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-5f765a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-5f765a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:26:10Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:26:10Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["8e06ac6cbf5999144a3b0f3b2584acaac3b4eb8d03d892bc45e03712448c4a9c"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"8e06ac6cbf5999144a3b0f3b2584acaac3b4eb8d03d892bc45e03712448c4a9c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:30:13Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-worker-w4-d6cb38","event":"DELETE"}
{"level":"info","ts":"2026-11-02T22:30:13Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-02T22:30:13Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-worker-w4-d6cb38\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-02T22:30:13Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"error","ts":"2026-11-02T22:30:13.951Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-02T21:22:55Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:24:52Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:24:52Z"}],"name":"60ca770315801fd35b67ab23639ba4ac6a344fcf95fe492c267cc87cb90ce14f","namespace":"kuadrant-system","resourceVersion":"32226","uid":"b889042a-a2fe-4f6d-b497-064f16b9a0f1"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["60ca770315801fd35b67ab23639ba4ac6a344fcf95fe492c267cc87cb90ce14f"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:22:56Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:22:56Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["60ca770315801fd35b67ab23639ba4ac6a344fcf95fe492c267cc87cb90ce14f"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"60ca770315801fd35b67ab23639ba4ac6a344fcf95fe492c267cc87cb90ce14f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:14.013Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-02T21:22:55Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:24:53Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:24:53Z"}],"name":"1f83c46a7c87c216ad3b7a3697a1ad6c518cb36972a910efbc3c7eed6ab3956a","namespace":"kuadrant-system","resourceVersion":"32255","uid":"b93910f9-688d-40e6-8398-ba70e28c8c56"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["1f83c46a7c87c216ad3b7a3697a1ad6c518cb36972a910efbc3c7eed6ab3956a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:22:56Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:22:56Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["1f83c46a7c87c216ad3b7a3697a1ad6c518cb36972a910efbc3c7eed6ab3956a"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"1f83c46a7c87c216ad3b7a3697a1ad6c518cb36972a910efbc3c7eed6ab3956a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:14.074Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-02T21:27:58Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:27:58Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:27:58Z"}],"name":"d4fbd382871bb4f5406c37842f4848012cdca0b01e2d7698dc28e396dc18659d","namespace":"kuadrant-system","resourceVersion":"36560","uid":"1045e5b6-a98b-46c5-9d7e-795de0f91e53"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d4fbd382871bb4f5406c37842f4848012cdca0b01e2d7698dc28e396dc18659d"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:27:58Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:27:58Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["d4fbd382871bb4f5406c37842f4848012cdca0b01e2d7698dc28e396dc18659d"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"d4fbd382871bb4f5406c37842f4848012cdca0b01e2d7698dc28e396dc18659d\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:14.137Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-02T21:26:25Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:26:25Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:26:25Z"}],"name":"739e19d51d8fbdeccfc8bc7587afd12132239f688ec6cf8d9586f242a71087f7","namespace":"kuadrant-system","resourceVersion":"34580","uid":"e5f77714-e8fa-48a7-8071-b9c53b3e732c"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["739e19d51d8fbdeccfc8bc7587afd12132239f688ec6cf8d9586f242a71087f7"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:26:25Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:26:25Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["739e19d51d8fbdeccfc8bc7587afd12132239f688ec6cf8d9586f242a71087f7"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"739e19d51d8fbdeccfc8bc7587afd12132239f688ec6cf8d9586f242a71087f7\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:14.201Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-02T21:24:19Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:24:54Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:24:54Z"}],"name":"505545a95fce131db80f848e9990387e6b3e42a2f7e2375f56bbc07efcac9723","namespace":"kuadrant-system","resourceVersion":"32302","uid":"ec050181-dffb-42d7-bd32-28b5712e49c3"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["505545a95fce131db80f848e9990387e6b3e42a2f7e2375f56bbc07efcac9723"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-5f765a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-5f765a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:24:20Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:24:20Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["505545a95fce131db80f848e9990387e6b3e42a2f7e2375f56bbc07efcac9723"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"505545a95fce131db80f848e9990387e6b3e42a2f7e2375f56bbc07efcac9723\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:14.262Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-02T21:24:19Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:24:52Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:24:53Z"}],"name":"b8fb7aae7cac121f592817a5e9754983e04e46d9e4226183153bf83b778fffdd","namespace":"kuadrant-system","resourceVersion":"32250","uid":"0acd69ca-9382-45b0-970e-3bf2adca1150"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["b8fb7aae7cac121f592817a5e9754983e04e46d9e4226183153bf83b778fffdd"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-5f765a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-5f765a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:24:19Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:24:19Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["b8fb7aae7cac121f592817a5e9754983e04e46d9e4226183153bf83b778fffdd"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"b8fb7aae7cac121f592817a5e9754983e04e46d9e4226183153bf83b778fffdd\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:14.325Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-02T21:23:13Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:24:54Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:24:54Z"}],"name":"0768841c9057075fe648e2fa67028e1fc0bee839efdd3e78e081dac6a9e13397","namespace":"kuadrant-system","resourceVersion":"32299","uid":"17b657dc-b679-4d15-ab7f-fb21d3a65b4f"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["0768841c9057075fe648e2fa67028e1fc0bee839efdd3e78e081dac6a9e13397"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-5f765a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-5f765a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:23:13Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:23:13Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["0768841c9057075fe648e2fa67028e1fc0bee839efdd3e78e081dac6a9e13397"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"0768841c9057075fe648e2fa67028e1fc0bee839efdd3e78e081dac6a9e13397\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:14.386Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-02T21:26:10Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:26:10Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:26:10Z"}],"name":"dc6825eadf840da0185447dcfb22803683fc39051aa637aea7a66d081b192bf7","namespace":"kuadrant-system","resourceVersion":"34144","uid":"caee39e9-c549-455d-a9e0-d1971951f59d"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["dc6825eadf840da0185447dcfb22803683fc39051aa637aea7a66d081b192bf7"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-5f765a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-5f765a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:26:10Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:26:10Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["dc6825eadf840da0185447dcfb22803683fc39051aa637aea7a66d081b192bf7"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"dc6825eadf840da0185447dcfb22803683fc39051aa637aea7a66d081b192bf7\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:14.448Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-02T21:27:21Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:27:21Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:27:21Z"}],"name":"98aca426d9ec5ae558219406a36e9375b2e6291ddc5e73bd3960b21edfe258cd","namespace":"kuadrant-system","resourceVersion":"35767","uid":"ac3c08c0-d13a-40d7-825f-bbd8aa6e4727"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["98aca426d9ec5ae558219406a36e9375b2e6291ddc5e73bd3960b21edfe258cd"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-5f765a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-5f765a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:27:21Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:27:21Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["98aca426d9ec5ae558219406a36e9375b2e6291ddc5e73bd3960b21edfe258cd"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"98aca426d9ec5ae558219406a36e9375b2e6291ddc5e73bd3960b21edfe258cd\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:14.510Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-02T21:22:55Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:24:51Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:24:51Z"}],"name":"503064d3f84a23711f1dad5e35d11ef1efceaefb2204608d180ef8d886666ffa","namespace":"kuadrant-system","resourceVersion":"32160","uid":"a294abe8-fc3f-4de0-a8c6-42def0d3b86a"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["503064d3f84a23711f1dad5e35d11ef1efceaefb2204608d180ef8d886666ffa"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:22:55Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:22:55Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["503064d3f84a23711f1dad5e35d11ef1efceaefb2204608d180ef8d886666ffa"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"503064d3f84a23711f1dad5e35d11ef1efceaefb2204608d180ef8d886666ffa\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:14.572Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-02T22:20:07Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:26:25Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:26:26Z"}],"name":"ad5aa9665d52830893fb4af1a6c52222eff28c5437dcf9fe501cab6f82aeaea0","namespace":"kuadrant-system","resourceVersion":"128195","uid":"26290c3a-7ad9-46a3-877e-afa01d04ea68"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["ad5aa9665d52830893fb4af1a6c52222eff28c5437dcf9fe501cab6f82aeaea0"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:20:07Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:20:07Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["ad5aa9665d52830893fb4af1a6c52222eff28c5437dcf9fe501cab6f82aeaea0"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"ad5aa9665d52830893fb4af1a6c52222eff28c5437dcf9fe501cab6f82aeaea0\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:14.639Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"0b94d900a5cdf5c531935a5db6b720c905f8b8e2c62caaf31136dacaca42afc8","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["0b94d900a5cdf5c531935a5db6b720c905f8b8e2c62caaf31136dacaca42afc8"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-a1d751.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-a1d751.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"0b94d900a5cdf5c531935a5db6b720c905f8b8e2c62caaf31136dacaca42afc8\" already exists"}
{"level":"error","ts":"2026-11-02T22:30:14.700Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-02T22:20:06Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:26:26Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:26:26Z"}],"name":"55a7427f941cf70e3504be7b1faaabc3224d15aa575a45663edd720843ebc89b","namespace":"kuadrant-system","resourceVersion":"128210","uid":"54b42902-3737-48d5-91b1-019b310945f2"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["55a7427f941cf70e3504be7b1faaabc3224d15aa575a45663edd720843ebc89b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:20:07Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:20:07Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["55a7427f941cf70e3504be7b1faaabc3224d15aa575a45663edd720843ebc89b"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"55a7427f941cf70e3504be7b1faaabc3224d15aa575a45663edd720843ebc89b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:14.764Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-02T21:23:13Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:24:50Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:24:50Z"}],"name":"0b8fd96f5e30886bce6ea837ac57b2f3d77783c525b1de469227d248ca2a1d6e","namespace":"kuadrant-system","resourceVersion":"32104","uid":"a025d410-cede-4df7-81b3-550d7d3dbc41"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["0b8fd96f5e30886bce6ea837ac57b2f3d77783c525b1de469227d248ca2a1d6e"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-5f765a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-5f765a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:23:13Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:23:13Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["0b8fd96f5e30886bce6ea837ac57b2f3d77783c525b1de469227d248ca2a1d6e"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"0b8fd96f5e30886bce6ea837ac57b2f3d77783c525b1de469227d248ca2a1d6e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:14.826Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-02T21:24:19Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:24:53Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:24:54Z"}],"name":"9112a3b536f3eb5f79a5b52d0ee8a7a26d3700b295f3ce2775128d2841f01ff4","namespace":"kuadrant-system","resourceVersion":"32296","uid":"ea3ebdec-0033-4bba-b81f-25ab556708a1"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["9112a3b536f3eb5f79a5b52d0ee8a7a26d3700b295f3ce2775128d2841f01ff4"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-5f765a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-5f765a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:24:19Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:24:19Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["9112a3b536f3eb5f79a5b52d0ee8a7a26d3700b295f3ce2775128d2841f01ff4"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"9112a3b536f3eb5f79a5b52d0ee8a7a26d3700b295f3ce2775128d2841f01ff4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:14.888Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-02T21:27:21Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:27:21Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:27:21Z"}],"name":"4afb168c7cbb67555e268bc246b8eeeba53cda69691eb181663c1375ab099775","namespace":"kuadrant-system","resourceVersion":"35775","uid":"1c02e46f-1cf9-4772-8eff-9af5257fbe48"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["4afb168c7cbb67555e268bc246b8eeeba53cda69691eb181663c1375ab099775"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-5f765a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-5f765a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:27:21Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:27:21Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["4afb168c7cbb67555e268bc246b8eeeba53cda69691eb181663c1375ab099775"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"4afb168c7cbb67555e268bc246b8eeeba53cda69691eb181663c1375ab099775\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:14.950Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-02T21:27:21Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:27:21Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:27:22Z"}],"name":"36a5aec7d5b7178c754711c0ad90ec391fbc4764ff98bc952ff9d4d46a3e1fad","namespace":"kuadrant-system","resourceVersion":"35780","uid":"961fd58c-a8fa-47e0-a48f-ca79edf3fd92"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["36a5aec7d5b7178c754711c0ad90ec391fbc4764ff98bc952ff9d4d46a3e1fad"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-5f765a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-5f765a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:27:22Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:27:22Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["36a5aec7d5b7178c754711c0ad90ec391fbc4764ff98bc952ff9d4d46a3e1fad"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"36a5aec7d5b7178c754711c0ad90ec391fbc4764ff98bc952ff9d4d46a3e1fad\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:15.012Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-02T21:24:19Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:24:53Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:24:53Z"}],"name":"db6f9ff18eeb49f1421400a53d101cb100b1a88466190b46fb6dbed22a42e073","namespace":"kuadrant-system","resourceVersion":"32280","uid":"f9192177-6a2d-4c5b-b7e1-1c9c379f4da2"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["db6f9ff18eeb49f1421400a53d101cb100b1a88466190b46fb6dbed22a42e073"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-5f765a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-5f765a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:24:20Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:24:20Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["db6f9ff18eeb49f1421400a53d101cb100b1a88466190b46fb6dbed22a42e073"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"db6f9ff18eeb49f1421400a53d101cb100b1a88466190b46fb6dbed22a42e073\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:15.075Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w0-0f0874/rate-test-model-0f0874-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w0-0f0874/rate-test-model-0f0874-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-02T22:21:56Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:27:45Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:27:45Z"}],"name":"a7d80a75dae47b36245f18223c45bf04ddce116b33459885543e64da9d9d1caa","namespace":"kuadrant-system","resourceVersion":"130155","uid":"e50df1e7-1125-43ab-b2f5-35068561424f"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a7d80a75dae47b36245f18223c45bf04ddce116b33459885543e64da9d9d1caa"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:24:06Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:24:06Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["a7d80a75dae47b36245f18223c45bf04ddce116b33459885543e64da9d9d1caa"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a7d80a75dae47b36245f18223c45bf04ddce116b33459885543e64da9d9d1caa\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:15.138Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-02T21:24:05Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:24:51Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:24:51Z"}],"name":"0947683a63afc3251194a3b586cb934b1350dcaa171c4fd826d6773a00d5cf2a","namespace":"kuadrant-system","resourceVersion":"32192","uid":"70a072f3-f31d-4c6d-a36b-292cd2a897b2"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["0947683a63afc3251194a3b586cb934b1350dcaa171c4fd826d6773a00d5cf2a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:24:51Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:24:51Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["0947683a63afc3251194a3b586cb934b1350dcaa171c4fd826d6773a00d5cf2a"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"0947683a63afc3251194a3b586cb934b1350dcaa171c4fd826d6773a00d5cf2a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:15.200Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-02T21:26:25Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:26:25Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:26:25Z"}],"name":"881b63d46f0e94053b88caefbfd71fdab183199879cb564ccb3671b6189fcc2e","namespace":"kuadrant-system","resourceVersion":"34582","uid":"49353857-1ff4-48f7-ac12-29e937ebe997"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["881b63d46f0e94053b88caefbfd71fdab183199879cb564ccb3671b6189fcc2e"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:26:25Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:26:25Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["881b63d46f0e94053b88caefbfd71fdab183199879cb564ccb3671b6189fcc2e"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"881b63d46f0e94053b88caefbfd71fdab183199879cb564ccb3671b6189fcc2e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:15.262Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-6fa533/premium-w2-6fa533-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-02T21:24:06Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:24:51Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:24:51Z"}],"name":"8f50bf1a21545f68eb583e07935b8b0da52bbc4743a8bc67c4d9545b76da56af","namespace":"kuadrant-system","resourceVersion":"32189","uid":"e34ce189-3763-4611-9fa1-ed81de274e2a"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["8f50bf1a21545f68eb583e07935b8b0da52bbc4743a8bc67c4d9545b76da56af"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:24:06Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:24:06Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["8f50bf1a21545f68eb583e07935b8b0da52bbc4743a8bc67c4d9545b76da56af"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"8f50bf1a21545f68eb583e07935b8b0da52bbc4743a8bc67c4d9545b76da56af\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:15.323Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w0-0f0874/rate-test-model-0f0874-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w0-0f0874/rate-test-model-0f0874-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-02T22:21:58Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:27:46Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:27:46Z"}],"name":"3d0d554392a2c25a1ce426beeffb3f2b91339d1b96f1197bf10fe0af0ece726b","namespace":"kuadrant-system","resourceVersion":"130198","uid":"6f10de51-18d9-4a45-9831-4605fae4d2e7"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["3d0d554392a2c25a1ce426beeffb3f2b91339d1b96f1197bf10fe0af0ece726b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w0-0f0874.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:21:58Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:21:58Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["3d0d554392a2c25a1ce426beeffb3f2b91339d1b96f1197bf10fe0af0ece726b"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"3d0d554392a2c25a1ce426beeffb3f2b91339d1b96f1197bf10fe0af0ece726b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:15.384Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-02T22:20:06Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:26:26Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:26:27Z"}],"name":"04ef5a9f5a54464f8dc13ab6c0af24178bef36e48dd84e92297e1f685bae9a8a","namespace":"kuadrant-system","resourceVersion":"128247","uid":"aa94e7ae-a29f-4493-87ea-5503587726b6"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["04ef5a9f5a54464f8dc13ab6c0af24178bef36e48dd84e92297e1f685bae9a8a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:23:02Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:23:02Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["04ef5a9f5a54464f8dc13ab6c0af24178bef36e48dd84e92297e1f685bae9a8a"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"04ef5a9f5a54464f8dc13ab6c0af24178bef36e48dd84e92297e1f685bae9a8a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:15.448Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w1-5f765a/distinct-2-w1-5f765a-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-02T21:27:21Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:27:21Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:27:21Z"}],"name":"37f7dad0ca5234ce11642187ba11e681aa288a9b2a62a6d47b06de5fa5c385ed","namespace":"kuadrant-system","resourceVersion":"35757","uid":"48d310fa-b2f5-4fb2-bea0-b85c295a0c01"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["37f7dad0ca5234ce11642187ba11e681aa288a9b2a62a6d47b06de5fa5c385ed"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-5f765a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-5f765a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:27:21Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:27:21Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["37f7dad0ca5234ce11642187ba11e681aa288a9b2a62a6d47b06de5fa5c385ed"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"37f7dad0ca5234ce11642187ba11e681aa288a9b2a62a6d47b06de5fa5c385ed\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:15.510Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-6fa533/simulator-w2-6fa533-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-02T21:22:55Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:24:50Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:24:50Z"}],"name":"41e99bc62a2ac4e8034135f4b655088597f627c66b2efc4627394d148bc2b0ce","namespace":"kuadrant-system","resourceVersion":"32123","uid":"2feb5a09-5cd8-4419-a0d7-9df0c0da123d"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["41e99bc62a2ac4e8034135f4b655088597f627c66b2efc4627394d148bc2b0ce"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:22:55Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:22:55Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["41e99bc62a2ac4e8034135f4b655088597f627c66b2efc4627394d148bc2b0ce"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"41e99bc62a2ac4e8034135f4b655088597f627c66b2efc4627394d148bc2b0ce\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:15.572Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-02T21:27:58Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:27:58Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:27:59Z"}],"name":"7be093b94c77d8e466548a812b2fd67ba6e4cdbef2e705474d1a124d26a40f56","namespace":"kuadrant-system","resourceVersion":"36562","uid":"bbf2e9e6-adaf-40cb-b40a-1645d7799c64"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["7be093b94c77d8e466548a812b2fd67ba6e4cdbef2e705474d1a124d26a40f56"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:27:58Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:27:58Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["7be093b94c77d8e466548a812b2fd67ba6e4cdbef2e705474d1a124d26a40f56"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"7be093b94c77d8e466548a812b2fd67ba6e4cdbef2e705474d1a124d26a40f56\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:15.634Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-02T21:27:59Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:27:59Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:27:59Z"}],"name":"8f577e4cdeda37406cbf43b607fe4ff7a6bd85c0d3b2c53a45b82a9207f437f9","namespace":"kuadrant-system","resourceVersion":"36588","uid":"551fcbee-df72-41b3-b465-afcd34ebfdb8"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["8f577e4cdeda37406cbf43b607fe4ff7a6bd85c0d3b2c53a45b82a9207f437f9"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:27:59Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:27:59Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["8f577e4cdeda37406cbf43b607fe4ff7a6bd85c0d3b2c53a45b82a9207f437f9"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"8f577e4cdeda37406cbf43b607fe4ff7a6bd85c0d3b2c53a45b82a9207f437f9\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:15.695Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w1-5f765a/simulator-w1-5f765a-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-02T21:23:13Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:24:52Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:24:52Z"}],"name":"b6a8f91d1ffdf775c75f2a1c84bb520696572aea4d3ece8ed9123766f347b2eb","namespace":"kuadrant-system","resourceVersion":"32240","uid":"1193fc44-d6fb-4c14-bf75-2d708be5e9b4"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["b6a8f91d1ffdf775c75f2a1c84bb520696572aea4d3ece8ed9123766f347b2eb"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-5f765a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-5f765a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:23:13Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:23:13Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["b6a8f91d1ffdf775c75f2a1c84bb520696572aea4d3ece8ed9123766f347b2eb"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"b6a8f91d1ffdf775c75f2a1c84bb520696572aea4d3ece8ed9123766f347b2eb\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:15.757Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-6fa533/distinct-2-w2-6fa533-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-02T21:27:59Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:27:59Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:28:00Z"}],"name":"b3a9fbda204f0b6bfe85682d0fee9fd7a9712977e22af554d2d82ba07f1a075a","namespace":"kuadrant-system","resourceVersion":"36622","uid":"258cc997-3a88-42a7-9b1e-1eba29a60fdc"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["b3a9fbda204f0b6bfe85682d0fee9fd7a9712977e22af554d2d82ba07f1a075a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:28:00Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:28:00Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["b3a9fbda204f0b6bfe85682d0fee9fd7a9712977e22af554d2d82ba07f1a075a"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"b3a9fbda204f0b6bfe85682d0fee9fd7a9712977e22af554d2d82ba07f1a075a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:15.818Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w2-6fa533/distinct-w2-6fa533-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-02T21:26:25Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:26:25Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:26:25Z"}],"name":"13cb74b6bdfe9b2af39effc13c9d5ade5172cb10a5930c6aefbe733c0ab0cad4","namespace":"kuadrant-system","resourceVersion":"34573","uid":"d5cd2ad8-fe9f-4ad2-acdb-affbf3282901"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["13cb74b6bdfe9b2af39effc13c9d5ade5172cb10a5930c6aefbe733c0ab0cad4"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w2-6fa533.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:26:25Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:26:25Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["13cb74b6bdfe9b2af39effc13c9d5ade5172cb10a5930c6aefbe733c0ab0cad4"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"13cb74b6bdfe9b2af39effc13c9d5ade5172cb10a5930c6aefbe733c0ab0cad4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:15.881Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-02T21:26:10Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:26:10Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:26:10Z"}],"name":"b0ee4efc66d9a6e357c482407ac7794ac3e2e51168e28a743b633a36b12f1489","namespace":"kuadrant-system","resourceVersion":"34155","uid":"ba90375d-ccef-4414-a780-acd2e09d5094"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["b0ee4efc66d9a6e357c482407ac7794ac3e2e51168e28a743b633a36b12f1489"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-5f765a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-5f765a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:26:10Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:26:10Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["b0ee4efc66d9a6e357c482407ac7794ac3e2e51168e28a743b633a36b12f1489"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"b0ee4efc66d9a6e357c482407ac7794ac3e2e51168e28a743b633a36b12f1489\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:15.943Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-02T22:20:06Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:26:25Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:26:25Z"}],"name":"ae47fb19c324c072c578abb0ac24ae029fef313aee06a65794451952fe00b10b","namespace":"kuadrant-system","resourceVersion":"128183","uid":"701cc148-f001-4f64-bad1-c4d680afd7e2"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["ae47fb19c324c072c578abb0ac24ae029fef313aee06a65794451952fe00b10b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:20:06Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:20:06Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["ae47fb19c324c072c578abb0ac24ae029fef313aee06a65794451952fe00b10b"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"ae47fb19c324c072c578abb0ac24ae029fef313aee06a65794451952fe00b10b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:16.005Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-02T21:24:19Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:24:50Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:24:51Z"}],"name":"106dc24382c96b56f69df1e4bfaa0455678809d57faded1081bc4e26a642d4a0","namespace":"kuadrant-system","resourceVersion":"32156","uid":"0fc3bf04-468e-4b9b-9735-cabcf8006ee1"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["106dc24382c96b56f69df1e4bfaa0455678809d57faded1081bc4e26a642d4a0"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-5f765a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-5f765a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:24:51Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:24:51Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["106dc24382c96b56f69df1e4bfaa0455678809d57faded1081bc4e26a642d4a0"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"106dc24382c96b56f69df1e4bfaa0455678809d57faded1081bc4e26a642d4a0\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:16.067Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w1-5f765a/premium-w1-5f765a-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-02T21:24:19Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:24:51Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:24:51Z"}],"name":"beb0d5e916dc078abcaba4ea5b4d8012d5c2d8edfd07ca54d585bfe44d7c605a","namespace":"kuadrant-system","resourceVersion":"32185","uid":"f43f1fdc-f2ae-4191-956a-5aa85ef7b609"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["beb0d5e916dc078abcaba4ea5b4d8012d5c2d8edfd07ca54d585bfe44d7c605a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-5f765a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-5f765a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:24:19Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:24:19Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["beb0d5e916dc078abcaba4ea5b4d8012d5c2d8edfd07ca54d585bfe44d7c605a"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"beb0d5e916dc078abcaba4ea5b4d8012d5c2d8edfd07ca54d585bfe44d7c605a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:16.129Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w0-6e535d/rate-test-model-6e535d-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-02T22:20:06Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:26:27Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:26:27Z"}],"name":"cee3ed5de102b63f4fd0d549002d21484e590243e6bb220ff26d56c71481f262","namespace":"kuadrant-system","resourceVersion":"128256","uid":"eff0c9a1-f54b-48bd-a9bd-8b6fb5a97d5b"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["cee3ed5de102b63f4fd0d549002d21484e590243e6bb220ff26d56c71481f262"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w0-6e535d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:20:06Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:20:06Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["cee3ed5de102b63f4fd0d549002d21484e590243e6bb220ff26d56c71481f262"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"cee3ed5de102b63f4fd0d549002d21484e590243e6bb220ff26d56c71481f262\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:16.193Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w1-5f765a/distinct-w1-5f765a-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-02T21:26:10Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:26:10Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:26:11Z"}],"name":"6ceeddb720a82c7a3a1051f6517a47c73f8528f97b9e67d8dd2f7dd9419967e1","namespace":"kuadrant-system","resourceVersion":"34192","uid":"4b85baea-8547-4eb6-9ab8-86d956ae9272"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["6ceeddb720a82c7a3a1051f6517a47c73f8528f97b9e67d8dd2f7dd9419967e1"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-5f765a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w1-5f765a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:26:11Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:26:11Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["6ceeddb720a82c7a3a1051f6517a47c73f8528f97b9e67d8dd2f7dd9419967e1"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"6ceeddb720a82c7a3a1051f6517a47c73f8528f97b9e67d8dd2f7dd9419967e1\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:16.250Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/f6229ee2157250d6d160cdc978e612aa3a7c43bb558942020078c3f42c450c79","error":"authconfigs.authorino.kuadrant.io \"f6229ee2157250d6d160cdc978e612aa3a7c43bb558942020078c3f42c450c79\" not found"}
{"level":"error","ts":"2026-11-02T22:30:16.305Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/51e9e3c7450b52b22ca45c280738926226df3d95852d8df43ff47cf85cca9e5a","error":"authconfigs.authorino.kuadrant.io \"51e9e3c7450b52b22ca45c280738926226df3d95852d8df43ff47cf85cca9e5a\" not found"}
{"level":"error","ts":"2026-11-02T22:30:16.363Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/0f923fa7f17446f382fb056bef7c9cc2146361c32cb89e19da4e6397505de43c","error":"authconfigs.authorino.kuadrant.io \"0f923fa7f17446f382fb056bef7c9cc2146361c32cb89e19da4e6397505de43c\" not found"}
{"level":"error","ts":"2026-11-02T22:30:16.420Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/f84e45e70df6f2c62c67fba14ae375620e4a3732a0ed6adeb79c70fb4031c1d5","error":"authconfigs.authorino.kuadrant.io \"f84e45e70df6f2c62c67fba14ae375620e4a3732a0ed6adeb79c70fb4031c1d5\" not found"}
{"level":"error","ts":"2026-11-02T22:30:16.474Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/5b294df7b29e8cb61b717640614fa36dd2c243ed540ecb057e57e5c1fc26ab65","error":"authconfigs.authorino.kuadrant.io \"5b294df7b29e8cb61b717640614fa36dd2c243ed540ecb057e57e5c1fc26ab65\" not found"}
{"level":"error","ts":"2026-11-02T22:30:16.529Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/a2db302be0c4963be9b2d68075376d29342d2e854fa4746701662a56823b450e","error":"authconfigs.authorino.kuadrant.io \"a2db302be0c4963be9b2d68075376d29342d2e854fa4746701662a56823b450e\" not found"}
{"level":"error","ts":"2026-11-02T22:30:16.583Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/fa1a008e4957943b0d2d9d600bd19dafc0caa0b522e5c1d1e09ecc5d82a64f4c","error":"authconfigs.authorino.kuadrant.io \"fa1a008e4957943b0d2d9d600bd19dafc0caa0b522e5c1d1e09ecc5d82a64f4c\" not found"}
{"level":"error","ts":"2026-11-02T22:30:16.637Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/79e41416d85afbda9f192c421571f899a58b4937465fe640fd4d17dfb0d8240e","error":"authconfigs.authorino.kuadrant.io \"79e41416d85afbda9f192c421571f899a58b4937465fe640fd4d17dfb0d8240e\" not found"}
{"level":"error","ts":"2026-11-02T22:30:16.692Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/2ce874ebffdc76810fc3c080f4a7068ce8f4e9a05d63e70150e7fc6ef281b797","error":"authconfigs.authorino.kuadrant.io \"2ce874ebffdc76810fc3c080f4a7068ce8f4e9a05d63e70150e7fc6ef281b797\" not found"}
{"level":"error","ts":"2026-11-02T22:30:16.746Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/75661500a5114b056fb7b7fa79b052930433ec107cb332756c581a2f0de24173","error":"authconfigs.authorino.kuadrant.io \"75661500a5114b056fb7b7fa79b052930433ec107cb332756c581a2f0de24173\" not found"}
{"level":"error","ts":"2026-11-02T22:30:16.802Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/e206eae15f3c87b50ca80d04704d63fdf1ea76a805ec0dff6aaf8552207a1be8","error":"authconfigs.authorino.kuadrant.io \"e206eae15f3c87b50ca80d04704d63fdf1ea76a805ec0dff6aaf8552207a1be8\" not found"}
{"level":"error","ts":"2026-11-02T22:30:16.857Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/b93afde66771848b5188f78e530f2f596324f9fb9f05b2dd8f1cb49489f2bda1","error":"authconfigs.authorino.kuadrant.io \"b93afde66771848b5188f78e530f2f596324f9fb9f05b2dd8f1cb49489f2bda1\" not found"}
{"level":"error","ts":"2026-11-02T22:30:16.912Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/6acb8fe5e02ded3380a75376f0b127d4a9709eeca703e4ffefd97996bba073a8","error":"authconfigs.authorino.kuadrant.io \"6acb8fe5e02ded3380a75376f0b127d4a9709eeca703e4ffefd97996bba073a8\" not found"}
{"level":"error","ts":"2026-11-02T22:30:16.967Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/96cad25fbcf27b7341cae948477117cfaf58cb098cf23b68e9b61e9380b5dbab","error":"authconfigs.authorino.kuadrant.io \"96cad25fbcf27b7341cae948477117cfaf58cb098cf23b68e9b61e9380b5dbab\" not found"}
{"level":"error","ts":"2026-11-02T22:30:17.021Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/dfa08453b9c8623db01e432dea4f9e09b3d7f80cbbee3a69df753c6d3fbfbded","error":"authconfigs.authorino.kuadrant.io \"dfa08453b9c8623db01e432dea4f9e09b3d7f80cbbee3a69df753c6d3fbfbded\" not found"}
{"level":"error","ts":"2026-11-02T22:30:17.077Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/8e6ff67d93e4d9b2ea87c487a06f947d8b76a18c9c78078c58dee29914a5b47c","error":"authconfigs.authorino.kuadrant.io \"8e6ff67d93e4d9b2ea87c487a06f947d8b76a18c9c78078c58dee29914a5b47c\" not found"}
{"level":"error","ts":"2026-11-02T22:30:17.132Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/45531229ceac4cfcba16f0f8d809077fb7e19e248278c544ac9fd018c419ef18","error":"authconfigs.authorino.kuadrant.io \"45531229ceac4cfcba16f0f8d809077fb7e19e248278c544ac9fd018c419ef18\" not found"}
{"level":"error","ts":"2026-11-02T22:30:17.191Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/9dccfbfbcf84c5edf4e0a3cc993bd8181b6febef066c8d0c3b0f13de64710295","error":"authconfigs.authorino.kuadrant.io \"9dccfbfbcf84c5edf4e0a3cc993bd8181b6febef066c8d0c3b0f13de64710295\" not found"}
{"level":"error","ts":"2026-11-02T22:30:17.246Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/a87be006d97d67fcdec172b6143f1db733cd2c78dc7239fae4e7b34930fb681c","error":"authconfigs.authorino.kuadrant.io \"a87be006d97d67fcdec172b6143f1db733cd2c78dc7239fae4e7b34930fb681c\" not found"}
{"level":"error","ts":"2026-11-02T22:30:17.301Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/de3ca7c8a9dcdebe0c2a67b74b3bc72bdc4a8f34aff1f0c69df675fbb03b1e05","error":"authconfigs.authorino.kuadrant.io \"de3ca7c8a9dcdebe0c2a67b74b3bc72bdc4a8f34aff1f0c69df675fbb03b1e05\" not found"}
{"level":"error","ts":"2026-11-02T22:30:17.355Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/a2866a5a08cd0abaabb645c82aff8b6635fdbd34410a7b092e32a8b164086e19","error":"authconfigs.authorino.kuadrant.io \"a2866a5a08cd0abaabb645c82aff8b6635fdbd34410a7b092e32a8b164086e19\" not found"}
{"level":"error","ts":"2026-11-02T22:30:17.410Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/517c7132d716e14e14b2c9fccd696f86bc7a24a46c391e71d07ac910d0dd1c18","error":"authconfigs.authorino.kuadrant.io \"517c7132d716e14e14b2c9fccd696f86bc7a24a46c391e71d07ac910d0dd1c18\" not found"}
{"level":"error","ts":"2026-11-02T22:30:17.465Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/150da2804d58820302b448e24151b1f189b717cd68a8c1e110fba61141165eb0","error":"authconfigs.authorino.kuadrant.io \"150da2804d58820302b448e24151b1f189b717cd68a8c1e110fba61141165eb0\" not found"}
{"level":"error","ts":"2026-11-02T22:30:17.520Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/b651c6e6a372a592c9723851c4377c52eae8778a18d51a17e65b611b0b04e077","error":"authconfigs.authorino.kuadrant.io \"b651c6e6a372a592c9723851c4377c52eae8778a18d51a17e65b611b0b04e077\" not found"}
{"level":"error","ts":"2026-11-02T22:30:17.764Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-a-w3-97995b-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-a-w3-97995b-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:17.826Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-b-w4-58ca7f-maas-auth","namespace":"openshift-ingress","error":"authpolicies.kuadrant.io \"e2e-shared-b-w4-58ca7f-maas-auth\" not found"}
{"level":"error","ts":"2026-11-02T22:30:17.955Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-worker-w4-d6cb38-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-worker-w4-d6cb38-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:18.016Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-worker-w1-5f765a-maas-auth","namespace":"openshift-ingress","error":"authpolicies.kuadrant.io \"e2e-worker-w1-5f765a-maas-auth\" not found"}
{"level":"error","ts":"2026-11-02T22:30:18.037Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w4-d6cb38","namespace":"e2e-models-e2e-worker-w4-d6cb38","uid":"486176e6-7786-40c4-9ce0-6f4a68b408b2","error":"tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w4-d6cb38\" not found"}
{"level":"error","ts":"2026-11-02T22:30:18.080Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-b-w0-0f0874-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-b-w0-0f0874-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:18.211Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-rate-test-model-0f0874","namespace":"ai-tenant-e2e-shared-b-w0-0f0874","uid":"7ed62117-0e2d-4962-9413-f43b21b067ff","error":"tokenratelimitpolicies.kuadrant.io \"maas-trlp-rate-test-model-0f0874\" not found"}
{"level":"error","ts":"2026-11-02T22:30:18.217Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-worker-w2-6fa533-maas-auth","namespace":"openshift-ingress","error":"authpolicies.kuadrant.io \"e2e-worker-w2-6fa533-maas-auth\" not found"}
{"level":"error","ts":"2026-11-02T22:30:18.280Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-a-w0-6e535d-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-a-w0-6e535d-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:18.327Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-worker-w4-d6cb38","namespace":"openshift-ingress","uid":"6f6a09c9-d5cc-4e47-8444-7b69085b24cf","error":"tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-worker-w4-d6cb38\" not found"}
{"level":"error","ts":"2026-11-02T22:30:18.344Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-b-w3-a1d751-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-b-w3-a1d751-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:18.387Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-a-w0-6e535d","namespace":"openshift-ingress","uid":"0eae774a-4032-4461-b2be-6f3edd911a80","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-a-w0-6e535d\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:18.503Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-worker-w1-5f765a","namespace":"openshift-ingress","uid":"61d218f4-e9a7-4418-a32d-90a2c51e6642","error":"tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-worker-w1-5f765a\" not found"}
{"level":"error","ts":"2026-11-02T22:30:18.620Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w4-d6cb38","namespace":"e2e-models-e2e-worker-w4-d6cb38","uid":"0d3ebd35-5005-4ee4-a055-ff95546e3673","error":"tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w4-d6cb38\" not found"}
{"level":"info","ts":"2026-11-02T22:30:18.620Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T22:30:18.620Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T22:30:18.740Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-worker-w4-d6cb38","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-worker-w4-d6cb38\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:18.775Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"sub-test-model-a1d751-kserve-route","namespace":"ai-tenant-e2e-shared-b-w3-a1d751","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"sub-test-model-a1d751-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:18.858Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"premium-w2-6fa533-kserve-route","namespace":"e2e-models-e2e-worker-w2-6fa533","error":"httproutes.gateway.networking.k8s.io \"premium-w2-6fa533-kserve-route\" not found"}
{"level":"error","ts":"2026-11-02T22:30:18.860Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"data-science-gateway","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"data-science-gateway\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:18.928Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"rate-test-model-6e535d-kserve-route","namespace":"ai-tenant-e2e-shared-a-w0-6e535d","error":"httproutes.gateway.networking.k8s.io \"rate-test-model-6e535d-kserve-route\" not found"}
{"level":"error","ts":"2026-11-02T22:30:19.033Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-b-w4-58ca7f","error":"gateways.gateway.networking.k8s.io \"e2e-shared-b-w4-58ca7f\" not found"}
{"level":"error","ts":"2026-11-02T22:30:19.090Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-worker-w1-5f765a","error":"gateways.gateway.networking.k8s.io \"e2e-worker-w1-5f765a\" not found"}
{"level":"error","ts":"2026-11-02T22:30:19.110Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"simulator-w1-5f765a-kserve-route","namespace":"e2e-models-e2e-worker-w1-5f765a","error":"httproutes.gateway.networking.k8s.io \"simulator-w1-5f765a-kserve-route\" not found"}
{"level":"error","ts":"2026-11-02T22:30:19.187Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"premium-w1-5f765a-kserve-route","namespace":"e2e-models-e2e-worker-w1-5f765a","error":"httproutes.gateway.networking.k8s.io \"premium-w1-5f765a-kserve-route\" not found"}
{"level":"error","ts":"2026-11-02T22:30:19.206Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-worker-w2-6fa533","error":"gateways.gateway.networking.k8s.io \"e2e-worker-w2-6fa533\" not found"}
{"level":"error","ts":"2026-11-02T22:30:19.257Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"distinct-w2-6fa533-kserve-route","namespace":"e2e-models-e2e-worker-w2-6fa533","error":"httproutes.gateway.networking.k8s.io \"distinct-w2-6fa533-kserve-route\" not found"}
{"level":"error","ts":"2026-11-02T22:30:19.354Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"distinct-2-w2-6fa533-kserve-route","namespace":"e2e-models-e2e-worker-w2-6fa533","error":"httproutes.gateway.networking.k8s.io \"distinct-2-w2-6fa533-kserve-route\" not found"}
{"level":"error","ts":"2026-11-02T22:30:19.385Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-a-w0-6e535d","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-shared-a-w0-6e535d\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:19.424Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"simulator-w2-6fa533-kserve-route","namespace":"e2e-models-e2e-worker-w2-6fa533","error":"httproutes.gateway.networking.k8s.io \"simulator-w2-6fa533-kserve-route\" not found"}
{"level":"info","ts":"2026-11-02T22:30:29.292Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","AuthPolicy","Kuadrant","EnvoyFilter","Gateway","TokenRateLimitPolicy","HTTPRoute","ConfigMap","Limitador"],"eventTypes":{"create":12,"delete":55,"update":148}}
{"level":"info","ts":"2026-11-02T22:30:29.557Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:30:29.577Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T22:30:30Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-shared-a-w0-6e535d","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-a-w0-6e535d","reconcileID":"bba7a5c5-c4a4-447b-a39a-4ab0b88605f1","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-shared-a-w0-6e535d","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T22:30:30Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-a-w0-6e535d","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T22:30:30Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T22:30:30Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-11-02T22:30:30Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T22:30:31.142Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T22:30:31Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-11-02T22:30:31Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-shared-a-w0-6e535d","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-a-w0-6e535d","reconcileID":"bba7a5c5-c4a4-447b-a39a-4ab0b88605f1","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-shared-a-w0-6e535d","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T22:30:31Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-a-w0-6e535d","event":"DELETE"}
{"level":"info","ts":"2026-11-02T22:30:31Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-02T22:30:31Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-shared-a-w0-6e535d\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-02T22:30:31Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T22:30:31.461Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T22:30:31.463Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:30:31.549Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:30:31.549Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T22:30:32.572Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:30:32.576Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:30:32.576Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T22:30:32.580Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:30:32.623Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:30:32.626Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T22:30:32.743Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T22:30:42Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-shared-b-w0-0f0874","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-b-w0-0f0874","reconcileID":"c5203ab5-258f-478d-ba31-8d37ee203a72","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-shared-b-w0-0f0874","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T22:30:42Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-b-w0-0f0874","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T22:30:42Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T22:30:42Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-11-02T22:30:42Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T22:30:42Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-11-02T22:30:42Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-shared-b-w0-0f0874","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-b-w0-0f0874","reconcileID":"c5203ab5-258f-478d-ba31-8d37ee203a72","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-shared-b-w0-0f0874","namespace":"openshift-ingress"}
{"level":"error","ts":"2026-11-02T22:30:42Z","logger":"telemetry-policy-extension-controller","msg":"Reconciler error","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-shared-b-w0-0f0874","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-b-w0-0f0874","reconcileID":"8405bcec-9a94-49a9-8703-2f5c99f6b913","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-shared-b-w0-0f0874\" not found","stacktrace":"sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:353\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-02T22:30:42Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-b-w0-0f0874","event":"DELETE"}
{"level":"info","ts":"2026-11-02T22:30:42Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-02T22:30:42Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-shared-b-w0-0f0874\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-02T22:30:42Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"error","ts":"2026-11-02T22:30:44.885Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-a-w0-6e535d","namespace":"openshift-ingress","uid":"0eae774a-4032-4461-b2be-6f3edd911a80","error":"tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-a-w0-6e535d\" not found"}
{"level":"error","ts":"2026-11-02T22:30:45.117Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-b-w0-0f0874","namespace":"openshift-ingress","uid":"8b4ec7cb-daa9-467a-b2f6-528aa3d837fc","error":"tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-b-w0-0f0874\" not found"}
{"level":"error","ts":"2026-11-02T22:30:45.198Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-a-w0-6e535d-maas-auth","namespace":"openshift-ingress","error":"authpolicies.kuadrant.io \"e2e-shared-a-w0-6e535d-maas-auth\" not found"}
{"level":"info","ts":"2026-11-02T22:30:45.409Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T22:30:45.409Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T22:30:45.803Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"data-science-gateway","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"data-science-gateway\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:45.920Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-a-w0-6e535d","error":"gateways.gateway.networking.k8s.io \"e2e-shared-a-w0-6e535d\" not found"}
{"level":"error","ts":"2026-11-02T22:30:45.979Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-b-w0-0f0874","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-shared-b-w0-0f0874\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:30:46.160Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway","EnvoyFilter","HTTPRoute","AuthPolicy"],"eventTypes":{"delete":9,"update":1}}
{"level":"info","ts":"2026-11-02T22:30:48.563Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:30:48.568Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:30:48.568Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T22:30:48.568Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:30:48.572Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T22:30:48.573Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-11-02T22:30:48.678Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:30:48.678Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T22:30:48.681Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-02T22:28:17Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:28:17Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:28:17Z"}],"name":"3ea0c1283049b0b2e2ae47d4fdbeeb04aae52608076de47123cc9c6c1a7b685a","namespace":"kuadrant-system","resourceVersion":"130965","uid":"3f1a4752-22d1-4273-bc8a-1b45b07b4b1f"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["3ea0c1283049b0b2e2ae47d4fdbeeb04aae52608076de47123cc9c6c1a7b685a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-97995b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-97995b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:28:17Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:28:17Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["3ea0c1283049b0b2e2ae47d4fdbeeb04aae52608076de47123cc9c6c1a7b685a"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"3ea0c1283049b0b2e2ae47d4fdbeeb04aae52608076de47123cc9c6c1a7b685a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:48.744Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-02T22:28:18Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:28:18Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:28:18Z"}],"name":"9de3aeb3807fb0a63865dbb0cb6cac00d8acc0a489a9165c369fb079f576e503","namespace":"kuadrant-system","resourceVersion":"130995","uid":"da942a40-8d31-436f-aa98-6cc547215105"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["9de3aeb3807fb0a63865dbb0cb6cac00d8acc0a489a9165c369fb079f576e503"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-97995b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-97995b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:28:18Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:28:18Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["9de3aeb3807fb0a63865dbb0cb6cac00d8acc0a489a9165c369fb079f576e503"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"9de3aeb3807fb0a63865dbb0cb6cac00d8acc0a489a9165c369fb079f576e503\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:48.807Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-02T22:28:17Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:28:17Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:28:18Z"}],"name":"9eab454af32c78b750dd8a7f0f51e46caf9c5a6d593a08102680ec455da7f941","namespace":"kuadrant-system","resourceVersion":"130988","uid":"460e064d-0417-4c55-a097-b8fa8a21524b"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["9eab454af32c78b750dd8a7f0f51e46caf9c5a6d593a08102680ec455da7f941"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-97995b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-97995b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:28:18Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:28:18Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["9eab454af32c78b750dd8a7f0f51e46caf9c5a6d593a08102680ec455da7f941"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"9eab454af32c78b750dd8a7f0f51e46caf9c5a6d593a08102680ec455da7f941\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:48.853Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-shared-b-w0-0f0874","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T21:56:34Z","generation":9,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"31926cb6-a222-454e-b0b0-713de52d3591\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:29:12Z"}],"name":"kuadrant-e2e-shared-b-w0-0f0874","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-b-w0-0f0874","uid":"31926cb6-a222-454e-b0b0-713de52d3591"}],"resourceVersion":"132269","uid":"1ec69299-baab-478d-87f9-565d3c2b35f2"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4676855aaad0efd1f263930f7407a2242dda7211d0408fa3820678f475f20874\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w0-0f0874-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w0-0f0874\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w0-0f0874\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]}],\"name\":\"3d902dff08fca5c2bb562975c1b916ca54e6236ecd9cc50b17e3b37999d911ec\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8ccf868b0c716a18e90e502ebb2284ce90d5ee3fcd5779be4d996fb8a3d03b43\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w0-0f0874-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w0-0f0874\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w0-0f0874\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]}],\"name\":\"e51fac9c5a01bb319b1deb20eaa60eeb3cb0f05fa44b2dfb2cac5ec6b7cbd8fd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"848b20842f79c8cc02bec7966c894853251e29e5c14c8a4cff729041c180e15c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w0-0f0874-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w0-0f0874\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w0-0f0874\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]}],\"name\":\"a73356366d107cd5992220a58c6f2b0f6bf70196a187bc3534c68088f7abd636\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b0dda7ce592fb57a979446129e21c491a217f4c5c9a704c19a519ee42c367e92\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w0-0f0874-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w0-0f0874\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w0-0f0874\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]}],\"name\":\"098f7ba551981a4029ff8c66c0d0234e632f325a01b723001668c0e56481bd87\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6e2c4c40ad28f1eeda9eca533706722536247311f5ede5be2cbe544e374719a6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w0-0f0874-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w0-0f0874\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w0-0f0874\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]}],\"name\":\"fd25786cbc9657425a1956e65052da9d0b96f50c6eca843a1c5af4671e05425e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ffaef4e77ab77e038e2181351f7ed710141739ce5f70351bf42c0606b9215e72\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w0-0f0874-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w0-0f0874\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__32546f71\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w0-0f0874\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w0-0f0874\"]}],\"name\":\"d6fb22990981f2cd0325455675dc804fada0a031b35d72d782173400f3a24d44\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}}],\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-shared-b-w0-0f0874"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-shared-b-w0-0f0874\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:48.868Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-02T22:28:18Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:28:18Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:28:18Z"}],"name":"e8df393789582296e5c92b134371d265557ec06b8f530a82d60afcfdfc27de8b","namespace":"kuadrant-system","resourceVersion":"130993","uid":"ee3f9dc9-1592-4c60-ad25-28f37e30aca2"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["e8df393789582296e5c92b134371d265557ec06b8f530a82d60afcfdfc27de8b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-97995b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-97995b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:28:18Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:28:18Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["e8df393789582296e5c92b134371d265557ec06b8f530a82d60afcfdfc27de8b"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"e8df393789582296e5c92b134371d265557ec06b8f530a82d60afcfdfc27de8b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:48.930Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-97995b","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-97995b#rule-3"},"creationTimestamp":"2026-11-02T21:54:07Z","generation":3,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:00:12Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:03:45Z"}],"name":"abffb2b80b2e83749e48ad9bc9e2b132b4526ff5c2ddee7e3c63dcaac739cb58","namespace":"kuadrant-system","resourceVersion":"95975","uid":"3d148990-75e7-4b0f-8e0d-c5bae3e9e89e"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["abffb2b80b2e83749e48ad9bc9e2b132b4526ff5c2ddee7e3c63dcaac739cb58"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-97995b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-97995b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:54:07Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:54:07Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["abffb2b80b2e83749e48ad9bc9e2b132b4526ff5c2ddee7e3c63dcaac739cb58"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"abffb2b80b2e83749e48ad9bc9e2b132b4526ff5c2ddee7e3c63dcaac739cb58\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:48.993Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-97995b","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-97995b#rule-5"},"creationTimestamp":"2026-11-02T21:54:07Z","generation":3,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:00:11Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:03:45Z"}],"name":"7acb8a78dba64f5ca2cb229b1a6a6e5100dfd1fe0185742cdf2493f937286eba","namespace":"kuadrant-system","resourceVersion":"95954","uid":"5111a353-6a37-4a0a-bfc1-cede96724922"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["7acb8a78dba64f5ca2cb229b1a6a6e5100dfd1fe0185742cdf2493f937286eba"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-97995b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-97995b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:03:45Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:03:45Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["7acb8a78dba64f5ca2cb229b1a6a6e5100dfd1fe0185742cdf2493f937286eba"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"7acb8a78dba64f5ca2cb229b1a6a6e5100dfd1fe0185742cdf2493f937286eba\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:49.057Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-97995b","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-97995b#rule-6"},"creationTimestamp":"2026-11-02T21:54:08Z","generation":3,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:00:12Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:03:46Z"}],"name":"feca5257a3a136afa9ca4bb6226e83b9e72a014fd57c59db758c454f118180b2","namespace":"kuadrant-system","resourceVersion":"95986","uid":"723bca8b-1d42-4c5c-80dd-8efa3359954d"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["feca5257a3a136afa9ca4bb6226e83b9e72a014fd57c59db758c454f118180b2"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-97995b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-97995b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:54:08Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:54:08Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["feca5257a3a136afa9ca4bb6226e83b9e72a014fd57c59db758c454f118180b2"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"feca5257a3a136afa9ca4bb6226e83b9e72a014fd57c59db758c454f118180b2\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:49.120Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-97995b","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-97995b#rule-2"},"creationTimestamp":"2026-11-02T21:54:07Z","generation":3,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:00:12Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:03:46Z"}],"name":"64610b2b1b14c01fb91d85773d211a6d8b173cb847914d22204a29dbf00c051b","namespace":"kuadrant-system","resourceVersion":"96020","uid":"fe278c19-5f46-42de-861c-4acd306183f5"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["64610b2b1b14c01fb91d85773d211a6d8b173cb847914d22204a29dbf00c051b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-97995b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-97995b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:54:08Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:54:08Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["64610b2b1b14c01fb91d85773d211a6d8b173cb847914d22204a29dbf00c051b"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"64610b2b1b14c01fb91d85773d211a6d8b173cb847914d22204a29dbf00c051b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:49.182Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-97995b","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-97995b#rule-1"},"creationTimestamp":"2026-11-02T21:54:07Z","generation":3,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:00:12Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:03:45Z"}],"name":"6de91d16ed05414ab83195af7a0e61dc3b464cde05b3f5b5c1cb41079af7d577","namespace":"kuadrant-system","resourceVersion":"95951","uid":"a4f9446c-17f0-4b21-8887-734403122d6a"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["6de91d16ed05414ab83195af7a0e61dc3b464cde05b3f5b5c1cb41079af7d577"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-97995b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-97995b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:54:08Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:54:08Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["6de91d16ed05414ab83195af7a0e61dc3b464cde05b3f5b5c1cb41079af7d577"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"6de91d16ed05414ab83195af7a0e61dc3b464cde05b3f5b5c1cb41079af7d577\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:49.207Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-shared-a-w0-6e535d","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T21:54:30Z","generation":10,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"bb413150-c71f-467a-b73c-fc346914ff7a\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:29:47Z"}],"name":"kuadrant-e2e-shared-a-w0-6e535d","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-a-w0-6e535d","uid":"bb413150-c71f-467a-b73c-fc346914ff7a"}],"resourceVersion":"133948","uid":"79ec4380-cbc0-4c66-b610-cdb28384077b"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"376d56a711fbb2b29d7c46a8a0998936174b738443f0db294a13f85fd8478a94\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"3aa9e48facd88e18a7acef348feeaf654a1d4310d58727df558a9c5543ced772\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"65ad30c331bd08b64f99c2bfc9d23db3979d37b9d3b916cb76d08a0dfabf963a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"4593350858282f0ebeaf11b57850d5bccfa270a4b6088784a058e2d70b5cbe7c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"71e8c9bf81b77581f96b1cca4bb909b8434efbbb06bf9c9ec1aa5c8f412b9c76\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"01c09092684d0d3ed9db0ad6f53595f8d2c97286804d29e76075f2c30f05f44e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c3ead856f0c0807270869b6a467d9281b93eaaa8c65e788c4b6393073db2cbe8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"7d0e9eabd4ff8a0b65212f3d03a7b14a1e695503c8c41fb7cd6e844984ba7c69\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8b7e784474461510a9d9970d39fe03c297fc6f9a5f80873c40898bdfcb389e5f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"3cb722466e22fc9e58ad8f75bb3dbd6e1d2f9d75c3cfaafc5c6350857d59f964\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7482755e6f782100b8480fa82045aac768a6400e192241b0d0cf93403dad8edb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w0-6e535d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__8ceaeca6\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w0-6e535d\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w0-6e535d\"]}],\"name\":\"af29fffcd438904723a318f8c7cd8dbe79f55578faf5560452874252825fdf46\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}}],\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-shared-a-w0-6e535d"}}},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-e2e-shared-a-w0-6e535d\" not found"}
{"level":"error","ts":"2026-11-02T22:30:49.246Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-02T22:28:17Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:28:17Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:28:17Z"}],"name":"7452998b42ae4dea69dddcc474a389491d89642261d52ffb8b2401267d4fd23a","namespace":"kuadrant-system","resourceVersion":"130968","uid":"e80192b0-4611-40ae-bcf8-327bc00f0bf9"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["7452998b42ae4dea69dddcc474a389491d89642261d52ffb8b2401267d4fd23a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-97995b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-97995b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:28:17Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:28:17Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["7452998b42ae4dea69dddcc474a389491d89642261d52ffb8b2401267d4fd23a"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"7452998b42ae4dea69dddcc474a389491d89642261d52ffb8b2401267d4fd23a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:49.307Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-02T22:28:17Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:28:17Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:28:17Z"}],"name":"8ce2cbfc67213d98707c4ceb948a0bc47d762da419d2877baa87368e52adeb7b","namespace":"kuadrant-system","resourceVersion":"130973","uid":"9461b97d-1a68-4341-943b-ac19e310da7a"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["8ce2cbfc67213d98707c4ceb948a0bc47d762da419d2877baa87368e52adeb7b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-97995b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-97995b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:28:17Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:28:17Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["8ce2cbfc67213d98707c4ceb948a0bc47d762da419d2877baa87368e52adeb7b"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"8ce2cbfc67213d98707c4ceb948a0bc47d762da419d2877baa87368e52adeb7b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:49.370Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-02T22:28:18Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:28:18Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:28:18Z"}],"name":"ed2994aa9701d5383eb1f805c9c89ccec8a7d0b77fb131a5ca742fa37c73a14b","namespace":"kuadrant-system","resourceVersion":"130991","uid":"07a7ade4-1218-4ff1-979e-f3f879d5fd42"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["ed2994aa9701d5383eb1f805c9c89ccec8a7d0b77fb131a5ca742fa37c73a14b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-97995b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-97995b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:28:18Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:28:18Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["ed2994aa9701d5383eb1f805c9c89ccec8a7d0b77fb131a5ca742fa37c73a14b"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"ed2994aa9701d5383eb1f805c9c89ccec8a7d0b77fb131a5ca742fa37c73a14b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:49.432Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-97995b","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-97995b#rule-4"},"creationTimestamp":"2026-11-02T21:54:07Z","generation":3,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:00:12Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:03:44Z"}],"name":"861bd69371a3568d3786b56a91d3af9c85fd73ef3e549606a38eed24c8a99b89","namespace":"kuadrant-system","resourceVersion":"95910","uid":"89ab541a-5df9-4304-8a04-21e122f37f9e"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["861bd69371a3568d3786b56a91d3af9c85fd73ef3e549606a38eed24c8a99b89"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-97995b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-97995b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:54:07Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:54:07Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["861bd69371a3568d3786b56a91d3af9c85fd73ef3e549606a38eed24c8a99b89"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"861bd69371a3568d3786b56a91d3af9c85fd73ef3e549606a38eed24c8a99b89\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:49.496Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-02T22:28:18Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:28:18Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:28:18Z"}],"name":"ddd153ffe5f2008b5c0d76c6d4ced2a6aaaea3fc84c2bb12b6f75d72f6ffdcf8","namespace":"kuadrant-system","resourceVersion":"130998","uid":"8431ba07-137a-4c34-80b5-9d428e133d9e"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["ddd153ffe5f2008b5c0d76c6d4ced2a6aaaea3fc84c2bb12b6f75d72f6ffdcf8"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-97995b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-97995b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:28:18Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:28:18Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["ddd153ffe5f2008b5c0d76c6d4ced2a6aaaea3fc84c2bb12b6f75d72f6ffdcf8"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"ddd153ffe5f2008b5c0d76c6d4ced2a6aaaea3fc84c2bb12b6f75d72f6ffdcf8\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:49.558Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-02T22:28:17Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:28:17Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:28:17Z"}],"name":"7a7d519d00fa2e97e5f400a44c82c2e18e0c409b5a9afbb4d9d294659141b972","namespace":"kuadrant-system","resourceVersion":"130978","uid":"4fc4d283-17d3-49fc-ada4-b5986c34e137"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["7a7d519d00fa2e97e5f400a44c82c2e18e0c409b5a9afbb4d9d294659141b972"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-97995b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-97995b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:28:17Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:28:17Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["7a7d519d00fa2e97e5f400a44c82c2e18e0c409b5a9afbb4d9d294659141b972"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"7a7d519d00fa2e97e5f400a44c82c2e18e0c409b5a9afbb4d9d294659141b972\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:49.622Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-02T22:28:17Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:28:17Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:28:17Z"}],"name":"5727d2fd0019c6bfa39a149d096736a5b6470b2cc5bf597b76fa7b9fb568b099","namespace":"kuadrant-system","resourceVersion":"130981","uid":"9b90c07b-553e-4e4c-8de2-5d796174497d"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["5727d2fd0019c6bfa39a149d096736a5b6470b2cc5bf597b76fa7b9fb568b099"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-97995b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-97995b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:28:17Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:28:17Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["5727d2fd0019c6bfa39a149d096736a5b6470b2cc5bf597b76fa7b9fb568b099"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"5727d2fd0019c6bfa39a149d096736a5b6470b2cc5bf597b76fa7b9fb568b099\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:49.685Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-02T22:28:17Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:28:17Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:28:17Z"}],"name":"96a831079b0b478b2f950e00a3b6488601f3db32cc01341caf7b7679a46be3b8","namespace":"kuadrant-system","resourceVersion":"130976","uid":"5dc726c8-64c0-4672-b766-2580ba81c088"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["96a831079b0b478b2f950e00a3b6488601f3db32cc01341caf7b7679a46be3b8"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-97995b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-97995b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:28:17Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:28:17Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["96a831079b0b478b2f950e00a3b6488601f3db32cc01341caf7b7679a46be3b8"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"96a831079b0b478b2f950e00a3b6488601f3db32cc01341caf7b7679a46be3b8\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:49.748Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-02T22:28:17Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:28:17Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:28:18Z"}],"name":"29e64f93e9761c53580c183981bf81fb67b5649bbe34948dec541fd02a8b9939","namespace":"kuadrant-system","resourceVersion":"130985","uid":"d19c2bc9-0d93-4762-a24f-89d331a3b27e"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"guardrail-checks-known":{"opa":{"rego":"import future.keywords.every\n\nallow {\n  selected := object.get(input.auth.metadata[\"subscription-info\"], \"selectedGuardrailChecks\", null)\n  selected != null\n  every id, value in selected {\n    id in []\n    value == true\n  }\n}\n"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["29e64f93e9761c53580c183981bf81fb67b5649bbe34948dec541fd02a8b9939"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-97995b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-97995b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:28:18Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:28:18Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["29e64f93e9761c53580c183981bf81fb67b5649bbe34948dec541fd02a8b9939"],"numAuthorizationPolicies":5,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"29e64f93e9761c53580c183981bf81fb67b5649bbe34948dec541fd02a8b9939\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:49.803Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/16fa7701b7d425ecd2db71ef9158baee753a6f3a0a2da1c3b4f412045e679280","error":"authconfigs.authorino.kuadrant.io \"16fa7701b7d425ecd2db71ef9158baee753a6f3a0a2da1c3b4f412045e679280\" not found"}
{"level":"error","ts":"2026-11-02T22:30:49.858Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/c806bf2d4d850ded382b88489831427afef078ecb67dd4c920a1355d1453a2f9","error":"authconfigs.authorino.kuadrant.io \"c806bf2d4d850ded382b88489831427afef078ecb67dd4c920a1355d1453a2f9\" not found"}
{"level":"error","ts":"2026-11-02T22:30:49.912Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/8ea982efbe7afcd4f8dbaa4e864584b38ec852971d686ed11c87e99f1b9f4f9a","error":"authconfigs.authorino.kuadrant.io \"8ea982efbe7afcd4f8dbaa4e864584b38ec852971d686ed11c87e99f1b9f4f9a\" not found"}
{"level":"error","ts":"2026-11-02T22:30:49.967Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/fd7deaf8530c822c1b10ef4c1b0887086bc840af6d5c7a730508ddcb6e179095","error":"authconfigs.authorino.kuadrant.io \"fd7deaf8530c822c1b10ef4c1b0887086bc840af6d5c7a730508ddcb6e179095\" not found"}
{"level":"error","ts":"2026-11-02T22:30:50.022Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/357c492c00cb28b26cd246d2e8f1f9086e6b25af6c039d953442c5371d3cf70a","error":"authconfigs.authorino.kuadrant.io \"357c492c00cb28b26cd246d2e8f1f9086e6b25af6c039d953442c5371d3cf70a\" not found"}
{"level":"error","ts":"2026-11-02T22:30:50.077Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/d03cda72cd19a4be8449b91e7c0874bc3615d892fbc822ada2024e8c1dc8bd56","error":"authconfigs.authorino.kuadrant.io \"d03cda72cd19a4be8449b91e7c0874bc3615d892fbc822ada2024e8c1dc8bd56\" not found"}
{"level":"error","ts":"2026-11-02T22:30:50.132Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/dc6825eadf840da0185447dcfb22803683fc39051aa637aea7a66d081b192bf7","error":"authconfigs.authorino.kuadrant.io \"dc6825eadf840da0185447dcfb22803683fc39051aa637aea7a66d081b192bf7\" not found"}
{"level":"error","ts":"2026-11-02T22:30:50.186Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/12f3d170c629c434ef1558f623819a2294b75940427c1164b50933cdad3fb52f","error":"authconfigs.authorino.kuadrant.io \"12f3d170c629c434ef1558f623819a2294b75940427c1164b50933cdad3fb52f\" not found"}
{"level":"error","ts":"2026-11-02T22:30:50.240Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/347ab4a75cfecc2353073cab067f0c183bd7a253c653eba93329ecf6aa4c77b2","error":"authconfigs.authorino.kuadrant.io \"347ab4a75cfecc2353073cab067f0c183bd7a253c653eba93329ecf6aa4c77b2\" not found"}
{"level":"error","ts":"2026-11-02T22:30:50.295Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/58ba249888c7ebfedfcb5aec9df19d4b07d2856710ac2163dcc961a176311fa9","error":"authconfigs.authorino.kuadrant.io \"58ba249888c7ebfedfcb5aec9df19d4b07d2856710ac2163dcc961a176311fa9\" not found"}
{"level":"error","ts":"2026-11-02T22:30:50.350Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/aa5865acb61f14eec3bcbdde417b12bdef516ceb89d09786d23726919283c8f2","error":"authconfigs.authorino.kuadrant.io \"aa5865acb61f14eec3bcbdde417b12bdef516ceb89d09786d23726919283c8f2\" not found"}
{"level":"error","ts":"2026-11-02T22:30:50.404Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/8f50bf1a21545f68eb583e07935b8b0da52bbc4743a8bc67c4d9545b76da56af","error":"authconfigs.authorino.kuadrant.io \"8f50bf1a21545f68eb583e07935b8b0da52bbc4743a8bc67c4d9545b76da56af\" not found"}
{"level":"error","ts":"2026-11-02T22:30:50.459Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/92c755f42520a16c18887562f8b0dd82ce78b0c009a03cf56621703050a4589e","error":"authconfigs.authorino.kuadrant.io \"92c755f42520a16c18887562f8b0dd82ce78b0c009a03cf56621703050a4589e\" not found"}
{"level":"error","ts":"2026-11-02T22:30:50.514Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/3ecbc6560d7cb2e5396471349d24b95ff664f3b33dfc188e590c2b772721287c","error":"authconfigs.authorino.kuadrant.io \"3ecbc6560d7cb2e5396471349d24b95ff664f3b33dfc188e590c2b772721287c\" not found"}
{"level":"error","ts":"2026-11-02T22:30:50.568Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/a9353902ff809c3953ab78fb1a74b0913862deabf4e36537f31dcb1d590b46dd","error":"authconfigs.authorino.kuadrant.io \"a9353902ff809c3953ab78fb1a74b0913862deabf4e36537f31dcb1d590b46dd\" not found"}
{"level":"error","ts":"2026-11-02T22:30:50.623Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/db6f9ff18eeb49f1421400a53d101cb100b1a88466190b46fb6dbed22a42e073","error":"authconfigs.authorino.kuadrant.io \"db6f9ff18eeb49f1421400a53d101cb100b1a88466190b46fb6dbed22a42e073\" not found"}
{"level":"error","ts":"2026-11-02T22:30:50.677Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/7f1003cf42290c9494548cc907c9d6b31f90160185f5f9a729a625709fd1fb40","error":"authconfigs.authorino.kuadrant.io \"7f1003cf42290c9494548cc907c9d6b31f90160185f5f9a729a625709fd1fb40\" not found"}
{"level":"error","ts":"2026-11-02T22:30:50.732Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/b3a9fbda204f0b6bfe85682d0fee9fd7a9712977e22af554d2d82ba07f1a075a","error":"authconfigs.authorino.kuadrant.io \"b3a9fbda204f0b6bfe85682d0fee9fd7a9712977e22af554d2d82ba07f1a075a\" not found"}
{"level":"error","ts":"2026-11-02T22:30:50.786Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/25cb748ea88f201b192c863c4e2fb40e5931cd9cfed0d04ae104e35dbe48f38b","error":"authconfigs.authorino.kuadrant.io \"25cb748ea88f201b192c863c4e2fb40e5931cd9cfed0d04ae104e35dbe48f38b\" not found"}
{"level":"error","ts":"2026-11-02T22:30:50.841Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/52afa67a4bb23da81788fa24144b809f70c5f20786bfc6a5c4e8bd0929485ee9","error":"authconfigs.authorino.kuadrant.io \"52afa67a4bb23da81788fa24144b809f70c5f20786bfc6a5c4e8bd0929485ee9\" not found"}
{"level":"error","ts":"2026-11-02T22:30:50.896Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/e12ef81cd87aec42f5b2528c46a9aeefe6b1bca82398f07b17a52a4bf6e91945","error":"authconfigs.authorino.kuadrant.io \"e12ef81cd87aec42f5b2528c46a9aeefe6b1bca82398f07b17a52a4bf6e91945\" not found"}
{"level":"error","ts":"2026-11-02T22:30:50.950Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/723ff56478b245706677de5d534bdca6f79a45abce147a872b1386591bf44cbc","error":"authconfigs.authorino.kuadrant.io \"723ff56478b245706677de5d534bdca6f79a45abce147a872b1386591bf44cbc\" not found"}
{"level":"error","ts":"2026-11-02T22:30:51.005Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/13694f4cecc05b3e953bb7d1aa68f96fad9b8548456e1357cc504ba9936493bf","error":"authconfigs.authorino.kuadrant.io \"13694f4cecc05b3e953bb7d1aa68f96fad9b8548456e1357cc504ba9936493bf\" not found"}
{"level":"error","ts":"2026-11-02T22:30:51.059Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/16e9561ee4c6deff2fa31e8a5aec69ff1b5c963a2bd79d3413890752338a808c","error":"authconfigs.authorino.kuadrant.io \"16e9561ee4c6deff2fa31e8a5aec69ff1b5c963a2bd79d3413890752338a808c\" not found"}
{"level":"error","ts":"2026-11-02T22:30:51.114Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/afe9746e0af749da011756561a859419e447efc535f5e3f3773b1d18a5b5a9ac","error":"authconfigs.authorino.kuadrant.io \"afe9746e0af749da011756561a859419e447efc535f5e3f3773b1d18a5b5a9ac\" not found"}
{"level":"error","ts":"2026-11-02T22:30:51.168Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/1f3d6ce43ced512267c700bcaefac5fe1e5a0f56279d9c49efc4ca04e0d03518","error":"authconfigs.authorino.kuadrant.io \"1f3d6ce43ced512267c700bcaefac5fe1e5a0f56279d9c49efc4ca04e0d03518\" not found"}
{"level":"error","ts":"2026-11-02T22:30:51.223Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/a7d80a75dae47b36245f18223c45bf04ddce116b33459885543e64da9d9d1caa","error":"authconfigs.authorino.kuadrant.io \"a7d80a75dae47b36245f18223c45bf04ddce116b33459885543e64da9d9d1caa\" not found"}
{"level":"error","ts":"2026-11-02T22:30:51.277Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/e99af4c913dc9844409b7c31f2f26b7f80984fdcc4a30c1de535a7a3435d0ae8","error":"authconfigs.authorino.kuadrant.io \"e99af4c913dc9844409b7c31f2f26b7f80984fdcc4a30c1de535a7a3435d0ae8\" not found"}
{"level":"error","ts":"2026-11-02T22:30:51.332Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/6d6f6c08f92b4cefaa6a997643ec612cf9c62df4fa750dd0f5d4c3d50d40d2bb","error":"authconfigs.authorino.kuadrant.io \"6d6f6c08f92b4cefaa6a997643ec612cf9c62df4fa750dd0f5d4c3d50d40d2bb\" not found"}
{"level":"error","ts":"2026-11-02T22:30:51.386Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/bb82cce53996fd9a50a4f33832b37ff599d227ab91d54895bf0ab989d1eb0b01","error":"authconfigs.authorino.kuadrant.io \"bb82cce53996fd9a50a4f33832b37ff599d227ab91d54895bf0ab989d1eb0b01\" not found"}
{"level":"error","ts":"2026-11-02T22:30:51.440Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/0768841c9057075fe648e2fa67028e1fc0bee839efdd3e78e081dac6a9e13397","error":"authconfigs.authorino.kuadrant.io \"0768841c9057075fe648e2fa67028e1fc0bee839efdd3e78e081dac6a9e13397\" not found"}
{"level":"error","ts":"2026-11-02T22:30:51.495Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/1ce9b189744d237515a1896d038a3437e8e31669b01937d8cf3a067728ee7e82","error":"authconfigs.authorino.kuadrant.io \"1ce9b189744d237515a1896d038a3437e8e31669b01937d8cf3a067728ee7e82\" not found"}
{"level":"error","ts":"2026-11-02T22:30:51.550Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/f09ce0bd9bc651317469310c8a604d792e7c7c55751d184a920638cf66ba0dd5","error":"authconfigs.authorino.kuadrant.io \"f09ce0bd9bc651317469310c8a604d792e7c7c55751d184a920638cf66ba0dd5\" not found"}
{"level":"error","ts":"2026-11-02T22:30:51.604Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/8e06ac6cbf5999144a3b0f3b2584acaac3b4eb8d03d892bc45e03712448c4a9c","error":"authconfigs.authorino.kuadrant.io \"8e06ac6cbf5999144a3b0f3b2584acaac3b4eb8d03d892bc45e03712448c4a9c\" not found"}
{"level":"error","ts":"2026-11-02T22:30:51.659Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/cf13f5a3da5f1ddbc441422b55ececcb0ffd227c7be1c942dc1d4c428387bca0","error":"authconfigs.authorino.kuadrant.io \"cf13f5a3da5f1ddbc441422b55ececcb0ffd227c7be1c942dc1d4c428387bca0\" not found"}
{"level":"error","ts":"2026-11-02T22:30:51.713Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/719394d8154dd624eedc306180a33baa4128531f223bc2727d0376601dd634f6","error":"authconfigs.authorino.kuadrant.io \"719394d8154dd624eedc306180a33baa4128531f223bc2727d0376601dd634f6\" not found"}
{"level":"error","ts":"2026-11-02T22:30:51.768Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/a6e80d640d49da44f2b60f9db62279137aa6839ed5acbca6493b96977b1f3f9b","error":"authconfigs.authorino.kuadrant.io \"a6e80d640d49da44f2b60f9db62279137aa6839ed5acbca6493b96977b1f3f9b\" not found"}
{"level":"error","ts":"2026-11-02T22:30:51.822Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/af8712f819a09682d066de98c1b93feb5b0f27e478190be446e0c2d881c1e213","error":"authconfigs.authorino.kuadrant.io \"af8712f819a09682d066de98c1b93feb5b0f27e478190be446e0c2d881c1e213\" not found"}
{"level":"error","ts":"2026-11-02T22:30:51.876Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/4ff864a27b8c6cdd9a746e87a7d53b4055daacec9650360ef6d48d5964395d3f","error":"authconfigs.authorino.kuadrant.io \"4ff864a27b8c6cdd9a746e87a7d53b4055daacec9650360ef6d48d5964395d3f\" not found"}
{"level":"error","ts":"2026-11-02T22:30:51.931Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/a69bb45bad035c53dd8c7176828b1cc26d0c9d3f775d2059034b1639ca1b49d8","error":"authconfigs.authorino.kuadrant.io \"a69bb45bad035c53dd8c7176828b1cc26d0c9d3f775d2059034b1639ca1b49d8\" not found"}
{"level":"error","ts":"2026-11-02T22:30:51.986Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/8f0923ad4223ef053267784d904817130eaaaa279092e9f9f1500d0325c2e6a7","error":"authconfigs.authorino.kuadrant.io \"8f0923ad4223ef053267784d904817130eaaaa279092e9f9f1500d0325c2e6a7\" not found"}
{"level":"error","ts":"2026-11-02T22:30:52.041Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/39a9f89f974929e5c36b7ca16af0fe122642ef82605ca091ecae9f1aab1c8c39","error":"authconfigs.authorino.kuadrant.io \"39a9f89f974929e5c36b7ca16af0fe122642ef82605ca091ecae9f1aab1c8c39\" not found"}
{"level":"error","ts":"2026-11-02T22:30:52.095Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/9f6fc629fa43de74b0fb261de7e8b46fbdfe4f21235446879cd916210856d6f0","error":"authconfigs.authorino.kuadrant.io \"9f6fc629fa43de74b0fb261de7e8b46fbdfe4f21235446879cd916210856d6f0\" not found"}
{"level":"error","ts":"2026-11-02T22:30:52.150Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/7be093b94c77d8e466548a812b2fd67ba6e4cdbef2e705474d1a124d26a40f56","error":"authconfigs.authorino.kuadrant.io \"7be093b94c77d8e466548a812b2fd67ba6e4cdbef2e705474d1a124d26a40f56\" not found"}
{"level":"error","ts":"2026-11-02T22:30:52.204Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/7fdbd59414185d321c56439c757d9c725c67465b49a83a52b935fdd9c5f0df82","error":"authconfigs.authorino.kuadrant.io \"7fdbd59414185d321c56439c757d9c725c67465b49a83a52b935fdd9c5f0df82\" not found"}
{"level":"error","ts":"2026-11-02T22:30:52.259Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/b0ee4efc66d9a6e357c482407ac7794ac3e2e51168e28a743b633a36b12f1489","error":"authconfigs.authorino.kuadrant.io \"b0ee4efc66d9a6e357c482407ac7794ac3e2e51168e28a743b633a36b12f1489\" not found"}
{"level":"error","ts":"2026-11-02T22:30:52.313Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/04ef5a9f5a54464f8dc13ab6c0af24178bef36e48dd84e92297e1f685bae9a8a","error":"authconfigs.authorino.kuadrant.io \"04ef5a9f5a54464f8dc13ab6c0af24178bef36e48dd84e92297e1f685bae9a8a\" not found"}
{"level":"error","ts":"2026-11-02T22:30:52.368Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/7ebdbd5a6be861834fc366408f369ad8f021dfe8f061cbc93334bc801f3df98f","error":"authconfigs.authorino.kuadrant.io \"7ebdbd5a6be861834fc366408f369ad8f021dfe8f061cbc93334bc801f3df98f\" not found"}
{"level":"error","ts":"2026-11-02T22:30:52.423Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/dff7a596e1042978304d40238abe84063cc499f4a6a2f9def85e7c84d1df1ebc","error":"authconfigs.authorino.kuadrant.io \"dff7a596e1042978304d40238abe84063cc499f4a6a2f9def85e7c84d1df1ebc\" not found"}
{"level":"error","ts":"2026-11-02T22:30:52.477Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/c17d6c6438d8754832a843b7a082fa7fc719ecd30696a3551f3ca815dd52f28b","error":"authconfigs.authorino.kuadrant.io \"c17d6c6438d8754832a843b7a082fa7fc719ecd30696a3551f3ca815dd52f28b\" not found"}
{"level":"error","ts":"2026-11-02T22:30:52.533Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/309f6b916a61539853033efc6ca2e083c01c99e5b96f857a7c78b89f9816f598","error":"authconfigs.authorino.kuadrant.io \"309f6b916a61539853033efc6ca2e083c01c99e5b96f857a7c78b89f9816f598\" not found"}
{"level":"error","ts":"2026-11-02T22:30:52.587Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/2538346ffaabe171687c406d12f294530661f7690a04d14ab2327034447b1886","error":"authconfigs.authorino.kuadrant.io \"2538346ffaabe171687c406d12f294530661f7690a04d14ab2327034447b1886\" not found"}
{"level":"error","ts":"2026-11-02T22:30:52.642Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/db8ed9490207e877020d08d86f8a9769046fd69225998abd4e476e93ef7b9431","error":"authconfigs.authorino.kuadrant.io \"db8ed9490207e877020d08d86f8a9769046fd69225998abd4e476e93ef7b9431\" not found"}
{"level":"error","ts":"2026-11-02T22:30:52.699Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/94dcd05ea37e3629c540245bc47fd87fca3f73a8e2994ead89bda609cefca74a","error":"authconfigs.authorino.kuadrant.io \"94dcd05ea37e3629c540245bc47fd87fca3f73a8e2994ead89bda609cefca74a\" not found"}
{"level":"error","ts":"2026-11-02T22:30:52.753Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/059aa363c4f5743984f4a4750b299221d4153361bba88fb44779ada6b736d06a","error":"authconfigs.authorino.kuadrant.io \"059aa363c4f5743984f4a4750b299221d4153361bba88fb44779ada6b736d06a\" not found"}
{"level":"error","ts":"2026-11-02T22:30:52.807Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/bcf0aab5299349f1dd1df89a10a558ad5617afdfb0f30d972811f3dbb51b1ea5","error":"authconfigs.authorino.kuadrant.io \"bcf0aab5299349f1dd1df89a10a558ad5617afdfb0f30d972811f3dbb51b1ea5\" not found"}
{"level":"error","ts":"2026-11-02T22:30:52.862Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/48e95544e68fc50e4e4e36c8679af44644ecbfb2cf7df51e27a09f30472eda9e","error":"authconfigs.authorino.kuadrant.io \"48e95544e68fc50e4e4e36c8679af44644ecbfb2cf7df51e27a09f30472eda9e\" not found"}
{"level":"error","ts":"2026-11-02T22:30:52.916Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/b1fdba63ead328fd43c505e06394bc2adb7e5e2dfb0a1e55ef2c41d8f345142f","error":"authconfigs.authorino.kuadrant.io \"b1fdba63ead328fd43c505e06394bc2adb7e5e2dfb0a1e55ef2c41d8f345142f\" not found"}
{"level":"error","ts":"2026-11-02T22:30:52.971Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/c19827aa458f939a86c4dbefda3dabc4f554898dbb7e2f92b488060e9e90b5cc","error":"authconfigs.authorino.kuadrant.io \"c19827aa458f939a86c4dbefda3dabc4f554898dbb7e2f92b488060e9e90b5cc\" not found"}
{"level":"error","ts":"2026-11-02T22:30:53.025Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/8abe3e629bd34674437803d6e54a0cb90fe0d0df12d2eac23f0b40d2f4990b37","error":"authconfigs.authorino.kuadrant.io \"8abe3e629bd34674437803d6e54a0cb90fe0d0df12d2eac23f0b40d2f4990b37\" not found"}
{"level":"error","ts":"2026-11-02T22:30:53.080Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/cee3ed5de102b63f4fd0d549002d21484e590243e6bb220ff26d56c71481f262","error":"authconfigs.authorino.kuadrant.io \"cee3ed5de102b63f4fd0d549002d21484e590243e6bb220ff26d56c71481f262\" not found"}
{"level":"error","ts":"2026-11-02T22:30:53.135Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/204a90b318233d1075e557d2348b027549cbc82cda4c1d6aea6cfcfa28a96654","error":"authconfigs.authorino.kuadrant.io \"204a90b318233d1075e557d2348b027549cbc82cda4c1d6aea6cfcfa28a96654\" not found"}
{"level":"error","ts":"2026-11-02T22:30:53.190Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/60ca770315801fd35b67ab23639ba4ac6a344fcf95fe492c267cc87cb90ce14f","error":"authconfigs.authorino.kuadrant.io \"60ca770315801fd35b67ab23639ba4ac6a344fcf95fe492c267cc87cb90ce14f\" not found"}
{"level":"error","ts":"2026-11-02T22:30:53.246Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/9fa5392cc7c0130bb8596420fcb1a79f07b3d804fb9e4de459f680cdcfd5dcfc","error":"authconfigs.authorino.kuadrant.io \"9fa5392cc7c0130bb8596420fcb1a79f07b3d804fb9e4de459f680cdcfd5dcfc\" not found"}
{"level":"error","ts":"2026-11-02T22:30:53.301Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/505545a95fce131db80f848e9990387e6b3e42a2f7e2375f56bbc07efcac9723","error":"authconfigs.authorino.kuadrant.io \"505545a95fce131db80f848e9990387e6b3e42a2f7e2375f56bbc07efcac9723\" not found"}
{"level":"error","ts":"2026-11-02T22:30:53.355Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/1f83c46a7c87c216ad3b7a3697a1ad6c518cb36972a910efbc3c7eed6ab3956a","error":"authconfigs.authorino.kuadrant.io \"1f83c46a7c87c216ad3b7a3697a1ad6c518cb36972a910efbc3c7eed6ab3956a\" not found"}
{"level":"error","ts":"2026-11-02T22:30:53.409Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/0947683a63afc3251194a3b586cb934b1350dcaa171c4fd826d6773a00d5cf2a","error":"authconfigs.authorino.kuadrant.io \"0947683a63afc3251194a3b586cb934b1350dcaa171c4fd826d6773a00d5cf2a\" not found"}
{"level":"error","ts":"2026-11-02T22:30:53.464Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/b565990bc269af90f4e0533dedaf97fc37dc70b037af910a7605358eda2713f5","error":"authconfigs.authorino.kuadrant.io \"b565990bc269af90f4e0533dedaf97fc37dc70b037af910a7605358eda2713f5\" not found"}
{"level":"error","ts":"2026-11-02T22:30:53.518Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/99a01d66d9ba32727c09707b61669b110b150d8025da9291ae815b1d8e07454c","error":"authconfigs.authorino.kuadrant.io \"99a01d66d9ba32727c09707b61669b110b150d8025da9291ae815b1d8e07454c\" not found"}
{"level":"error","ts":"2026-11-02T22:30:53.573Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/4b5d6544ef7fd39f49a5af0551f4a404b0a5f49df3054a95306b7f797216c599","error":"authconfigs.authorino.kuadrant.io \"4b5d6544ef7fd39f49a5af0551f4a404b0a5f49df3054a95306b7f797216c599\" not found"}
{"level":"error","ts":"2026-11-02T22:30:53.627Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/a2f26131fa92b8ff5a24a34c4f1276e2ebde9d4239d1c79890c5f312ae6d007d","error":"authconfigs.authorino.kuadrant.io \"a2f26131fa92b8ff5a24a34c4f1276e2ebde9d4239d1c79890c5f312ae6d007d\" not found"}
{"level":"error","ts":"2026-11-02T22:30:53.681Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/319a8bd03b55a51284dd6790058e026879ed8db3e6d527dedb4a9314473afa5b","error":"authconfigs.authorino.kuadrant.io \"319a8bd03b55a51284dd6790058e026879ed8db3e6d527dedb4a9314473afa5b\" not found"}
{"level":"error","ts":"2026-11-02T22:30:53.736Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/206e50a9b0e5f83281f994d9f1d85f92406e3544297c47017c081f763b10dd96","error":"authconfigs.authorino.kuadrant.io \"206e50a9b0e5f83281f994d9f1d85f92406e3544297c47017c081f763b10dd96\" not found"}
{"level":"error","ts":"2026-11-02T22:30:53.790Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/8309dc44d5088e48040255bf86dbc622de08fc216837cd0027a69bdf179a9d2a","error":"authconfigs.authorino.kuadrant.io \"8309dc44d5088e48040255bf86dbc622de08fc216837cd0027a69bdf179a9d2a\" not found"}
{"level":"error","ts":"2026-11-02T22:30:53.845Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/66eb2a66302c20c8061f062df1542c7ad1db513c8b1988f81768f7d266f6665c","error":"authconfigs.authorino.kuadrant.io \"66eb2a66302c20c8061f062df1542c7ad1db513c8b1988f81768f7d266f6665c\" not found"}
{"level":"error","ts":"2026-11-02T22:30:53.900Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/9d278f3acef96193a8d6a95bb17fda6beacb6c6949e61147bbb0a9f984d383ca","error":"authconfigs.authorino.kuadrant.io \"9d278f3acef96193a8d6a95bb17fda6beacb6c6949e61147bbb0a9f984d383ca\" not found"}
{"level":"error","ts":"2026-11-02T22:30:53.954Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/37f7dad0ca5234ce11642187ba11e681aa288a9b2a62a6d47b06de5fa5c385ed","error":"authconfigs.authorino.kuadrant.io \"37f7dad0ca5234ce11642187ba11e681aa288a9b2a62a6d47b06de5fa5c385ed\" not found"}
{"level":"error","ts":"2026-11-02T22:30:54.008Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/e1e7c7c242c339c99da1caa3f217a7bd53ffc78a71bee9a0e898d1f0b8471fb3","error":"authconfigs.authorino.kuadrant.io \"e1e7c7c242c339c99da1caa3f217a7bd53ffc78a71bee9a0e898d1f0b8471fb3\" not found"}
{"level":"error","ts":"2026-11-02T22:30:54.064Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/6d3e7a9a4b4298310e0bfe2e3cbd62aec91a573c07d02cbee9db82354ce9ae45","error":"authconfigs.authorino.kuadrant.io \"6d3e7a9a4b4298310e0bfe2e3cbd62aec91a573c07d02cbee9db82354ce9ae45\" not found"}
{"level":"error","ts":"2026-11-02T22:30:54.118Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/f1edf5f89fd287762fbbefa668581cdc8f1877a3f31497227c537000670166d9","error":"authconfigs.authorino.kuadrant.io \"f1edf5f89fd287762fbbefa668581cdc8f1877a3f31497227c537000670166d9\" not found"}
{"level":"error","ts":"2026-11-02T22:30:54.173Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/0623abc228b11818faa4a08b26d906ef498cb9511f2bcee2bcd7c9e8dbb0a23a","error":"authconfigs.authorino.kuadrant.io \"0623abc228b11818faa4a08b26d906ef498cb9511f2bcee2bcd7c9e8dbb0a23a\" not found"}
{"level":"error","ts":"2026-11-02T22:30:54.227Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/6cbb9b4408bb48fa5c471c9684ef41f50ebbc4e85135af89ff2781ab48666f2a","error":"authconfigs.authorino.kuadrant.io \"6cbb9b4408bb48fa5c471c9684ef41f50ebbc4e85135af89ff2781ab48666f2a\" not found"}
{"level":"error","ts":"2026-11-02T22:30:54.282Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/e701c3e95fd6d7e3e60b9f162039289bbc904c42df899db9436b6ad7538d1ffc","error":"authconfigs.authorino.kuadrant.io \"e701c3e95fd6d7e3e60b9f162039289bbc904c42df899db9436b6ad7538d1ffc\" not found"}
{"level":"error","ts":"2026-11-02T22:30:54.336Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/5cddd3e1918c7df14f710eb09cebc745d043be6f81e6c1e1f2a3803e2f0c6513","error":"authconfigs.authorino.kuadrant.io \"5cddd3e1918c7df14f710eb09cebc745d043be6f81e6c1e1f2a3803e2f0c6513\" not found"}
{"level":"error","ts":"2026-11-02T22:30:54.391Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/33871c6a0ae4feae1469b537cc1ea6bbbd60286eed4edf3f6b041e5ca65d4b23","error":"authconfigs.authorino.kuadrant.io \"33871c6a0ae4feae1469b537cc1ea6bbbd60286eed4edf3f6b041e5ca65d4b23\" not found"}
{"level":"error","ts":"2026-11-02T22:30:54.445Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/21c045f9fd9a65bcf44bc04d3fcb17d52c1649c95ac1f90f68dd01492045074d","error":"authconfigs.authorino.kuadrant.io \"21c045f9fd9a65bcf44bc04d3fcb17d52c1649c95ac1f90f68dd01492045074d\" not found"}
{"level":"error","ts":"2026-11-02T22:30:54.501Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/27c00f1160fee4edb42d2d932daa50752238a681b270e486550b0ccd674d7682","error":"authconfigs.authorino.kuadrant.io \"27c00f1160fee4edb42d2d932daa50752238a681b270e486550b0ccd674d7682\" not found"}
{"level":"error","ts":"2026-11-02T22:30:54.555Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/55a7427f941cf70e3504be7b1faaabc3224d15aa575a45663edd720843ebc89b","error":"authconfigs.authorino.kuadrant.io \"55a7427f941cf70e3504be7b1faaabc3224d15aa575a45663edd720843ebc89b\" not found"}
{"level":"error","ts":"2026-11-02T22:30:54.610Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/3aa68add648f18fb79f3def0d73f0c2f29d8ab60b1352cf4548a1a038cf3d923","error":"authconfigs.authorino.kuadrant.io \"3aa68add648f18fb79f3def0d73f0c2f29d8ab60b1352cf4548a1a038cf3d923\" not found"}
{"level":"error","ts":"2026-11-02T22:30:54.664Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/b7e1694df51b77341405c6097e6d1487bf70a48e8a95816d2cfc62e5ddd6a999","error":"authconfigs.authorino.kuadrant.io \"b7e1694df51b77341405c6097e6d1487bf70a48e8a95816d2cfc62e5ddd6a999\" not found"}
{"level":"error","ts":"2026-11-02T22:30:54.719Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/3474cd3af51b646106406cc4778f6a5608fdc62b1fd92f27ccbcf8ab285bc05c","error":"authconfigs.authorino.kuadrant.io \"3474cd3af51b646106406cc4778f6a5608fdc62b1fd92f27ccbcf8ab285bc05c\" not found"}
{"level":"error","ts":"2026-11-02T22:30:54.773Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/2f2531e01fa8fc0031706fadbba0c1818c30681dcf9d2c65b1c7c23230ea3a32","error":"authconfigs.authorino.kuadrant.io \"2f2531e01fa8fc0031706fadbba0c1818c30681dcf9d2c65b1c7c23230ea3a32\" not found"}
{"level":"error","ts":"2026-11-02T22:30:54.828Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/98aca426d9ec5ae558219406a36e9375b2e6291ddc5e73bd3960b21edfe258cd","error":"authconfigs.authorino.kuadrant.io \"98aca426d9ec5ae558219406a36e9375b2e6291ddc5e73bd3960b21edfe258cd\" not found"}
{"level":"error","ts":"2026-11-02T22:30:54.883Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/9112a3b536f3eb5f79a5b52d0ee8a7a26d3700b295f3ce2775128d2841f01ff4","error":"authconfigs.authorino.kuadrant.io \"9112a3b536f3eb5f79a5b52d0ee8a7a26d3700b295f3ce2775128d2841f01ff4\" not found"}
{"level":"error","ts":"2026-11-02T22:30:54.938Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/739e19d51d8fbdeccfc8bc7587afd12132239f688ec6cf8d9586f242a71087f7","error":"authconfigs.authorino.kuadrant.io \"739e19d51d8fbdeccfc8bc7587afd12132239f688ec6cf8d9586f242a71087f7\" not found"}
{"level":"error","ts":"2026-11-02T22:30:54.995Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/5bc63b4c1a02d51f1462172790f7018aec7db9fb8a2a61024ca7c15aac9065b4","error":"authconfigs.authorino.kuadrant.io \"5bc63b4c1a02d51f1462172790f7018aec7db9fb8a2a61024ca7c15aac9065b4\" not found"}
{"level":"error","ts":"2026-11-02T22:30:55.050Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/12dec0ddb151cc18ef75cfe2b4260788095e28a391f359fc3f7da7c75381b728","error":"authconfigs.authorino.kuadrant.io \"12dec0ddb151cc18ef75cfe2b4260788095e28a391f359fc3f7da7c75381b728\" not found"}
{"level":"error","ts":"2026-11-02T22:30:55.105Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/4139e076413d5d9d1fd2b594b83d854cc771dfa28886f3f67439ec043220dd9f","error":"authconfigs.authorino.kuadrant.io \"4139e076413d5d9d1fd2b594b83d854cc771dfa28886f3f67439ec043220dd9f\" not found"}
{"level":"error","ts":"2026-11-02T22:30:55.160Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/9a1afd5e20de63bb2c85d93c9c3fd7aae15a0f45cb6e07dc467b8063b97decee","error":"authconfigs.authorino.kuadrant.io \"9a1afd5e20de63bb2c85d93c9c3fd7aae15a0f45cb6e07dc467b8063b97decee\" not found"}
{"level":"error","ts":"2026-11-02T22:30:55.215Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/e199374b1d053d8a1ea2fb463b47f0da1b100cb9029acd61282384f0bb2553a2","error":"authconfigs.authorino.kuadrant.io \"e199374b1d053d8a1ea2fb463b47f0da1b100cb9029acd61282384f0bb2553a2\" not found"}
{"level":"error","ts":"2026-11-02T22:30:55.269Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/eadff6644620dd26a92e8dd1076b97db8fef2224eb03b70ce4e7ee1ef8dc0b30","error":"authconfigs.authorino.kuadrant.io \"eadff6644620dd26a92e8dd1076b97db8fef2224eb03b70ce4e7ee1ef8dc0b30\" not found"}
{"level":"error","ts":"2026-11-02T22:30:55.324Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/bd641664cfab5eecac33b1ff0c46f78597ed896bbc4c7a81487d56141be11715","error":"authconfigs.authorino.kuadrant.io \"bd641664cfab5eecac33b1ff0c46f78597ed896bbc4c7a81487d56141be11715\" not found"}
{"level":"error","ts":"2026-11-02T22:30:55.378Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/16cb85f469e7c5716866312b8b4cc95d7bd4782b54923c1571be2b995ef85c30","error":"authconfigs.authorino.kuadrant.io \"16cb85f469e7c5716866312b8b4cc95d7bd4782b54923c1571be2b995ef85c30\" not found"}
{"level":"error","ts":"2026-11-02T22:30:55.433Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/796ce8085bd3851fe6a6d0c9b4c29504c70e44da1ae3ea663bfc85d308b1e5b1","error":"authconfigs.authorino.kuadrant.io \"796ce8085bd3851fe6a6d0c9b4c29504c70e44da1ae3ea663bfc85d308b1e5b1\" not found"}
{"level":"error","ts":"2026-11-02T22:30:55.489Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/4afb168c7cbb67555e268bc246b8eeeba53cda69691eb181663c1375ab099775","error":"authconfigs.authorino.kuadrant.io \"4afb168c7cbb67555e268bc246b8eeeba53cda69691eb181663c1375ab099775\" not found"}
{"level":"error","ts":"2026-11-02T22:30:55.544Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/ae47fb19c324c072c578abb0ac24ae029fef313aee06a65794451952fe00b10b","error":"authconfigs.authorino.kuadrant.io \"ae47fb19c324c072c578abb0ac24ae029fef313aee06a65794451952fe00b10b\" not found"}
{"level":"error","ts":"2026-11-02T22:30:55.599Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/5ea067858e444716d33ddecbe718b086e12804ce72bba0a6f135b64fb1bb1c60","error":"authconfigs.authorino.kuadrant.io \"5ea067858e444716d33ddecbe718b086e12804ce72bba0a6f135b64fb1bb1c60\" not found"}
{"level":"error","ts":"2026-11-02T22:30:55.653Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/13cb74b6bdfe9b2af39effc13c9d5ade5172cb10a5930c6aefbe733c0ab0cad4","error":"authconfigs.authorino.kuadrant.io \"13cb74b6bdfe9b2af39effc13c9d5ade5172cb10a5930c6aefbe733c0ab0cad4\" not found"}
{"level":"error","ts":"2026-11-02T22:30:55.708Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/b4056adace047bf2186763869c2f6a0524a9534ef874733d3868dfd41db1a7c9","error":"authconfigs.authorino.kuadrant.io \"b4056adace047bf2186763869c2f6a0524a9534ef874733d3868dfd41db1a7c9\" not found"}
{"level":"error","ts":"2026-11-02T22:30:55.763Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/f4ecce895af38f9134e1fa20d5bd1e91c0c47aeb2d6d3a1ff49cf2e9138234bb","error":"authconfigs.authorino.kuadrant.io \"f4ecce895af38f9134e1fa20d5bd1e91c0c47aeb2d6d3a1ff49cf2e9138234bb\" not found"}
{"level":"error","ts":"2026-11-02T22:30:55.817Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/b6a8f91d1ffdf775c75f2a1c84bb520696572aea4d3ece8ed9123766f347b2eb","error":"authconfigs.authorino.kuadrant.io \"b6a8f91d1ffdf775c75f2a1c84bb520696572aea4d3ece8ed9123766f347b2eb\" not found"}
{"level":"error","ts":"2026-11-02T22:30:55.871Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/bc33498b2dcdc2f8d2612aa17c0e640458a4442c9d7f2ad45303aeb15b5bccb9","error":"authconfigs.authorino.kuadrant.io \"bc33498b2dcdc2f8d2612aa17c0e640458a4442c9d7f2ad45303aeb15b5bccb9\" not found"}
{"level":"error","ts":"2026-11-02T22:30:55.926Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/8be72fdf7a1e6b1379ac7dc12f7c40286d882ef14376e9fd3e726b2fb781546c","error":"authconfigs.authorino.kuadrant.io \"8be72fdf7a1e6b1379ac7dc12f7c40286d882ef14376e9fd3e726b2fb781546c\" not found"}
{"level":"error","ts":"2026-11-02T22:30:55.981Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/b8fb7aae7cac121f592817a5e9754983e04e46d9e4226183153bf83b778fffdd","error":"authconfigs.authorino.kuadrant.io \"b8fb7aae7cac121f592817a5e9754983e04e46d9e4226183153bf83b778fffdd\" not found"}
{"level":"error","ts":"2026-11-02T22:30:56.036Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/df8548d2a100989756489c2811783626f3836ef18d08ba8c81bfb6b9e9ef9c28","error":"authconfigs.authorino.kuadrant.io \"df8548d2a100989756489c2811783626f3836ef18d08ba8c81bfb6b9e9ef9c28\" not found"}
{"level":"error","ts":"2026-11-02T22:30:56.090Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/099191e40682a5a6b1df435c6dc10936b8b4e31a891f3520e8e9f8418b1acc3e","error":"authconfigs.authorino.kuadrant.io \"099191e40682a5a6b1df435c6dc10936b8b4e31a891f3520e8e9f8418b1acc3e\" not found"}
{"level":"error","ts":"2026-11-02T22:30:56.147Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/f7254b99580aca11d813d05cebe8fd0d083eab4978ed55c24131cbd3917e5e39","error":"authconfigs.authorino.kuadrant.io \"f7254b99580aca11d813d05cebe8fd0d083eab4978ed55c24131cbd3917e5e39\" not found"}
{"level":"error","ts":"2026-11-02T22:30:56.202Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/6ac0410a29c97032cc673c8f56fb055dcd84c1040f73657459b7f1183a6ef131","error":"authconfigs.authorino.kuadrant.io \"6ac0410a29c97032cc673c8f56fb055dcd84c1040f73657459b7f1183a6ef131\" not found"}
{"level":"error","ts":"2026-11-02T22:30:56.256Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/ad3bad78fb2ca1b68182c777555c2a07f35742a0dc28e73d65c173489bf20bfe","error":"authconfigs.authorino.kuadrant.io \"ad3bad78fb2ca1b68182c777555c2a07f35742a0dc28e73d65c173489bf20bfe\" not found"}
{"level":"error","ts":"2026-11-02T22:30:56.312Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/a6fa5c95daf46871f07bc4e3ef7985a19659c040a1ef2a7baccccaa90e241705","error":"authconfigs.authorino.kuadrant.io \"a6fa5c95daf46871f07bc4e3ef7985a19659c040a1ef2a7baccccaa90e241705\" not found"}
{"level":"error","ts":"2026-11-02T22:30:56.367Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/f333a7db2a4322946ba06e577de4e4465e1174fb5cc0bb60d8d97ffd9018dc4b","error":"authconfigs.authorino.kuadrant.io \"f333a7db2a4322946ba06e577de4e4465e1174fb5cc0bb60d8d97ffd9018dc4b\" not found"}
{"level":"error","ts":"2026-11-02T22:30:56.421Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/36a5aec7d5b7178c754711c0ad90ec391fbc4764ff98bc952ff9d4d46a3e1fad","error":"authconfigs.authorino.kuadrant.io \"36a5aec7d5b7178c754711c0ad90ec391fbc4764ff98bc952ff9d4d46a3e1fad\" not found"}
{"level":"error","ts":"2026-11-02T22:30:56.476Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/e5f21bd702765764bb09a1ee4f30f2c44baa119970ede500be5eedb7653d9284","error":"authconfigs.authorino.kuadrant.io \"e5f21bd702765764bb09a1ee4f30f2c44baa119970ede500be5eedb7653d9284\" not found"}
{"level":"error","ts":"2026-11-02T22:30:56.530Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/2aaf9242e876623422852fe471269a2d268f4d784b14c7ab37ec9f34c17f3060","error":"authconfigs.authorino.kuadrant.io \"2aaf9242e876623422852fe471269a2d268f4d784b14c7ab37ec9f34c17f3060\" not found"}
{"level":"error","ts":"2026-11-02T22:30:56.585Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/e5e9b9fa41efe7f56f3ea6e9079d12a9f3e89cd596105815b30b04ba7ba1281b","error":"authconfigs.authorino.kuadrant.io \"e5e9b9fa41efe7f56f3ea6e9079d12a9f3e89cd596105815b30b04ba7ba1281b\" not found"}
{"level":"error","ts":"2026-11-02T22:30:56.639Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/735d43fce555e32c36cd137abc0678ce944fbfe58a677497d16ab8d9ab37074f","error":"authconfigs.authorino.kuadrant.io \"735d43fce555e32c36cd137abc0678ce944fbfe58a677497d16ab8d9ab37074f\" not found"}
{"level":"error","ts":"2026-11-02T22:30:56.694Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/371e486415502802484cc345e68be13e0a37a1abb38f2f6c8cce9f8e79b8d9c1","error":"authconfigs.authorino.kuadrant.io \"371e486415502802484cc345e68be13e0a37a1abb38f2f6c8cce9f8e79b8d9c1\" not found"}
{"level":"error","ts":"2026-11-02T22:30:56.750Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/106dc24382c96b56f69df1e4bfaa0455678809d57faded1081bc4e26a642d4a0","error":"authconfigs.authorino.kuadrant.io \"106dc24382c96b56f69df1e4bfaa0455678809d57faded1081bc4e26a642d4a0\" not found"}
{"level":"error","ts":"2026-11-02T22:30:56.812Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/2c4b4abb753457c4ad4bd5815f6ce55723fcfcf44f298a47923e03e51d023a49","error":"authconfigs.authorino.kuadrant.io \"2c4b4abb753457c4ad4bd5815f6ce55723fcfcf44f298a47923e03e51d023a49\" not found"}
{"level":"error","ts":"2026-11-02T22:30:56.868Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/6ed7710bfd4535612b60aefac40ff2eebbe50fc666cc75f29a23130bdd6ea269","error":"authconfigs.authorino.kuadrant.io \"6ed7710bfd4535612b60aefac40ff2eebbe50fc666cc75f29a23130bdd6ea269\" not found"}
{"level":"error","ts":"2026-11-02T22:30:56.923Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/c4c89ab332c30b38dc4f16ef73fecdbd0ef26ff23424b1e8fd0d18c2d45cf73d","error":"authconfigs.authorino.kuadrant.io \"c4c89ab332c30b38dc4f16ef73fecdbd0ef26ff23424b1e8fd0d18c2d45cf73d\" not found"}
{"level":"error","ts":"2026-11-02T22:30:56.978Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/5c34c962f04362894a54cdf652c523865dbd1633f051244729b008181d474e55","error":"authconfigs.authorino.kuadrant.io \"5c34c962f04362894a54cdf652c523865dbd1633f051244729b008181d474e55\" not found"}
{"level":"error","ts":"2026-11-02T22:30:57.033Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/32a498b3029fba046b39d6c26d52ecb2de8f74b942f2d122b45240b1a839deae","error":"authconfigs.authorino.kuadrant.io \"32a498b3029fba046b39d6c26d52ecb2de8f74b942f2d122b45240b1a839deae\" not found"}
{"level":"error","ts":"2026-11-02T22:30:57.087Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/c5421eebe7da7086c1d4756a4f69af5cdd7ec596e7f07e8aff73f29facff31ae","error":"authconfigs.authorino.kuadrant.io \"c5421eebe7da7086c1d4756a4f69af5cdd7ec596e7f07e8aff73f29facff31ae\" not found"}
{"level":"error","ts":"2026-11-02T22:30:57.142Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/ddbb47f4f9dda290c11f442f07feec9b2e64a236ec2c98dd4fb16a3796302ba3","error":"authconfigs.authorino.kuadrant.io \"ddbb47f4f9dda290c11f442f07feec9b2e64a236ec2c98dd4fb16a3796302ba3\" not found"}
{"level":"error","ts":"2026-11-02T22:30:57.196Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/6d702678bda1dfc9e3eeb362adcee5bc69be4839840717fadfcf3f540bbad15d","error":"authconfigs.authorino.kuadrant.io \"6d702678bda1dfc9e3eeb362adcee5bc69be4839840717fadfcf3f540bbad15d\" not found"}
{"level":"error","ts":"2026-11-02T22:30:57.251Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/68beb50e573f7f8f729255a19248728f937beeab700e92bcc9c0a070e602e982","error":"authconfigs.authorino.kuadrant.io \"68beb50e573f7f8f729255a19248728f937beeab700e92bcc9c0a070e602e982\" not found"}
{"level":"error","ts":"2026-11-02T22:30:57.306Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/d4fbd382871bb4f5406c37842f4848012cdca0b01e2d7698dc28e396dc18659d","error":"authconfigs.authorino.kuadrant.io \"d4fbd382871bb4f5406c37842f4848012cdca0b01e2d7698dc28e396dc18659d\" not found"}
{"level":"error","ts":"2026-11-02T22:30:57.360Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/6ceeddb720a82c7a3a1051f6517a47c73f8528f97b9e67d8dd2f7dd9419967e1","error":"authconfigs.authorino.kuadrant.io \"6ceeddb720a82c7a3a1051f6517a47c73f8528f97b9e67d8dd2f7dd9419967e1\" not found"}
{"level":"error","ts":"2026-11-02T22:30:57.415Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/503064d3f84a23711f1dad5e35d11ef1efceaefb2204608d180ef8d886666ffa","error":"authconfigs.authorino.kuadrant.io \"503064d3f84a23711f1dad5e35d11ef1efceaefb2204608d180ef8d886666ffa\" not found"}
{"level":"error","ts":"2026-11-02T22:30:57.470Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/6060eef24f1f9e109ceaa90837578da0e77128864be44cea71a6e4d056f6aed1","error":"authconfigs.authorino.kuadrant.io \"6060eef24f1f9e109ceaa90837578da0e77128864be44cea71a6e4d056f6aed1\" not found"}
{"level":"error","ts":"2026-11-02T22:30:57.524Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/881b63d46f0e94053b88caefbfd71fdab183199879cb564ccb3671b6189fcc2e","error":"authconfigs.authorino.kuadrant.io \"881b63d46f0e94053b88caefbfd71fdab183199879cb564ccb3671b6189fcc2e\" not found"}
{"level":"error","ts":"2026-11-02T22:30:57.579Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/f27c742360d050f8cfba473367fd8076f0a6abdf57b30c6116d8b1fa7559bcc0","error":"authconfigs.authorino.kuadrant.io \"f27c742360d050f8cfba473367fd8076f0a6abdf57b30c6116d8b1fa7559bcc0\" not found"}
{"level":"error","ts":"2026-11-02T22:30:57.634Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/85484301f7aa6f30a87b224096575af8d7beea83a8ccf5091f246a4cb028e31b","error":"authconfigs.authorino.kuadrant.io \"85484301f7aa6f30a87b224096575af8d7beea83a8ccf5091f246a4cb028e31b\" not found"}
{"level":"error","ts":"2026-11-02T22:30:57.688Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/922492b3fb118d2a03b9019d5fd7a1e7fc6f7f5e4559c5e1a0ef89b6f41e6c00","error":"authconfigs.authorino.kuadrant.io \"922492b3fb118d2a03b9019d5fd7a1e7fc6f7f5e4559c5e1a0ef89b6f41e6c00\" not found"}
{"level":"error","ts":"2026-11-02T22:30:57.743Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/b69fcfecbff8a7db20373884ddd2ca22e39f7a814dfc0946441bf6dc7f369a4d","error":"authconfigs.authorino.kuadrant.io \"b69fcfecbff8a7db20373884ddd2ca22e39f7a814dfc0946441bf6dc7f369a4d\" not found"}
{"level":"error","ts":"2026-11-02T22:30:57.798Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/4db1dd6250896b02d5f97b90471902db72d349ea082f211b7b5e4046c827d477","error":"authconfigs.authorino.kuadrant.io \"4db1dd6250896b02d5f97b90471902db72d349ea082f211b7b5e4046c827d477\" not found"}
{"level":"error","ts":"2026-11-02T22:30:57.852Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/af01177c39cc2acfc81deb8fed1e1062fd6125232da28da32592d4c0fd546c97","error":"authconfigs.authorino.kuadrant.io \"af01177c39cc2acfc81deb8fed1e1062fd6125232da28da32592d4c0fd546c97\" not found"}
{"level":"error","ts":"2026-11-02T22:30:57.907Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/915885eb7c9a3e141be9223dcd2bf03d4b850977922b9f3ad6f812809cf05a77","error":"authconfigs.authorino.kuadrant.io \"915885eb7c9a3e141be9223dcd2bf03d4b850977922b9f3ad6f812809cf05a77\" not found"}
{"level":"error","ts":"2026-11-02T22:30:57.961Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/99ce90aab60d81af668145560f9879cd2b5941652fd3e18c3d45856709a0948e","error":"authconfigs.authorino.kuadrant.io \"99ce90aab60d81af668145560f9879cd2b5941652fd3e18c3d45856709a0948e\" not found"}
{"level":"error","ts":"2026-11-02T22:30:58.016Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/0b8fd96f5e30886bce6ea837ac57b2f3d77783c525b1de469227d248ca2a1d6e","error":"authconfigs.authorino.kuadrant.io \"0b8fd96f5e30886bce6ea837ac57b2f3d77783c525b1de469227d248ca2a1d6e\" not found"}
{"level":"error","ts":"2026-11-02T22:30:58.070Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/784ccec783ba11c98817fe5af2849f9f4970be19046e351a067c85add913f548","error":"authconfigs.authorino.kuadrant.io \"784ccec783ba11c98817fe5af2849f9f4970be19046e351a067c85add913f548\" not found"}
{"level":"error","ts":"2026-11-02T22:30:58.125Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/9178bfcf79bd6f1164069b245bef389ffaa38dddce2763e94a3e39d83454aa7f","error":"authconfigs.authorino.kuadrant.io \"9178bfcf79bd6f1164069b245bef389ffaa38dddce2763e94a3e39d83454aa7f\" not found"}
{"level":"error","ts":"2026-11-02T22:30:58.180Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/7f9f489fba4cc345dba07951f043d704ea999478c1da34cd23037357dcdf1384","error":"authconfigs.authorino.kuadrant.io \"7f9f489fba4cc345dba07951f043d704ea999478c1da34cd23037357dcdf1384\" not found"}
{"level":"error","ts":"2026-11-02T22:30:58.235Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/f2655bcd7b6a7d3d8a4479c1c943c5f2b4d4fbb7d96408fc7ce07c4e7bd9f30c","error":"authconfigs.authorino.kuadrant.io \"f2655bcd7b6a7d3d8a4479c1c943c5f2b4d4fbb7d96408fc7ce07c4e7bd9f30c\" not found"}
{"level":"error","ts":"2026-11-02T22:30:58.289Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/c7906cc8021baa6797dfa1978c7ce78b494865d95b66f59ca1cd380376b5fba9","error":"authconfigs.authorino.kuadrant.io \"c7906cc8021baa6797dfa1978c7ce78b494865d95b66f59ca1cd380376b5fba9\" not found"}
{"level":"error","ts":"2026-11-02T22:30:58.344Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/ccba7a9b1f6fb13d16375041d5707e71f92b68b4e5eb52e231100015ff08ef4b","error":"authconfigs.authorino.kuadrant.io \"ccba7a9b1f6fb13d16375041d5707e71f92b68b4e5eb52e231100015ff08ef4b\" not found"}
{"level":"error","ts":"2026-11-02T22:30:58.399Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/313f15eb64d50822c9c91871179d7a6ffa3111f658f213fdc0612575f480add7","error":"authconfigs.authorino.kuadrant.io \"313f15eb64d50822c9c91871179d7a6ffa3111f658f213fdc0612575f480add7\" not found"}
{"level":"error","ts":"2026-11-02T22:30:58.454Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/edbbdcfc920b88151941be1a4c41ad8be6a38bd6beddae7387db202bc3e9b302","error":"authconfigs.authorino.kuadrant.io \"edbbdcfc920b88151941be1a4c41ad8be6a38bd6beddae7387db202bc3e9b302\" not found"}
{"level":"error","ts":"2026-11-02T22:30:58.508Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/ad04b751b35d313ca76c5057f5e800aa0d5504bc27298aa1762dd803d351bff2","error":"authconfigs.authorino.kuadrant.io \"ad04b751b35d313ca76c5057f5e800aa0d5504bc27298aa1762dd803d351bff2\" not found"}
{"level":"error","ts":"2026-11-02T22:30:58.563Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/9ba6421c13373b029e319749dfcc66205cba71509d9781aae6bc20029ca16a7b","error":"authconfigs.authorino.kuadrant.io \"9ba6421c13373b029e319749dfcc66205cba71509d9781aae6bc20029ca16a7b\" not found"}
{"level":"error","ts":"2026-11-02T22:30:58.618Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/3d0d554392a2c25a1ce426beeffb3f2b91339d1b96f1197bf10fe0af0ece726b","error":"authconfigs.authorino.kuadrant.io \"3d0d554392a2c25a1ce426beeffb3f2b91339d1b96f1197bf10fe0af0ece726b\" not found"}
{"level":"error","ts":"2026-11-02T22:30:58.673Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/23d2f913b5bde1ed64144a38680e6282220982f4f5ea1167fabdda3234dbc67e","error":"authconfigs.authorino.kuadrant.io \"23d2f913b5bde1ed64144a38680e6282220982f4f5ea1167fabdda3234dbc67e\" not found"}
{"level":"error","ts":"2026-11-02T22:30:58.727Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/8614fe473acb7380c1bbcefbfc7ddc49bdb08a20998450fd852a13de53bb8a12","error":"authconfigs.authorino.kuadrant.io \"8614fe473acb7380c1bbcefbfc7ddc49bdb08a20998450fd852a13de53bb8a12\" not found"}
{"level":"error","ts":"2026-11-02T22:30:58.781Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/62457e23e29ce9b4e8380d685c5e9e84bc5137e91486a6f9c1c9e352ca3a021c","error":"authconfigs.authorino.kuadrant.io \"62457e23e29ce9b4e8380d685c5e9e84bc5137e91486a6f9c1c9e352ca3a021c\" not found"}
{"level":"error","ts":"2026-11-02T22:30:58.836Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/9a442413f7e81c114c48c6bbdd04c0e3809cdcdf4def1f524f6d3adf70468027","error":"authconfigs.authorino.kuadrant.io \"9a442413f7e81c114c48c6bbdd04c0e3809cdcdf4def1f524f6d3adf70468027\" not found"}
{"level":"error","ts":"2026-11-02T22:30:58.891Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/beb0d5e916dc078abcaba4ea5b4d8012d5c2d8edfd07ca54d585bfe44d7c605a","error":"authconfigs.authorino.kuadrant.io \"beb0d5e916dc078abcaba4ea5b4d8012d5c2d8edfd07ca54d585bfe44d7c605a\" not found"}
{"level":"error","ts":"2026-11-02T22:30:58.945Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/ad5aa9665d52830893fb4af1a6c52222eff28c5437dcf9fe501cab6f82aeaea0","error":"authconfigs.authorino.kuadrant.io \"ad5aa9665d52830893fb4af1a6c52222eff28c5437dcf9fe501cab6f82aeaea0\" not found"}
{"level":"error","ts":"2026-11-02T22:30:59.000Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/8f577e4cdeda37406cbf43b607fe4ff7a6bd85c0d3b2c53a45b82a9207f437f9","error":"authconfigs.authorino.kuadrant.io \"8f577e4cdeda37406cbf43b607fe4ff7a6bd85c0d3b2c53a45b82a9207f437f9\" not found"}
{"level":"error","ts":"2026-11-02T22:30:59.054Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/c5c4680765cefb123f1033aa2b612856432a81adb7bccb16df753674ddd4a42e","error":"authconfigs.authorino.kuadrant.io \"c5c4680765cefb123f1033aa2b612856432a81adb7bccb16df753674ddd4a42e\" not found"}
{"level":"error","ts":"2026-11-02T22:30:59.109Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/828fe179b1caaef8c4abb4ba71cbe53ab31fc04108a1194889605dd8100c90f1","error":"authconfigs.authorino.kuadrant.io \"828fe179b1caaef8c4abb4ba71cbe53ab31fc04108a1194889605dd8100c90f1\" not found"}
{"level":"error","ts":"2026-11-02T22:30:59.163Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/41e99bc62a2ac4e8034135f4b655088597f627c66b2efc4627394d148bc2b0ce","error":"authconfigs.authorino.kuadrant.io \"41e99bc62a2ac4e8034135f4b655088597f627c66b2efc4627394d148bc2b0ce\" not found"}
{"level":"error","ts":"2026-11-02T22:30:59.218Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/bf3fa706be871596c50143869f253e98ce7aa463d723d2f419d378a041dbfbe5","error":"authconfigs.authorino.kuadrant.io \"bf3fa706be871596c50143869f253e98ce7aa463d723d2f419d378a041dbfbe5\" not found"}
{"level":"error","ts":"2026-11-02T22:30:59.272Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/7d8b4229a4e8df0df0b627da5317c526c045e2ab5837161d638a7835193820d5","error":"authconfigs.authorino.kuadrant.io \"7d8b4229a4e8df0df0b627da5317c526c045e2ab5837161d638a7835193820d5\" not found"}
{"level":"error","ts":"2026-11-02T22:30:59.445Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-b-w0-0f0874","namespace":"openshift-ingress","uid":"8b4ec7cb-daa9-467a-b2f6-528aa3d837fc","error":"tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-b-w0-0f0874\" not found"}
{"level":"error","ts":"2026-11-02T22:30:59.448Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-a-w3-97995b-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-a-w3-97995b-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:59.510Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-b-w0-0f0874-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-b-w0-0f0874-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:59.559Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-a-w0-6e535d","namespace":"openshift-ingress","uid":"0eae774a-4032-4461-b2be-6f3edd911a80","error":"tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-a-w0-6e535d\" not found"}
{"level":"error","ts":"2026-11-02T22:30:59.714Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-b-w3-a1d751-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-b-w3-a1d751-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:30:59.773Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-a-w0-6e535d-maas-auth","namespace":"openshift-ingress","error":"authpolicies.kuadrant.io \"e2e-shared-a-w0-6e535d-maas-auth\" not found"}
{"level":"info","ts":"2026-11-02T22:31:00.029Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T22:31:00.029Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T22:31:00.086Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-a-w0-6e535d","error":"gateways.gateway.networking.k8s.io \"e2e-shared-a-w0-6e535d\" not found"}
{"level":"error","ts":"2026-11-02T22:31:00.389Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-b-w0-0f0874","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-shared-b-w0-0f0874\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:31:00.508Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"data-science-gateway","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"data-science-gateway\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:31:05.679Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","Gateway","AuthPolicy","ConfigMap","EnvoyFilter","Kuadrant","Limitador","TokenRateLimitPolicy","HTTPRoute"],"eventTypes":{"delete":183,"update":27}}
{"level":"info","ts":"2026-11-02T22:31:05.805Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:31:05.816Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T22:31:06.553Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T22:31:06.554Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T22:31:06.824Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:31:06.824Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T22:31:06.959Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:31:07.855Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:31:07.855Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:31:07.861Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T22:31:07.873Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:31:07.873Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T22:31:07.874Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-11-02T22:31:07.946Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:31:07.946Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T22:31:09.392Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T22:31:09.392Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T22:31:14.660Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Limitador","ConfigMap","AuthPolicy","Gateway","AuthConfig","EnvoyFilter"],"eventTypes":{"delete":15,"update":5}}
{"level":"info","ts":"2026-11-02T22:31:14.733Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T22:31:15.332Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T22:31:15.461Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:31:15.461Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T22:31:16.544Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:31:16.548Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:31:16.554Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T22:31:16.559Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:31:16.563Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:31:16.563Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T22:31:16.630Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T22:31:17.836Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T22:31:17.836Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T22:31:25.698Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Limitador","ConfigMap"],"eventTypes":{"update":2}}
{"level":"info","ts":"2026-11-02T22:31:25.824Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T22:31:26.558Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T22:31:26.741Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:31:26.741Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T22:31:27.474Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:31:27.475Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:31:27.477Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-02T22:31:27.477Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T22:31:27.954Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w0-0c9014","namespace":"e2e-models-e2e-worker-w0-0c9014","uid":"4f647df6-1d5b-433b-b4fc-1279ff1755f7","error":"tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w0-0c9014\" not found"}
{"level":"info","ts":"2026-11-02T22:31:28.138Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T22:31:28.138Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T22:31:28.272Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthPolicy","Gateway"],"eventTypes":{"delete":2,"update":1}}
{"level":"info","ts":"2026-11-02T22:31:30.080Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:31:30.123Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:31:30.130Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:31:30.130Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T22:31:30.131Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-02T22:31:30.131Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T22:31:30.140Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-11-02T22:31:31.582Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w0-0c9014","namespace":"e2e-models-e2e-worker-w0-0c9014","uid":"4f647df6-1d5b-433b-b4fc-1279ff1755f7","error":"tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w0-0c9014\" not found"}
{"level":"error","ts":"2026-11-02T22:31:31.640Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-simulated-simulated-premium","namespace":"llm","uid":"447993be-3c57-4e68-8ffa-6fc998a39c77","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-simulated-simulated-premium\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:31:31.697Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-b-w3-a1d751","namespace":"openshift-ingress","uid":"2c7a0593-2f35-427a-b6f0-958582546c18","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-b-w3-a1d751\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:31:31.754Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w0-0c9014","namespace":"e2e-models-e2e-worker-w0-0c9014","uid":"dcb5a0e4-7049-4ddc-91de-e14d55b09789","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w0-0c9014\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:31:31.871Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w3-f51151","namespace":"e2e-models-e2e-worker-w3-f51151","uid":"c78aa03a-e3ca-4797-8a09-ab0d9cd88148","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w3-f51151\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:31:31.929Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w3-f51151","namespace":"e2e-models-e2e-worker-w3-f51151","uid":"e3340067-224a-43ad-8020-ca9e00ead152","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w3-f51151\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:31:31.986Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-facebook-opt-125m-simulated","namespace":"llm","uid":"da8edb1a-ed61-454d-939f-fc7cd235d9fb","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-facebook-opt-125m-simulated\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:31:32.102Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-a-w3-97995b","namespace":"openshift-ingress","uid":"9405e4ea-22ff-4c46-bbc0-f492e0e403dc","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-a-w3-97995b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:31:32.162Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T22:31:32.162Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T22:31:37.536Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","ConfigMap","AuthPolicy","TokenRateLimitPolicy","Limitador"],"eventTypes":{"delete":1,"update":28}}
{"level":"info","ts":"2026-11-02T22:31:37.607Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T22:31:38.045Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T22:31:38.157Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:31:38.157Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T22:31:39.154Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:31:39.157Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:31:39.163Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T22:31:39.173Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:31:39.173Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T22:31:39.175Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:31:39.273Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T22:31:43.701Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T22:31:43.701Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T22:31:44.230Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthPolicy"],"eventTypes":{"update":1}}
{"level":"info","ts":"2026-11-02T22:31:45.849Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:31:45.852Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:31:45.852Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-02T22:31:45.964Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-02T21:23:34Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:24:05Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:24:05Z"}],"name":"06c24ca69f585351676e3a47fdf7a96df9b9a8fe85641e1c3348c8cfdfe446cb","namespace":"kuadrant-system","resourceVersion":"30912","uid":"7a426f2f-729f-4903-8b67-8f575490065e"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["06c24ca69f585351676e3a47fdf7a96df9b9a8fe85641e1c3348c8cfdfe446cb"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w0-0c9014.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w0-0c9014.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:23:34Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:23:34Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["06c24ca69f585351676e3a47fdf7a96df9b9a8fe85641e1c3348c8cfdfe446cb"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"06c24ca69f585351676e3a47fdf7a96df9b9a8fe85641e1c3348c8cfdfe446cb\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:31:46.026Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-02T21:29:14Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:29:14Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:29:14Z"}],"name":"6b6f55f762b51c1f46156308a7f509359377c543fd3789f104b3416ff46e3216","namespace":"kuadrant-system","resourceVersion":"38451","uid":"85d2b316-4aab-4fdc-8a84-f88d55ca4b6c"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["6b6f55f762b51c1f46156308a7f509359377c543fd3789f104b3416ff46e3216"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w0-0c9014.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w0-0c9014.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:29:14Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:29:14Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["6b6f55f762b51c1f46156308a7f509359377c543fd3789f104b3416ff46e3216"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"6b6f55f762b51c1f46156308a7f509359377c543fd3789f104b3416ff46e3216\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:31:46.089Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-02T21:27:44Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:27:44Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:27:44Z"}],"name":"463f896d9e9b5a3f2518e764053718a018fbe93828587f90cc4250e5a67a2236","namespace":"kuadrant-system","resourceVersion":"36207","uid":"b2055a57-c951-41e4-ab14-818a8ec16f69"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["463f896d9e9b5a3f2518e764053718a018fbe93828587f90cc4250e5a67a2236"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w0-0c9014.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w0-0c9014.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:27:44Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:27:44Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["463f896d9e9b5a3f2518e764053718a018fbe93828587f90cc4250e5a67a2236"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"463f896d9e9b5a3f2518e764053718a018fbe93828587f90cc4250e5a67a2236\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:31:46.150Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-0c9014","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-0c9014#rule-2"},"creationTimestamp":"2026-11-02T21:21:39Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:24:07Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:24:07Z"}],"name":"59093ab44195ceb3a72fd7400b422644d3d7c840cd3e838bafbbcf827cbcc073","namespace":"kuadrant-system","resourceVersion":"30998","uid":"3a48dc7c-6ee1-4d5d-b4f4-1359bb2bd99f"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["59093ab44195ceb3a72fd7400b422644d3d7c840cd3e838bafbbcf827cbcc073"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w0-0c9014.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w0-0c9014.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:21:39Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:21:39Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["59093ab44195ceb3a72fd7400b422644d3d7c840cd3e838bafbbcf827cbcc073"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"59093ab44195ceb3a72fd7400b422644d3d7c840cd3e838bafbbcf827cbcc073\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:31:46.211Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-02T21:29:15Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:29:15Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:29:15Z"}],"name":"884ebceaf8f5da21059151f97834277770ed77023feb57f83fc8c75e495f8d1c","namespace":"kuadrant-system","resourceVersion":"38470","uid":"6d824d92-ae02-42ce-9627-c2be9a5394e9"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["884ebceaf8f5da21059151f97834277770ed77023feb57f83fc8c75e495f8d1c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w0-0c9014.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w0-0c9014.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:29:15Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:29:15Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["884ebceaf8f5da21059151f97834277770ed77023feb57f83fc8c75e495f8d1c"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"884ebceaf8f5da21059151f97834277770ed77023feb57f83fc8c75e495f8d1c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:31:46.274Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-02T21:27:44Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:27:44Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:27:45Z"}],"name":"b8e8a49e358e54b12e2aba59e563ba17bcf32315bebde13a721f3b7ebfae18ba","namespace":"kuadrant-system","resourceVersion":"36254","uid":"15fb44e1-6573-4a91-8577-7f101a98278a"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["b8e8a49e358e54b12e2aba59e563ba17bcf32315bebde13a721f3b7ebfae18ba"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w0-0c9014.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w0-0c9014.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:27:45Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:27:45Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["b8e8a49e358e54b12e2aba59e563ba17bcf32315bebde13a721f3b7ebfae18ba"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"b8e8a49e358e54b12e2aba59e563ba17bcf32315bebde13a721f3b7ebfae18ba\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:31:46.367Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-worker-w0-0c9014","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T21:21:39Z","generation":16,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"ddb57683-c2b1-4246-8c87-c1833e256a52\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:53:12Z"}],"name":"kuadrant-e2e-worker-w0-0c9014","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-worker-w0-0c9014","uid":"ddb57683-c2b1-4246-8c87-c1833e256a52"}],"resourceVersion":"80288","uid":"3a59a593-1a36-4e21-9529-ff8f3620d431"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"86115b8156c50eab2036378ac37ec53b33537f0eef44a4aa5d81752c24254c82\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"c69d9902b654dc255ef5aa6007c01753aa727fc097ae6b83d952cc0cf913761b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bdc9387e460a2dc1a85bc42d8ce6440788e8331159ace91b443c9628ef7c1fed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"2f68643a3c63d5b17fdfef48d85bd91a0973501f0d563a896e4b380a0b00d185\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e1cab00a309f6035001c6bed21b280b9cd6d81b83072c8f351fbe860f69886ad\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"d886729ca10572769b8b41e68ee56fb12942ea073f0b48ede22b1cc50bfcc40f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fe65e47ea66e64f823a934786806a737bfe3ca692bad4019774d91daeb2348d1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"e10af8f1a2640cf1de04932f79e79764db98097340db6ec566b3ab0af709d0d8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"86115b8156c50eab2036378ac37ec53b33537f0eef44a4aa5d81752c24254c82\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"34720a2e4d6ed7817a277e99c8b6c63bea050141799be3b70b3690e8575a06a6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bdc9387e460a2dc1a85bc42d8ce6440788e8331159ace91b443c9628ef7c1fed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"3a712e9256a22351eb20be5c7695beb1ebb8fb8ce2b2061a380c7829f310a235\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e1cab00a309f6035001c6bed21b280b9cd6d81b83072c8f351fbe860f69886ad\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"24d4dc5eb03a2701700ed1da77fab5dada30f4d5f19acc2aeb784ab7c2913842\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fe65e47ea66e64f823a934786806a737bfe3ca692bad4019774d91daeb2348d1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"95b56d1eb3f5f986a8dcd4728f616565f9664996c1a434f44f7b87c3972457ca\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"86115b8156c50eab2036378ac37ec53b33537f0eef44a4aa5d81752c24254c82\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"f831f6710914a69194c3f7c48e2651f7e183a1e62afcb27c73307245ab045f93\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bdc9387e460a2dc1a85bc42d8ce6440788e8331159ace91b443c9628ef7c1fed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"ad3a2d8079306ff1eeb9734837c5b71f0724eb8028848f90dbf05b80557a363c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e1cab00a309f6035001c6bed21b280b9cd6d81b83072c8f351fbe860f69886ad\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"44114992b7dce232405acd1cfada4b72839265de04c15b8c8b12cba013144276\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fe65e47ea66e64f823a934786806a737bfe3ca692bad4019774d91daeb2348d1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"a594b6f1c0a2b22e4714c27e98575eda080192ee3760bdfca9b4ad6aa516eee0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"86115b8156c50eab2036378ac37ec53b33537f0eef44a4aa5d81752c24254c82\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"de21a6b7dab6f53ab9e521b41625d35020e107d76ddb50e2958e0e2a412d9e40\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bdc9387e460a2dc1a85bc42d8ce6440788e8331159ace91b443c9628ef7c1fed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"9d9413f8be4dfb8834299266127fb239516760f378a7601605194b5533f62a28\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e1cab00a309f6035001c6bed21b280b9cd6d81b83072c8f351fbe860f69886ad\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"b608ac3153414f90d7bc1d459d441fc96968144e3d07d2286f28927e15b1e621\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fe65e47ea66e64f823a934786806a737bfe3ca692bad4019774d91daeb2348d1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"31897c718cc142df0d5d16918dfaf37807fffedaa54950878ada2e28c78ed1ea\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"86115b8156c50eab2036378ac37ec53b33537f0eef44a4aa5d81752c24254c82\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"0f90af4971cd47ea5ddd60d45eba18a900b5cf23592a3f0ecd9d46778e3738e0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bdc9387e460a2dc1a85bc42d8ce6440788e8331159ace91b443c9628ef7c1fed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"93ac09aaab9c4f036a2bdd254b8b96a4151063abefd4189c40778e53ebecdc09\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e1cab00a309f6035001c6bed21b280b9cd6d81b83072c8f351fbe860f69886ad\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"8791484f6beb20141c5c557cf7cec8b4649b67a98f43b54539a6ee6a88bceb5f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fe65e47ea66e64f823a934786806a737bfe3ca692bad4019774d91daeb2348d1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"5009bcd6ede0ee206f1c68b91ea406216f5da58a2b1c5f056ba6778c5f13d641\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"86115b8156c50eab2036378ac37ec53b33537f0eef44a4aa5d81752c24254c82\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"140e618f0bcaa91b635c87d4f29e5f8813bf0436d1f6e9b36373faecbdec61eb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"86115b8156c50eab2036378ac37ec53b33537f0eef44a4aa5d81752c24254c82\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"6acbaeb49e85ee3cb000f040214618990342fd0a59de5b2c5a1f90647758a246\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bdc9387e460a2dc1a85bc42d8ce6440788e8331159ace91b443c9628ef7c1fed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"5b6e6a7f7dc5f0d34eb857ca49303262b3c223fe67458805f41c060248c5dbfe\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bdc9387e460a2dc1a85bc42d8ce6440788e8331159ace91b443c9628ef7c1fed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"2127668fa8fef2292ac1484bc4a37390a4f7d56256dc3e5dbee6c3e5a11a9b76\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e1cab00a309f6035001c6bed21b280b9cd6d81b83072c8f351fbe860f69886ad\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"0aa314d93ee3acda2c2d9263c7d5271f8931007a465cca802fa4f97f82de8fea\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e1cab00a309f6035001c6bed21b280b9cd6d81b83072c8f351fbe860f69886ad\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"cb70a8e00aa575e704bd5c438dfcc5d7f8961efe6033fd93fae3fc6eca018120\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fe65e47ea66e64f823a934786806a737bfe3ca692bad4019774d91daeb2348d1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"1acbce7018705c04168bda5187e037e60c0fe47f186f10f96e84266e33b5b034\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fe65e47ea66e64f823a934786806a737bfe3ca692bad4019774d91daeb2348d1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"52baf0b74be4e68628b5b4ef71a9d95dad1cf739658ce467c9b24c3165eac562\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"86115b8156c50eab2036378ac37ec53b33537f0eef44a4aa5d81752c24254c82\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"a9b1a49056b3283c82e0d4f88ad61bed5b6f4b736a70f1bb2ef4ba19a80a05e0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bdc9387e460a2dc1a85bc42d8ce6440788e8331159ace91b443c9628ef7c1fed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"30c85ca7419d0f9a695b73530b16cb571b50e9dde62c1210e8c4fe44c14e4def\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e1cab00a309f6035001c6bed21b280b9cd6d81b83072c8f351fbe860f69886ad\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"5a52f00c07e5813093290d1bee011f0120610619cb82666a79b0139919644d6e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fe65e47ea66e64f823a934786806a737bfe3ca692bad4019774d91daeb2348d1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"309ad48f4f9314f702e5565256eb6d81567787f6737820f7ffb21a6d85a92b93\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"00c4d48b9f06a2f5dbb9cbe22ae3dcc9e10401b038e62058849dcebe2769e4f1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-0c9014\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-0c9014\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"02e0339b7fefd72794f04b407e26149d4822a36b0c408bf1129e0f7ccdc0cfdb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"884ebceaf8f5da21059151f97834277770ed77023feb57f83fc8c75e495f8d1c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"bb55cf856b87c0953ba4478213144ef02787b3cbbf80cc32e530521407ee40b0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7da280ddad70ebcc1b84b8a595244d0682cd0302755439371683331c4562cfe5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"23b1ef8cd3219264f8227915650891004d0dbf97a799031e0e6e6967fcd5f1c8\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fe169ab2014a705a54df2fda4ec719f7132fd6bba54202f7531ce8df8da2bdf6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"5f4fc30622e992160dd04a2ed38f7e44c1794374d6682ae9f1f7ca01be3ee831\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8cb0b0d9cbe25e4182aea7d2ed6f3ca636a7d0c9be364f722b182dde26da45e1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"ca6fe2da7884bdf4da7e4fad467882fb9f7b1a542ef29da25c93b58c0a2facf5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5f8a52baf63f9e4c9ea31b6e22c9076262e33bc06968bbcb213439af05ae3a21\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"4e45e802c43f08adeba0b390be3827705a757991fe469c439db480762890906f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9a7eea6dc0fbfacc7f1b1980a90d1b04de88692dd5758d6a6457477b77a64673\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"0657b3667bafd18f07dc410bc515b76f51256e8c487baf4fe36409a313e6191e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ece9796b491eeaad9788ab6c426bb54d8cbb85433a9010ef2c4d3f579cca0db0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"5b95fd1a3cba680d3078cbfcc3ed349106804d68df9ff279d7829f1ce54c9fcb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3d645f3ac772a0cc5a9a71b4e6a542a2b2ab9962190903cb5d89d3e8e45b7f9d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"d61768c90b21a96135005ba91b0f0abbf7ffc2bd4f372c506a740a4d2280118a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"bcf1ddf402fe28df1f45e616a2e2380b51177c45a7f8dcdd03bc2aa6b5814d26\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"0d7aee7ae66dd59feb746b56375d3063a0a395dd032211e5f6fd8a79acc4c534\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4cc208f8f31098b1cdf91b5776a85b52bae0339e659b20995e8ad11208703993\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"d480cd881add8aa6a454eefd0ff4a4f1883e0f31dd0af2c4fc8d49930dfd988a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"096fbc9d544918ac5b9d60464268ef3b1f03546e96ed130c743da74445576f52\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"862991ab77df3e7a553882c71a94c90c8006da4badbb5d62b2523a0c2ae8397b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"228ec96802a09009d984b3728e4e96175fefb32ba2e3b918071e85b3f8ec79d0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"1174da5781e0d01a3f99ec7d577f0c792e9d2f3d97450b0297d625c782aae7c6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6d14c0784badaddad1e95c3697462cedd1c5a5cf32d3a98f16155abc0721429e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"c6601f905085efd63830b0439c759fd2e17f4b3a0625b37e6ca853dfb418a3fe\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"669fd13dfb6f84f6e255bbee071a63253e1d5bd80a372cb6a445299b3c53a1a6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"aae79ba1b6eabe4b8be62d566c21c48755697af6a5a955ca0108115f218409f6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b0bfe3b1d3a080ff25e482046cf0d1df0ca30a090ef9f8424787467410af7627\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"cfedc7f35c0353d53fec0474975ad5e05c19ec8b2ac4718a77f59ccd7fb1233c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b0476fc7cd4ea3306c893f375fa8b815ad5c84676dd8000109732b76fc6c9e7d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"2fc0502446287f4669be2a416f781c0acba21256ff9eb15861862053f18d0e29\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4dcc64ddad4ef375730fe33c8b8925944bf0c1750f66d8a3347219a51dd190d3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"fe7515ad4af2d0fbe432bcf9bb564a76c332dd67819f108c4e0ccd547ada4eb1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a24eea90cd520665ff61391c71ddaf8965158b1b42c4e6f9fe99dd03dfa7c401\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"2036d4e41537afdd08f850cbe0bbe0d23c83b572c0c1f917f2cd718904dfce6d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1cd65b24c576b1e8f7a954fffca2225dfb109bf5a068107003d4f72206723e55\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"909bedc4bbf04ca094fb3d369cf7cb3b15d83ab3e98ef27c04ee79b787659c95\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"be088898c71049f4ea232cae6dd479dfab1a9947fba6b17e7353ce14e639507c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"cfc0c9b5c46987f78f689a5a334275694f4c03653d50c2fbe6e969e238c7f8cb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"03e9bc99c98697160f9a6db2252bc0ba9e88e4ed113a3d5d851256f6cee3dcab\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"642d89c776f69505ff2a885b3a3e0374200ad36c578ca4799ed899b1dc0cf546\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0e0bbf1b6879cb3f68f7ea7f2afda47c74a88c5d3cb97fdf3e110cdc54718649\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"f05bad08945108f9026112e207cee46af50e92faf4445f0e991b27b9412c4c58\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ad6b1369f6065e5d01605f83113ef1c7c93ed4b3fa8d01ad81d870c4a418f675\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"9eb0cbcb37fa43674c71b90f27589d7260b93ced662c1ceb0efe4cb1f91dab4c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4b932ff2b149c42a260b63c5bdd2b0515a398d1964de7381e0735756ee620b8e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"6fbda76757cae53d56b898432e232fb51847f0a1452503c1d53bf530847020ed\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a8ba5320fff14c281f32c2b0a9e757f0e205aace00c294b0d13fa46185724d35\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"8d788326bd35d2b328ba885da80b8eac2f0f1f55930d0bd275aa0c5fd637e227\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0ad1aa31e975e4b569a9617aed9c37982646578e71674b0d96896f60dc232a90\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"c8ee3691fdd0cb6a376274ca4ee98e52cb5718f985d4f539fb764ae6116296f6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0be4b31b8961f89b18ef02b2a56a0b76e7cb0d94a4440a467414ac2d9a504010\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"235df022eefeafa48d660af3720c4cb0c0fec34ddef36d3c467db88f9a57b07f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"69645d92530f5991fb0c1154aa418715dafc9eb9b4b827c33aa742687b00c4fc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"b449a8480f629d5de320a05efeec5a558221dbb03b4dac7572367202e5ec4e3a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"96d049688a520cd26e12f2232f544b815eac1611ab00713e2f641e57b40e5f84\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"bc1544ecfcc1a9c24b532fcd9001124011a4a99e354877a6f611310592c512dc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fbfa7264341556b62c34307c6c836c7e015aeca2df10913c89f8c2d9d38fd28d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"787567c7ebc18db7ec0598b9dbf1466caebf9a1d07f97cfb4afbc3f8bc3fd0e4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"03938d68f68953b697b7b9ec3a9bb3205251dab0d8c28c8488a51872990c74d6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"0d7a95a011dd25d93bb4476331e0b43d38df072b07b758073c5e89ae27e7c6e3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea4599ace477623ac871dedf5650245e6a589cd60cb7c50944431b6bd5453ebc\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"06aff6eabb02cda098099e156015c1b3f2389b929e7df774b34188d1589de73e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"463f896d9e9b5a3f2518e764053718a018fbe93828587f90cc4250e5a67a2236\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"88eb8224ce85abcb39e51aee14e03c01d32d86bc4f686e66279e969a1413d263\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d2e0eee1c8e9f13da0b4cd4af8a834f482ac80e1620cc44747922a7c61d6a51b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"203a868aa43281568c0e425caebe830e36d9bb16cabaf6e7dd92722711d4e496\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0dcf2663d1fa4c3fb5056f3703d9d1a316345e3f4ea0e2503f77738258a9e6a2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"c4e555c424bbb24fa529375505443d3163dbb2379b150d3ae00c6689e4123fae\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"29a6e78291fb6eb1600fcc523c35316897713ec3a1f3092074998de0701a2bff\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"220018b07e05f37b279946d5b903a8c5295a21774b20d317b40db4ae44ab089f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ea78fba3abdfbae2cfbad8389b4c97d45d924dfb8eebd29422ca7a2b62f9564f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"86fdf51aa1b29a978535560d7a45ad778e5802bfe467d27e1295c743248d1507\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"dcddce6770eda2db3f8f60d8b51b5ed927194e11c56d328f35000b6f5e92dbdf\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"df9a2fd989201e2d0ef8377583b501f9afac6836df894071bbae9e6b6b2598f4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b8e8a49e358e54b12e2aba59e563ba17bcf32315bebde13a721f3b7ebfae18ba\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"742ed2fd7d94f5d252aeaa965657e054bac8691ea31b81375ab8a5488c2f2888\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"327ad026e5a9c61ed15c52c9e2fb0c219e4d9a636a17ed736f525f2b42ebfd6d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"8b45807e9f971b175f77e49aa0f5e281c0245f33f6942f95c36aedfd7d419199\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"59093ab44195ceb3a72fd7400b422644d3d7c840cd3e838bafbbcf827cbcc073\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-0c9014\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-0c9014\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"bde801ad48bcba39a3cf88516077f8fad94dd2ce0692d0f274ab650cb9cc6614\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fbf5e5a312486cd624620a8628b976f89d3b75ffa1d3e47224c08e003294432f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-0c9014\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-0c9014\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"047906c5f7db776a9bd905e481a3347b0c84bd6edf626dc5626ed91115c7408a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cbaea0f78f7b655ed1c234a9fbf7020e12e29bee546d39c314b814aa1692620f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-0c9014\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-0c9014\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"1e414f5eaffdbc43cdaeda8552267e2b46abc1a6b41adfdb24735f3843a9c51f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"2ab986aa56245948b966f417e9db684ac2bae70862e05b68a996c57de4d7c4c9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-0c9014\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-0c9014\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"3f61be5c1cb2e788fb6ec123b23519795a5d4fa05fbf9eb842b61931843e1834\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"83f9aef31a325eccb5ee1ca5935289e892a53f7f9d05ac2a6d2b8a973624d6db\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-0c9014\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-0c9014\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"ead8e640f12ec2a2a5b9632dbacd377499d067469c52a5e5c7791f29393639d3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"93867ab0bab47561de7ff57c3a2f54a4e134cfb5a3ee35d78ee703589d669077\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"760f6f0b0f0dfc05ff96616a7ebd6878ae6a8e384823348a74bc46e7ee6e70ab\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/simulator-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"06c24ca69f585351676e3a47fdf7a96df9b9a8fe85641e1c3348c8cfdfe446cb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__d7fea12c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"7a367976f0232b68\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w0-0c9014/maas-trlp-premium-w0-0c9014\"]}],\"name\":\"2089b2caaee71efefb7e26192d15a3376881340fd07cbc304d192587b50b0c07\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/premium-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f713c09235fdc689702761ce6f8fb3c2c03ea75f66382e5121160a24cf7aee9d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"78522ace7509d509793c07978801f1f4bab7d64f1ad59df33af972c953cd6851\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-w0-0c9014')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6b6f55f762b51c1f46156308a7f509359377c543fd3789f104b3416ff46e3216\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w0-0c9014-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__d80dbebc\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w0-0c9014\"]}],\"name\":\"06aab5232bb89b6e09b9780286eb3fceeee4557f3ea4efd5ede8278ad6c21170\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w0-0c9014/models/e2e/distinct-2-w0-0c9014')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-worker-w0-0c9014"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-worker-w0-0c9014\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:31:46.381Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-02T21:22:27Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:24:07Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:24:08Z"}],"name":"0ad1aa31e975e4b569a9617aed9c37982646578e71674b0d96896f60dc232a90","namespace":"kuadrant-system","resourceVersion":"31003","uid":"41096978-2465-483a-b2dd-5b426c95094d"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["0ad1aa31e975e4b569a9617aed9c37982646578e71674b0d96896f60dc232a90"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w0-0c9014.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w0-0c9014.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:22:28Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:22:28Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["0ad1aa31e975e4b569a9617aed9c37982646578e71674b0d96896f60dc232a90"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"0ad1aa31e975e4b569a9617aed9c37982646578e71674b0d96896f60dc232a90\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:31:46.445Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-02T21:27:44Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:27:44Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:27:44Z"}],"name":"b0bfe3b1d3a080ff25e482046cf0d1df0ca30a090ef9f8424787467410af7627","namespace":"kuadrant-system","resourceVersion":"36197","uid":"62eb99c4-faf3-4192-8c38-d55a7b1b5937"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["b0bfe3b1d3a080ff25e482046cf0d1df0ca30a090ef9f8424787467410af7627"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w0-0c9014.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w0-0c9014.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:27:44Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:27:44Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["b0bfe3b1d3a080ff25e482046cf0d1df0ca30a090ef9f8424787467410af7627"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"b0bfe3b1d3a080ff25e482046cf0d1df0ca30a090ef9f8424787467410af7627\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:31:46.510Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-02T21:29:14Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:29:14Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:29:14Z"}],"name":"fe65e47ea66e64f823a934786806a737bfe3ca692bad4019774d91daeb2348d1","namespace":"kuadrant-system","resourceVersion":"38442","uid":"404ff589-0b14-41ac-984f-34be75f82cd9"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["fe65e47ea66e64f823a934786806a737bfe3ca692bad4019774d91daeb2348d1"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w0-0c9014.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w0-0c9014.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:29:14Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:29:14Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["fe65e47ea66e64f823a934786806a737bfe3ca692bad4019774d91daeb2348d1"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"fe65e47ea66e64f823a934786806a737bfe3ca692bad4019774d91daeb2348d1\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:31:46.571Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-02T21:23:33Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:24:06Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:24:07Z"}],"name":"d2e0eee1c8e9f13da0b4cd4af8a834f482ac80e1620cc44747922a7c61d6a51b","namespace":"kuadrant-system","resourceVersion":"30965","uid":"6d03c396-deba-46fe-871c-443011c2cf54"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d2e0eee1c8e9f13da0b4cd4af8a834f482ac80e1620cc44747922a7c61d6a51b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w0-0c9014.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w0-0c9014.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:23:33Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:23:33Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["d2e0eee1c8e9f13da0b4cd4af8a834f482ac80e1620cc44747922a7c61d6a51b"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"d2e0eee1c8e9f13da0b4cd4af8a834f482ac80e1620cc44747922a7c61d6a51b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:31:46.632Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-02T21:29:15Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:29:15Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:29:15Z"}],"name":"69645d92530f5991fb0c1154aa418715dafc9eb9b4b827c33aa742687b00c4fc","namespace":"kuadrant-system","resourceVersion":"38476","uid":"42dd7cae-be9e-4ebc-81e2-0e27dbb94f30"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["69645d92530f5991fb0c1154aa418715dafc9eb9b4b827c33aa742687b00c4fc"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w0-0c9014.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w0-0c9014.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:29:15Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:29:15Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["69645d92530f5991fb0c1154aa418715dafc9eb9b4b827c33aa742687b00c4fc"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"69645d92530f5991fb0c1154aa418715dafc9eb9b4b827c33aa742687b00c4fc\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:31:46.694Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-02T21:22:28Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:24:07Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:24:07Z"}],"name":"dcddce6770eda2db3f8f60d8b51b5ed927194e11c56d328f35000b6f5e92dbdf","namespace":"kuadrant-system","resourceVersion":"30975","uid":"82b65453-d432-427c-bc4a-401b8b2402f3"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["dcddce6770eda2db3f8f60d8b51b5ed927194e11c56d328f35000b6f5e92dbdf"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w0-0c9014.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w0-0c9014.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:22:28Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:22:28Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["dcddce6770eda2db3f8f60d8b51b5ed927194e11c56d328f35000b6f5e92dbdf"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"dcddce6770eda2db3f8f60d8b51b5ed927194e11c56d328f35000b6f5e92dbdf\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:31:46.754Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-02T21:23:34Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:24:05Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:24:06Z"}],"name":"b0476fc7cd4ea3306c893f375fa8b815ad5c84676dd8000109732b76fc6c9e7d","namespace":"kuadrant-system","resourceVersion":"30928","uid":"6f021429-5a35-4893-a3f6-344055be1634"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["b0476fc7cd4ea3306c893f375fa8b815ad5c84676dd8000109732b76fc6c9e7d"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w0-0c9014.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w0-0c9014.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:23:35Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:23:35Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["b0476fc7cd4ea3306c893f375fa8b815ad5c84676dd8000109732b76fc6c9e7d"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"b0476fc7cd4ea3306c893f375fa8b815ad5c84676dd8000109732b76fc6c9e7d\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:31:46.815Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-0c9014","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-0c9014#rule-4"},"creationTimestamp":"2026-11-02T21:21:39Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:24:06Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:24:07Z"}],"name":"2ab986aa56245948b966f417e9db684ac2bae70862e05b68a996c57de4d7c4c9","namespace":"kuadrant-system","resourceVersion":"30963","uid":"f10a0bb5-8ae9-4110-9033-f90a79498353"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["2ab986aa56245948b966f417e9db684ac2bae70862e05b68a996c57de4d7c4c9"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w0-0c9014.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w0-0c9014.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:21:39Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:21:39Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["2ab986aa56245948b966f417e9db684ac2bae70862e05b68a996c57de4d7c4c9"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"2ab986aa56245948b966f417e9db684ac2bae70862e05b68a996c57de4d7c4c9\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:31:46.878Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-02T21:27:44Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:27:44Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:27:44Z"}],"name":"e1cab00a309f6035001c6bed21b280b9cd6d81b83072c8f351fbe860f69886ad","namespace":"kuadrant-system","resourceVersion":"36216","uid":"71c8c077-8dfc-47ab-af31-ee1d9c807215"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["e1cab00a309f6035001c6bed21b280b9cd6d81b83072c8f351fbe860f69886ad"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w0-0c9014.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w0-0c9014.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:27:44Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:27:44Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["e1cab00a309f6035001c6bed21b280b9cd6d81b83072c8f351fbe860f69886ad"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"e1cab00a309f6035001c6bed21b280b9cd6d81b83072c8f351fbe860f69886ad\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:31:46.938Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-02T21:23:33Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:24:08Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:24:09Z"}],"name":"4cc208f8f31098b1cdf91b5776a85b52bae0339e659b20995e8ad11208703993","namespace":"kuadrant-system","resourceVersion":"31046","uid":"edc75be0-89d1-45cb-858c-56b74750dc17"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["4cc208f8f31098b1cdf91b5776a85b52bae0339e659b20995e8ad11208703993"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w0-0c9014.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w0-0c9014.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:24:09Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:24:09Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["4cc208f8f31098b1cdf91b5776a85b52bae0339e659b20995e8ad11208703993"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"4cc208f8f31098b1cdf91b5776a85b52bae0339e659b20995e8ad11208703993\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:31:47.001Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-02T21:27:44Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:27:44Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:27:44Z"}],"name":"6d14c0784badaddad1e95c3697462cedd1c5a5cf32d3a98f16155abc0721429e","namespace":"kuadrant-system","resourceVersion":"36211","uid":"ac60ccbd-fb18-4eda-8427-d3d8a15dd68c"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["6d14c0784badaddad1e95c3697462cedd1c5a5cf32d3a98f16155abc0721429e"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w0-0c9014.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w0-0c9014.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:27:44Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:27:44Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["6d14c0784badaddad1e95c3697462cedd1c5a5cf32d3a98f16155abc0721429e"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"6d14c0784badaddad1e95c3697462cedd1c5a5cf32d3a98f16155abc0721429e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:31:47.062Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-02T21:27:44Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:27:44Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:27:45Z"}],"name":"ece9796b491eeaad9788ab6c426bb54d8cbb85433a9010ef2c4d3f579cca0db0","namespace":"kuadrant-system","resourceVersion":"36236","uid":"c71b67b2-4354-4d81-8dc0-b4063dbd2b2d"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["ece9796b491eeaad9788ab6c426bb54d8cbb85433a9010ef2c4d3f579cca0db0"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w0-0c9014.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w0-0c9014.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:27:45Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:27:45Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["ece9796b491eeaad9788ab6c426bb54d8cbb85433a9010ef2c4d3f579cca0db0"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"ece9796b491eeaad9788ab6c426bb54d8cbb85433a9010ef2c4d3f579cca0db0\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:31:47.134Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-0c9014","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-0c9014#rule-6"},"creationTimestamp":"2026-11-02T21:21:38Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:24:06Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:24:06Z"}],"name":"00c4d48b9f06a2f5dbb9cbe22ae3dcc9e10401b038e62058849dcebe2769e4f1","namespace":"kuadrant-system","resourceVersion":"30946","uid":"07877e64-8ebc-4a34-be24-5c5b5844eb08"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["00c4d48b9f06a2f5dbb9cbe22ae3dcc9e10401b038e62058849dcebe2769e4f1"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w0-0c9014.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w0-0c9014.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:21:39Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:21:39Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["00c4d48b9f06a2f5dbb9cbe22ae3dcc9e10401b038e62058849dcebe2769e4f1"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"00c4d48b9f06a2f5dbb9cbe22ae3dcc9e10401b038e62058849dcebe2769e4f1\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:31:47.205Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-02T21:22:27Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:24:07Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:24:07Z"}],"name":"a24eea90cd520665ff61391c71ddaf8965158b1b42c4e6f9fe99dd03dfa7c401","namespace":"kuadrant-system","resourceVersion":"30973","uid":"151c942e-c044-4eac-8794-0ee424a0ba5f"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a24eea90cd520665ff61391c71ddaf8965158b1b42c4e6f9fe99dd03dfa7c401"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w0-0c9014.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w0-0c9014.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:22:27Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:22:27Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["a24eea90cd520665ff61391c71ddaf8965158b1b42c4e6f9fe99dd03dfa7c401"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a24eea90cd520665ff61391c71ddaf8965158b1b42c4e6f9fe99dd03dfa7c401\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:31:47.271Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-02T21:29:14Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:29:14Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:29:14Z"}],"name":"096fbc9d544918ac5b9d60464268ef3b1f03546e96ed130c743da74445576f52","namespace":"kuadrant-system","resourceVersion":"38435","uid":"7fee2104-d30c-4083-bbed-7465d1e84a00"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["096fbc9d544918ac5b9d60464268ef3b1f03546e96ed130c743da74445576f52"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w0-0c9014.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w0-0c9014.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:29:14Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:29:14Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["096fbc9d544918ac5b9d60464268ef3b1f03546e96ed130c743da74445576f52"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"096fbc9d544918ac5b9d60464268ef3b1f03546e96ed130c743da74445576f52\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:31:47.334Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-02T21:23:34Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:24:06Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:24:07Z"}],"name":"fbfa7264341556b62c34307c6c836c7e015aeca2df10913c89f8c2d9d38fd28d","namespace":"kuadrant-system","resourceVersion":"30968","uid":"6f13e95b-48fd-4f21-b240-1e4c47fc88d5"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["fbfa7264341556b62c34307c6c836c7e015aeca2df10913c89f8c2d9d38fd28d"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w0-0c9014.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w0-0c9014.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:23:34Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:23:34Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["fbfa7264341556b62c34307c6c836c7e015aeca2df10913c89f8c2d9d38fd28d"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"fbfa7264341556b62c34307c6c836c7e015aeca2df10913c89f8c2d9d38fd28d\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:31:47.398Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-02T21:27:45Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:27:45Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:27:45Z"}],"name":"ad6b1369f6065e5d01605f83113ef1c7c93ed4b3fa8d01ad81d870c4a418f675","namespace":"kuadrant-system","resourceVersion":"36244","uid":"10867d31-40ea-4a37-9f0f-e8edd730a556"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["ad6b1369f6065e5d01605f83113ef1c7c93ed4b3fa8d01ad81d870c4a418f675"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w0-0c9014.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w0-0c9014.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:27:45Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:27:45Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["ad6b1369f6065e5d01605f83113ef1c7c93ed4b3fa8d01ad81d870c4a418f675"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"ad6b1369f6065e5d01605f83113ef1c7c93ed4b3fa8d01ad81d870c4a418f675\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:31:47.461Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-02T21:22:27Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:24:06Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:24:06Z"}],"name":"96d049688a520cd26e12f2232f544b815eac1611ab00713e2f641e57b40e5f84","namespace":"kuadrant-system","resourceVersion":"30939","uid":"b0e751f1-44d5-4b4a-9cf2-124fd8b59296"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["96d049688a520cd26e12f2232f544b815eac1611ab00713e2f641e57b40e5f84"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w0-0c9014.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w0-0c9014.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:22:27Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:22:27Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["96d049688a520cd26e12f2232f544b815eac1611ab00713e2f641e57b40e5f84"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"96d049688a520cd26e12f2232f544b815eac1611ab00713e2f641e57b40e5f84\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:31:47.525Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-02T21:23:35Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:24:08Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:24:08Z"}],"name":"29a6e78291fb6eb1600fcc523c35316897713ec3a1f3092074998de0701a2bff","namespace":"kuadrant-system","resourceVersion":"31022","uid":"2fd19a91-25a9-4751-bb2a-b60bbac716bd"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["29a6e78291fb6eb1600fcc523c35316897713ec3a1f3092074998de0701a2bff"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w0-0c9014.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w0-0c9014.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:23:35Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:23:35Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["29a6e78291fb6eb1600fcc523c35316897713ec3a1f3092074998de0701a2bff"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"29a6e78291fb6eb1600fcc523c35316897713ec3a1f3092074998de0701a2bff\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:31:47.586Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-0c9014","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-0c9014#rule-3"},"creationTimestamp":"2026-11-02T21:21:39Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:24:08Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:24:08Z"}],"name":"cbaea0f78f7b655ed1c234a9fbf7020e12e29bee546d39c314b814aa1692620f","namespace":"kuadrant-system","resourceVersion":"31007","uid":"e69f5846-7642-44f2-b48e-cb17964eb05a"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["cbaea0f78f7b655ed1c234a9fbf7020e12e29bee546d39c314b814aa1692620f"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w0-0c9014.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w0-0c9014.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:21:39Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:21:39Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["cbaea0f78f7b655ed1c234a9fbf7020e12e29bee546d39c314b814aa1692620f"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"cbaea0f78f7b655ed1c234a9fbf7020e12e29bee546d39c314b814aa1692620f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:31:47.648Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-02T21:27:44Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:27:44Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:27:44Z"}],"name":"0be4b31b8961f89b18ef02b2a56a0b76e7cb0d94a4440a467414ac2d9a504010","namespace":"kuadrant-system","resourceVersion":"36200","uid":"81849e87-48e8-49f7-828d-8b5467641c73"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["0be4b31b8961f89b18ef02b2a56a0b76e7cb0d94a4440a467414ac2d9a504010"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w0-0c9014.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w0-0c9014.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:27:44Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:27:44Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["0be4b31b8961f89b18ef02b2a56a0b76e7cb0d94a4440a467414ac2d9a504010"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"0be4b31b8961f89b18ef02b2a56a0b76e7cb0d94a4440a467414ac2d9a504010\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:31:47.710Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-02T21:29:14Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:29:14Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:29:15Z"}],"name":"03938d68f68953b697b7b9ec3a9bb3205251dab0d8c28c8488a51872990c74d6","namespace":"kuadrant-system","resourceVersion":"38466","uid":"cc441f66-5a3a-4d28-85cb-3078972ac548"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["03938d68f68953b697b7b9ec3a9bb3205251dab0d8c28c8488a51872990c74d6"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w0-0c9014.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w0-0c9014.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:29:15Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:29:15Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["03938d68f68953b697b7b9ec3a9bb3205251dab0d8c28c8488a51872990c74d6"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"03938d68f68953b697b7b9ec3a9bb3205251dab0d8c28c8488a51872990c74d6\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:31:47.772Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-02T21:23:34Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:24:07Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:24:07Z"}],"name":"bdc9387e460a2dc1a85bc42d8ce6440788e8331159ace91b443c9628ef7c1fed","namespace":"kuadrant-system","resourceVersion":"30988","uid":"430493ae-635d-43b3-b197-1bc8fcf2d01c"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["bdc9387e460a2dc1a85bc42d8ce6440788e8331159ace91b443c9628ef7c1fed"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w0-0c9014.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w0-0c9014.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:23:34Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:23:34Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["bdc9387e460a2dc1a85bc42d8ce6440788e8331159ace91b443c9628ef7c1fed"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"bdc9387e460a2dc1a85bc42d8ce6440788e8331159ace91b443c9628ef7c1fed\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:31:47.834Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-02T21:22:28Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:24:07Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:24:07Z"}],"name":"228ec96802a09009d984b3728e4e96175fefb32ba2e3b918071e85b3f8ec79d0","namespace":"kuadrant-system","resourceVersion":"30990","uid":"8fd66630-e1d9-4f5e-adec-0bbe684df945"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["228ec96802a09009d984b3728e4e96175fefb32ba2e3b918071e85b3f8ec79d0"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w0-0c9014.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w0-0c9014.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:22:28Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:22:28Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["228ec96802a09009d984b3728e4e96175fefb32ba2e3b918071e85b3f8ec79d0"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"228ec96802a09009d984b3728e4e96175fefb32ba2e3b918071e85b3f8ec79d0\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:31:47.896Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-02T21:22:28Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:24:05Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:24:06Z"}],"name":"9a7eea6dc0fbfacc7f1b1980a90d1b04de88692dd5758d6a6457477b77a64673","namespace":"kuadrant-system","resourceVersion":"30930","uid":"feee1837-ded6-4c6d-8dae-315a49084335"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["9a7eea6dc0fbfacc7f1b1980a90d1b04de88692dd5758d6a6457477b77a64673"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w0-0c9014.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w0-0c9014.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:24:06Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:24:06Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["9a7eea6dc0fbfacc7f1b1980a90d1b04de88692dd5758d6a6457477b77a64673"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"9a7eea6dc0fbfacc7f1b1980a90d1b04de88692dd5758d6a6457477b77a64673\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:31:47.958Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-02T21:22:28Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:24:06Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:24:06Z"}],"name":"ea4599ace477623ac871dedf5650245e6a589cd60cb7c50944431b6bd5453ebc","namespace":"kuadrant-system","resourceVersion":"30949","uid":"f5faffff-4b96-4fa7-8873-0e583efbc388"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["ea4599ace477623ac871dedf5650245e6a589cd60cb7c50944431b6bd5453ebc"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w0-0c9014.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w0-0c9014.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:22:28Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:22:28Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["ea4599ace477623ac871dedf5650245e6a589cd60cb7c50944431b6bd5453ebc"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"ea4599ace477623ac871dedf5650245e6a589cd60cb7c50944431b6bd5453ebc\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:31:48.019Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-02T21:29:14Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:29:14Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:29:14Z"}],"name":"4dcc64ddad4ef375730fe33c8b8925944bf0c1750f66d8a3347219a51dd190d3","namespace":"kuadrant-system","resourceVersion":"38446","uid":"ab3162a1-b40b-442e-9813-c9ca938e6d86"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["4dcc64ddad4ef375730fe33c8b8925944bf0c1750f66d8a3347219a51dd190d3"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w0-0c9014.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w0-0c9014.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:29:14Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:29:14Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["4dcc64ddad4ef375730fe33c8b8925944bf0c1750f66d8a3347219a51dd190d3"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"4dcc64ddad4ef375730fe33c8b8925944bf0c1750f66d8a3347219a51dd190d3\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:31:48.080Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-02T21:23:33Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:24:06Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:24:06Z"}],"name":"0e0bbf1b6879cb3f68f7ea7f2afda47c74a88c5d3cb97fdf3e110cdc54718649","namespace":"kuadrant-system","resourceVersion":"30953","uid":"582d4379-bf3b-4598-a06d-0f76d7fdfc54"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["0e0bbf1b6879cb3f68f7ea7f2afda47c74a88c5d3cb97fdf3e110cdc54718649"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w0-0c9014.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w0-0c9014.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:23:33Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:23:33Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["0e0bbf1b6879cb3f68f7ea7f2afda47c74a88c5d3cb97fdf3e110cdc54718649"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"0e0bbf1b6879cb3f68f7ea7f2afda47c74a88c5d3cb97fdf3e110cdc54718649\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:31:48.142Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-02T21:29:14Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:29:14Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:29:14Z"}],"name":"be088898c71049f4ea232cae6dd479dfab1a9947fba6b17e7353ce14e639507c","namespace":"kuadrant-system","resourceVersion":"38439","uid":"6f4804dd-63f9-4441-9f04-24613de4c7e5"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["be088898c71049f4ea232cae6dd479dfab1a9947fba6b17e7353ce14e639507c"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w0-0c9014.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w0-0c9014.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:29:14Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:29:14Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["be088898c71049f4ea232cae6dd479dfab1a9947fba6b17e7353ce14e639507c"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"be088898c71049f4ea232cae6dd479dfab1a9947fba6b17e7353ce14e639507c\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:31:48.203Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-02T21:23:35Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:24:07Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:24:07Z"}],"name":"4b932ff2b149c42a260b63c5bdd2b0515a398d1964de7381e0735756ee620b8e","namespace":"kuadrant-system","resourceVersion":"30994","uid":"d20efdda-d31c-4d4c-914d-97cd6b9488f3"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["4b932ff2b149c42a260b63c5bdd2b0515a398d1964de7381e0735756ee620b8e"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w0-0c9014.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w0-0c9014.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:23:35Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:23:35Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["4b932ff2b149c42a260b63c5bdd2b0515a398d1964de7381e0735756ee620b8e"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"4b932ff2b149c42a260b63c5bdd2b0515a398d1964de7381e0735756ee620b8e\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:31:48.267Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-02T21:23:34Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:24:07Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:24:07Z"}],"name":"327ad026e5a9c61ed15c52c9e2fb0c219e4d9a636a17ed736f525f2b42ebfd6d","namespace":"kuadrant-system","resourceVersion":"30977","uid":"344285d1-a828-4f8a-b282-3c0d664b7947"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["327ad026e5a9c61ed15c52c9e2fb0c219e4d9a636a17ed736f525f2b42ebfd6d"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w0-0c9014.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w0-0c9014.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:23:34Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:23:34Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["327ad026e5a9c61ed15c52c9e2fb0c219e4d9a636a17ed736f525f2b42ebfd6d"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"327ad026e5a9c61ed15c52c9e2fb0c219e4d9a636a17ed736f525f2b42ebfd6d\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:31:48.329Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-02T21:29:15Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:29:15Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:29:16Z"}],"name":"a8ba5320fff14c281f32c2b0a9e757f0e205aace00c294b0d13fa46185724d35","namespace":"kuadrant-system","resourceVersion":"38511","uid":"a75bebe0-14f6-4bd2-a6b0-27b0ac68e4ad"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["a8ba5320fff14c281f32c2b0a9e757f0e205aace00c294b0d13fa46185724d35"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w0-0c9014.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w0-0c9014.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:29:16Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:29:16Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["a8ba5320fff14c281f32c2b0a9e757f0e205aace00c294b0d13fa46185724d35"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a8ba5320fff14c281f32c2b0a9e757f0e205aace00c294b0d13fa46185724d35\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:31:48.392Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-02T21:29:15Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:29:15Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:29:15Z"}],"name":"3d645f3ac772a0cc5a9a71b4e6a542a2b2ab9962190903cb5d89d3e8e45b7f9d","namespace":"kuadrant-system","resourceVersion":"38472","uid":"8be67dac-1b5b-45d3-b57a-55c4d10daed6"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["3d645f3ac772a0cc5a9a71b4e6a542a2b2ab9962190903cb5d89d3e8e45b7f9d"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w0-0c9014.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w0-0c9014.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:29:15Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:29:15Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["3d645f3ac772a0cc5a9a71b4e6a542a2b2ab9962190903cb5d89d3e8e45b7f9d"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"3d645f3ac772a0cc5a9a71b4e6a542a2b2ab9962190903cb5d89d3e8e45b7f9d\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:31:48.454Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-02T21:23:34Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:24:07Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:24:08Z"}],"name":"669fd13dfb6f84f6e255bbee071a63253e1d5bd80a372cb6a445299b3c53a1a6","namespace":"kuadrant-system","resourceVersion":"31005","uid":"f5777609-5e97-4c16-963c-9d1e99003496"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["669fd13dfb6f84f6e255bbee071a63253e1d5bd80a372cb6a445299b3c53a1a6"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w0-0c9014.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w0-0c9014.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:23:34Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:23:34Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["669fd13dfb6f84f6e255bbee071a63253e1d5bd80a372cb6a445299b3c53a1a6"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"669fd13dfb6f84f6e255bbee071a63253e1d5bd80a372cb6a445299b3c53a1a6\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:31:48.515Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-02T21:29:14Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:29:14Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:29:14Z"}],"name":"5f8a52baf63f9e4c9ea31b6e22c9076262e33bc06968bbcb213439af05ae3a21","namespace":"kuadrant-system","resourceVersion":"38448","uid":"dbe8bd9e-4fa1-4693-bb5c-2b8f0cd6b8be"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["5f8a52baf63f9e4c9ea31b6e22c9076262e33bc06968bbcb213439af05ae3a21"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w0-0c9014.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w0-0c9014.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:29:14Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:29:14Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["5f8a52baf63f9e4c9ea31b6e22c9076262e33bc06968bbcb213439af05ae3a21"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"5f8a52baf63f9e4c9ea31b6e22c9076262e33bc06968bbcb213439af05ae3a21\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:31:48.577Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-02T21:22:28Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:24:08Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:24:08Z"}],"name":"86115b8156c50eab2036378ac37ec53b33537f0eef44a4aa5d81752c24254c82","namespace":"kuadrant-system","resourceVersion":"31024","uid":"4be38a1a-78ad-443b-b5fd-e28ea0ce572c"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["86115b8156c50eab2036378ac37ec53b33537f0eef44a4aa5d81752c24254c82"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w0-0c9014.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w0-0c9014.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:24:08Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:24:08Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["86115b8156c50eab2036378ac37ec53b33537f0eef44a4aa5d81752c24254c82"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"86115b8156c50eab2036378ac37ec53b33537f0eef44a4aa5d81752c24254c82\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:31:48.640Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-02T21:27:44Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:27:44Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:27:44Z"}],"name":"fe169ab2014a705a54df2fda4ec719f7132fd6bba54202f7531ce8df8da2bdf6","namespace":"kuadrant-system","resourceVersion":"36214","uid":"16c2fb37-4f83-4fc3-a05b-40f040b716d7"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["fe169ab2014a705a54df2fda4ec719f7132fd6bba54202f7531ce8df8da2bdf6"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w0-0c9014.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w0-0c9014.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:27:44Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:27:44Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["fe169ab2014a705a54df2fda4ec719f7132fd6bba54202f7531ce8df8da2bdf6"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"fe169ab2014a705a54df2fda4ec719f7132fd6bba54202f7531ce8df8da2bdf6\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:31:48.702Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-02T21:27:44Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:27:44Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:27:45Z"}],"name":"1cd65b24c576b1e8f7a954fffca2225dfb109bf5a068107003d4f72206723e55","namespace":"kuadrant-system","resourceVersion":"36239","uid":"e01e967d-d694-4e67-beb7-6dd1c186b486"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["1cd65b24c576b1e8f7a954fffca2225dfb109bf5a068107003d4f72206723e55"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w0-0c9014.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w0-0c9014.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:27:45Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:27:45Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["1cd65b24c576b1e8f7a954fffca2225dfb109bf5a068107003d4f72206723e55"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"1cd65b24c576b1e8f7a954fffca2225dfb109bf5a068107003d4f72206723e55\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:31:48.764Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-02T21:22:28Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:24:08Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:24:08Z"}],"name":"bcf1ddf402fe28df1f45e616a2e2380b51177c45a7f8dcdd03bc2aa6b5814d26","namespace":"kuadrant-system","resourceVersion":"31012","uid":"1079f46f-9b61-4b47-9497-b526ab3787bd"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["bcf1ddf402fe28df1f45e616a2e2380b51177c45a7f8dcdd03bc2aa6b5814d26"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w0-0c9014.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w0-0c9014.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:22:28Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:22:28Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["bcf1ddf402fe28df1f45e616a2e2380b51177c45a7f8dcdd03bc2aa6b5814d26"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"bcf1ddf402fe28df1f45e616a2e2380b51177c45a7f8dcdd03bc2aa6b5814d26\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:31:48.825Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-0c9014","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-0c9014#rule-1"},"creationTimestamp":"2026-11-02T21:21:39Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:24:07Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:24:07Z"}],"name":"83f9aef31a325eccb5ee1ca5935289e892a53f7f9d05ac2a6d2b8a973624d6db","namespace":"kuadrant-system","resourceVersion":"30981","uid":"62ef17fe-7301-424c-bfc0-20e53ca644d0"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["83f9aef31a325eccb5ee1ca5935289e892a53f7f9d05ac2a6d2b8a973624d6db"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w0-0c9014.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w0-0c9014.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:21:40Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:21:40Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["83f9aef31a325eccb5ee1ca5935289e892a53f7f9d05ac2a6d2b8a973624d6db"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"83f9aef31a325eccb5ee1ca5935289e892a53f7f9d05ac2a6d2b8a973624d6db\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:31:48.887Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-02T21:27:44Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:27:44Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:27:44Z"}],"name":"0dcf2663d1fa4c3fb5056f3703d9d1a316345e3f4ea0e2503f77738258a9e6a2","namespace":"kuadrant-system","resourceVersion":"36203","uid":"3c63b88c-f20c-45a6-b290-76500901f9c5"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["0dcf2663d1fa4c3fb5056f3703d9d1a316345e3f4ea0e2503f77738258a9e6a2"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w0-0c9014.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w0-0c9014.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:27:44Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:27:44Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["0dcf2663d1fa4c3fb5056f3703d9d1a316345e3f4ea0e2503f77738258a9e6a2"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"0dcf2663d1fa4c3fb5056f3703d9d1a316345e3f4ea0e2503f77738258a9e6a2\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:31:48.949Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-02T21:22:28Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:24:08Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:24:08Z"}],"name":"7da280ddad70ebcc1b84b8a595244d0682cd0302755439371683331c4562cfe5","namespace":"kuadrant-system","resourceVersion":"31019","uid":"5d391cda-1213-4fe8-97ce-9d7660fe8196"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["7da280ddad70ebcc1b84b8a595244d0682cd0302755439371683331c4562cfe5"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w0-0c9014.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w0-0c9014.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:24:08Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:24:08Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["7da280ddad70ebcc1b84b8a595244d0682cd0302755439371683331c4562cfe5"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"7da280ddad70ebcc1b84b8a595244d0682cd0302755439371683331c4562cfe5\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:31:49.010Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-02T21:22:27Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:24:05Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:24:06Z"}],"name":"03e9bc99c98697160f9a6db2252bc0ba9e88e4ed113a3d5d851256f6cee3dcab","namespace":"kuadrant-system","resourceVersion":"30936","uid":"b26282a2-b362-4c25-9cf4-ebc1032f7edd"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["03e9bc99c98697160f9a6db2252bc0ba9e88e4ed113a3d5d851256f6cee3dcab"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w0-0c9014.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w0-0c9014.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:24:06Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:24:06Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["03e9bc99c98697160f9a6db2252bc0ba9e88e4ed113a3d5d851256f6cee3dcab"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"03e9bc99c98697160f9a6db2252bc0ba9e88e4ed113a3d5d851256f6cee3dcab\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:31:49.073Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w0-0c9014/simulator-w0-0c9014-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-02T21:22:27Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:24:07Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:24:07Z"}],"name":"93867ab0bab47561de7ff57c3a2f54a4e134cfb5a3ee35d78ee703589d669077","namespace":"kuadrant-system","resourceVersion":"30979","uid":"1bd2dff1-a103-4fd7-8975-db395df762d5"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["93867ab0bab47561de7ff57c3a2f54a4e134cfb5a3ee35d78ee703589d669077"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w0-0c9014.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w0-0c9014.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:22:27Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:22:27Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["93867ab0bab47561de7ff57c3a2f54a4e134cfb5a3ee35d78ee703589d669077"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"93867ab0bab47561de7ff57c3a2f54a4e134cfb5a3ee35d78ee703589d669077\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:31:49.135Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-0c9014","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-worker-w0-0c9014#rule-5"},"creationTimestamp":"2026-11-02T21:21:39Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:24:06Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:24:06Z"}],"name":"fbf5e5a312486cd624620a8628b976f89d3b75ffa1d3e47224c08e003294432f","namespace":"kuadrant-system","resourceVersion":"30958","uid":"81769390-e7fb-4448-b923-575f7bc269d4"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["fbf5e5a312486cd624620a8628b976f89d3b75ffa1d3e47224c08e003294432f"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w0-0c9014.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w0-0c9014.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:21:39Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:21:39Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["fbf5e5a312486cd624620a8628b976f89d3b75ffa1d3e47224c08e003294432f"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"fbf5e5a312486cd624620a8628b976f89d3b75ffa1d3e47224c08e003294432f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:31:49.196Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w0-0c9014/distinct-w0-0c9014-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-02T21:27:44Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:27:44Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:27:45Z"}],"name":"f713c09235fdc689702761ce6f8fb3c2c03ea75f66382e5121160a24cf7aee9d","namespace":"kuadrant-system","resourceVersion":"36246","uid":"c74d63ea-45fd-4a2d-8239-53ed7a20307e"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f713c09235fdc689702761ce6f8fb3c2c03ea75f66382e5121160a24cf7aee9d"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w0-0c9014.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w0-0c9014.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:27:45Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:27:45Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["f713c09235fdc689702761ce6f8fb3c2c03ea75f66382e5121160a24cf7aee9d"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"f713c09235fdc689702761ce6f8fb3c2c03ea75f66382e5121160a24cf7aee9d\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:31:49.257Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w0-0c9014/premium-w0-0c9014-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-02T21:23:33Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:24:07Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:24:07Z"}],"name":"8cb0b0d9cbe25e4182aea7d2ed6f3ca636a7d0c9be364f722b182dde26da45e1","namespace":"kuadrant-system","resourceVersion":"30992","uid":"974a4a57-3768-4a59-ba78-3e87ba4f862b"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["8cb0b0d9cbe25e4182aea7d2ed6f3ca636a7d0c9be364f722b182dde26da45e1"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w0-0c9014.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w0-0c9014.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:23:33Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:23:33Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["8cb0b0d9cbe25e4182aea7d2ed6f3ca636a7d0c9be364f722b182dde26da45e1"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"8cb0b0d9cbe25e4182aea7d2ed6f3ca636a7d0c9be364f722b182dde26da45e1\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:31:49.319Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:e2e-models-e2e-worker-w0-0c9014/distinct-2-w0-0c9014-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-02T21:29:15Z","generation":1,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T21:29:15Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:29:15Z"}],"name":"ea78fba3abdfbae2cfbad8389b4c97d45d924dfb8eebd29422ca7a2b62f9564f","namespace":"kuadrant-system","resourceVersion":"38458","uid":"5405c068-4624-4967-a303-07c5bcba2e90"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["ea78fba3abdfbae2cfbad8389b4c97d45d924dfb8eebd29422ca7a2b62f9564f"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w0-0c9014.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-worker-w0-0c9014.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:29:15Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:29:15Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["ea78fba3abdfbae2cfbad8389b4c97d45d924dfb8eebd29422ca7a2b62f9564f"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"ea78fba3abdfbae2cfbad8389b4c97d45d924dfb8eebd29422ca7a2b62f9564f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:31:49.449Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-worker-w0-0c9014-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-worker-w0-0c9014-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:31:49.722Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-b-w3-a1d751-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-b-w3-a1d751-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:31:49.811Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"simulator-w0-0c9014-kserve-route","namespace":"e2e-models-e2e-worker-w0-0c9014","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"simulator-w0-0c9014-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:31:55.133Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","TokenRateLimitPolicy","AuthPolicy","HTTPRoute","EnvoyFilter","Limitador","ConfigMap"],"eventTypes":{"delete":1,"update":66}}
{"level":"info","ts":"2026-11-02T22:31:55.257Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T22:31:55.656Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T22:31:55.752Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:31:55.752Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T22:31:56Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-worker-w0-0c9014","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-worker-w0-0c9014","reconcileID":"b8c91fd2-6415-4f6f-82e4-4e67e98411b2","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-worker-w0-0c9014","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T22:31:56Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-worker-w0-0c9014","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T22:31:56Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T22:31:56Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-11-02T22:31:56Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T22:31:56.859Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:31:56.859Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:31:56.863Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T22:31:56.868Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:31:56.868Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T22:31:56.882Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-11-02T22:31:56.919Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:31:56.919Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T22:31:56Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-11-02T22:31:56Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-worker-w0-0c9014","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-worker-w0-0c9014","reconcileID":"b8c91fd2-6415-4f6f-82e4-4e67e98411b2","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-worker-w0-0c9014","namespace":"openshift-ingress"}
{"level":"error","ts":"2026-11-02T22:31:57Z","logger":"telemetry-policy-extension-controller","msg":"Reconciler error","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-worker-w0-0c9014","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-worker-w0-0c9014","reconcileID":"3d926b68-1e8b-4100-9ff1-d08c22f9dd48","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-worker-w0-0c9014\" not found","stacktrace":"sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:353\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-02T22:31:57Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-worker-w0-0c9014","event":"DELETE"}
{"level":"info","ts":"2026-11-02T22:31:57Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-02T22:31:57Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-worker-w0-0c9014\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-02T22:31:57Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"error","ts":"2026-11-02T22:31:58.137Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-worker-w0-0c9014","namespace":"openshift-ingress","uid":"571b24bc-6370-4aa0-925c-f6e54337fc45","error":"tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-worker-w0-0c9014\" not found"}
{"level":"info","ts":"2026-11-02T22:31:58.255Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T22:31:58.255Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T22:31:58.449Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-worker-w0-0c9014","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-worker-w0-0c9014\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:32:06.163Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["EnvoyFilter","ConfigMap","HTTPRoute","AuthPolicy","Gateway","Limitador","Kuadrant","TokenRateLimitPolicy"],"eventTypes":{"delete":2,"update":7}}
{"level":"info","ts":"2026-11-02T22:32:06.449Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:32:06.469Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T22:32:07.037Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T22:32:07.140Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T22:32:07.236Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:32:07.236Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T22:32:07.341Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:32:07.859Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:32:07.865Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:32:07.868Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T22:32:07.923Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:32:07.924Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:32:07.924Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T22:32:07.931Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T22:32:08.857Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to delete envoyfilter object","gateway":"openshift-ingress/e2e-worker-w0-0c9014","envoyfilter":"openshift-ingress/kuadrant-e2e-worker-w0-0c9014","error":"envoyfilters.networking.istio.io \"kuadrant-e2e-worker-w0-0c9014\" not found"}
{"level":"error","ts":"2026-11-02T22:32:11.449Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-worker-w0-0c9014-maas-auth","namespace":"openshift-ingress","error":"authpolicies.kuadrant.io \"e2e-worker-w0-0c9014-maas-auth\" not found"}
{"level":"info","ts":"2026-11-02T22:32:11.985Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T22:32:11.985Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T22:32:12.305Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-worker-w0-0c9014","error":"gateways.gateway.networking.k8s.io \"e2e-worker-w0-0c9014\" not found"}
{"level":"info","ts":"2026-11-02T22:32:12.563Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","Gateway","HTTPRoute"],"eventTypes":{"create":2,"delete":4,"update":1}}
{"level":"info","ts":"2026-11-02T22:32:13.842Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:32:13.844Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:32:13.844Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T22:32:13.860Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:32:13.860Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:32:13.863Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"error","ts":"2026-11-02T22:32:13.923Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to delete envoyfilter object","envoyfilter":"openshift-ingress/kuadrant-ratelimiting-e2e-worker-w0-0c9014","error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-worker-w0-0c9014\" not found"}
{"level":"error","ts":"2026-11-02T22:32:13.923Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to delete envoyfilter object","envoyfilter":"openshift-ingress/kuadrant-auth-e2e-worker-w0-0c9014","error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-worker-w0-0c9014\" not found"}
{"level":"error","ts":"2026-11-02T22:32:13.923Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:32:13.923Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T22:32:13.923Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/03e9bc99c98697160f9a6db2252bc0ba9e88e4ed113a3d5d851256f6cee3dcab","error":"authconfigs.authorino.kuadrant.io \"03e9bc99c98697160f9a6db2252bc0ba9e88e4ed113a3d5d851256f6cee3dcab\" not found"}
{"level":"error","ts":"2026-11-02T22:32:13.978Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/b0476fc7cd4ea3306c893f375fa8b815ad5c84676dd8000109732b76fc6c9e7d","error":"authconfigs.authorino.kuadrant.io \"b0476fc7cd4ea3306c893f375fa8b815ad5c84676dd8000109732b76fc6c9e7d\" not found"}
{"level":"error","ts":"2026-11-02T22:32:14.036Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/9a7eea6dc0fbfacc7f1b1980a90d1b04de88692dd5758d6a6457477b77a64673","error":"authconfigs.authorino.kuadrant.io \"9a7eea6dc0fbfacc7f1b1980a90d1b04de88692dd5758d6a6457477b77a64673\" not found"}
{"level":"error","ts":"2026-11-02T22:32:14.091Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/6d14c0784badaddad1e95c3697462cedd1c5a5cf32d3a98f16155abc0721429e","error":"authconfigs.authorino.kuadrant.io \"6d14c0784badaddad1e95c3697462cedd1c5a5cf32d3a98f16155abc0721429e\" not found"}
{"level":"error","ts":"2026-11-02T22:32:14.146Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/83f9aef31a325eccb5ee1ca5935289e892a53f7f9d05ac2a6d2b8a973624d6db","error":"authconfigs.authorino.kuadrant.io \"83f9aef31a325eccb5ee1ca5935289e892a53f7f9d05ac2a6d2b8a973624d6db\" not found"}
{"level":"error","ts":"2026-11-02T22:32:14.299Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/0be4b31b8961f89b18ef02b2a56a0b76e7cb0d94a4440a467414ac2d9a504010","error":"authconfigs.authorino.kuadrant.io \"0be4b31b8961f89b18ef02b2a56a0b76e7cb0d94a4440a467414ac2d9a504010\" not found"}
{"level":"error","ts":"2026-11-02T22:32:14.303Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-shared-b-w3-a1d751","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T21:56:05Z","generation":5,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"b4f450f8-3314-4538-8376-5bc4682213ba\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:29:46Z"}],"name":"kuadrant-e2e-shared-b-w3-a1d751","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-b-w3-a1d751","uid":"b4f450f8-3314-4538-8376-5bc4682213ba"}],"resourceVersion":"133928","uid":"f193cccb-926b-43ad-b8dd-0f35a235191b"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fd6cf0f18f21a2b21b869fb35862696f9d65f6371aaab90e03f0600806862db9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_500_per_1m__3c5ebddf\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"9f3f1bc278673cf2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-a1d751/maas-trlp-sub-test-model-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_500_per_1m__3c5ebddf\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"9f3f1bc278673cf2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-a1d751/maas-trlp-sub-test-model-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__6dd28790\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"fdfe5ac0855997fa\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-a1d751/maas-trlp-sub-test-model-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__6dd28790\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"fdfe5ac0855997fa\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-a1d751/maas-trlp-sub-test-model-a1d751\"]}],\"name\":\"b4f5dc508462935c59141642eb690c679074d18c598722aa3348703ebb49251c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w3-a1d751/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fd6cf0f18f21a2b21b869fb35862696f9d65f6371aaab90e03f0600806862db9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_500_per_1m__3c5ebddf\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"9f3f1bc278673cf2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-a1d751/maas-trlp-sub-test-model-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_500_per_1m__3c5ebddf\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"9f3f1bc278673cf2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-a1d751/maas-trlp-sub-test-model-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__6dd28790\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"fdfe5ac0855997fa\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-a1d751/maas-trlp-sub-test-model-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__6dd28790\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"fdfe5ac0855997fa\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-a1d751/maas-trlp-sub-test-model-a1d751\"]}],\"name\":\"ea40f06b359e26e9f95fc2c8e156fb14aec66b3738478bbb9e9e9110be4baf61\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w3-a1d751/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fd6cf0f18f21a2b21b869fb35862696f9d65f6371aaab90e03f0600806862db9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_500_per_1m__3c5ebddf\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"9f3f1bc278673cf2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-a1d751/maas-trlp-sub-test-model-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_500_per_1m__3c5ebddf\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"9f3f1bc278673cf2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-a1d751/maas-trlp-sub-test-model-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__6dd28790\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"fdfe5ac0855997fa\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-a1d751/maas-trlp-sub-test-model-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__6dd28790\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"fdfe5ac0855997fa\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-a1d751/maas-trlp-sub-test-model-a1d751\"]}],\"name\":\"af1a36d8b543a16bd969a4908547157c03ad6f16a3e06fa7ba81f634b8ac2571\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w3-a1d751/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fd6cf0f18f21a2b21b869fb35862696f9d65f6371aaab90e03f0600806862db9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_500_per_1m__3c5ebddf\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"9f3f1bc278673cf2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-a1d751/maas-trlp-sub-test-model-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_500_per_1m__3c5ebddf\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"9f3f1bc278673cf2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-a1d751/maas-trlp-sub-test-model-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__6dd28790\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"fdfe5ac0855997fa\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-a1d751/maas-trlp-sub-test-model-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__6dd28790\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"fdfe5ac0855997fa\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-a1d751/maas-trlp-sub-test-model-a1d751\"]}],\"name\":\"b00bb8d8f42b0a1f4760bf5a6416af2cef0f8f8103c38765d8a912de36d2ba3e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w3-a1d751/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fd6cf0f18f21a2b21b869fb35862696f9d65f6371aaab90e03f0600806862db9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_500_per_1m__3c5ebddf\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"9f3f1bc278673cf2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-a1d751/maas-trlp-sub-test-model-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_500_per_1m__3c5ebddf\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"9f3f1bc278673cf2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-a1d751/maas-trlp-sub-test-model-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__6dd28790\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"fdfe5ac0855997fa\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-a1d751/maas-trlp-sub-test-model-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__6dd28790\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"fdfe5ac0855997fa\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-a1d751/maas-trlp-sub-test-model-a1d751\"]}],\"name\":\"bcb4ee38c297fd81d1ba36ca91c6f43533ae03bcf32de74dee7773bb5b2cb53b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w3-a1d751/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fd6cf0f18f21a2b21b869fb35862696f9d65f6371aaab90e03f0600806862db9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_500_per_1m__3c5ebddf\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"9f3f1bc278673cf2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-a1d751/maas-trlp-sub-test-model-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_500_per_1m__3c5ebddf\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"9f3f1bc278673cf2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-a1d751/maas-trlp-sub-test-model-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__6dd28790\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"fdfe5ac0855997fa\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-a1d751/maas-trlp-sub-test-model-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__6dd28790\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"fdfe5ac0855997fa\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-a1d751/maas-trlp-sub-test-model-a1d751\"]}],\"name\":\"99d79bd58a3e5e09b5c11b892fea548b7b9173be1aa16ee4751b8ebe6ee5e1f6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w3-a1d751/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fd6cf0f18f21a2b21b869fb35862696f9d65f6371aaab90e03f0600806862db9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_500_per_1m__3c5ebddf\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"9f3f1bc278673cf2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-a1d751/maas-trlp-sub-test-model-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_500_per_1m__3c5ebddf\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"9f3f1bc278673cf2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-a1d751/maas-trlp-sub-test-model-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__6dd28790\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"fdfe5ac0855997fa\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-a1d751/maas-trlp-sub-test-model-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__6dd28790\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"fdfe5ac0855997fa\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-a1d751/maas-trlp-sub-test-model-a1d751\"]}],\"name\":\"5379ce2935360da6445a4624ebb0fffb1d4681ffb42315b2e61e5399dfb808fb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w3-a1d751/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fd6cf0f18f21a2b21b869fb35862696f9d65f6371aaab90e03f0600806862db9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_500_per_1m__3c5ebddf\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"9f3f1bc278673cf2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-a1d751/maas-trlp-sub-test-model-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_500_per_1m__3c5ebddf\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"9f3f1bc278673cf2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-a1d751/maas-trlp-sub-test-model-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__6dd28790\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"fdfe5ac0855997fa\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-a1d751/maas-trlp-sub-test-model-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__6dd28790\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"fdfe5ac0855997fa\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-a1d751/maas-trlp-sub-test-model-a1d751\"]}],\"name\":\"24a78e9d4e679465e27f213ebfa01f64bc96922ad78fdc53cff071ac5b6a81dc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w3-a1d751/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e5c3e46343f841520ecdb272dac135e882471a34b6fbd1dfe102bb1535df2522\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-a1d751\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-a1d751\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]}],\"name\":\"4309e9a901e490b5923f5e9c24699d2e857cbb6dc20e790330c076d768763498\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b12682b1a488a7777939851e73abef802241193375e49cf718828297da8cb2c2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_500_per_1m__3c5ebddf\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"9f3f1bc278673cf2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-a1d751/maas-trlp-sub-test-model-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_500_per_1m__3c5ebddf\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"9f3f1bc278673cf2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-a1d751/maas-trlp-sub-test-model-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__6dd28790\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"fdfe5ac0855997fa\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-a1d751/maas-trlp-sub-test-model-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__6dd28790\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"fdfe5ac0855997fa\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-a1d751/maas-trlp-sub-test-model-a1d751\"]}],\"name\":\"1640fd99e1d2b5698216be3f60d3664af2cabf1f24f0bb1fa79f6e2fe9f23ef6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w3-a1d751/models/facebook/opt-125m/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8023c7d6d2d950131dbdfdd9ebb5c95e52dfae5d4dfaf93b8b4ae57eb45d2bcf\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_500_per_1m__3c5ebddf\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"9f3f1bc278673cf2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-a1d751/maas-trlp-sub-test-model-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_500_per_1m__3c5ebddf\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"9f3f1bc278673cf2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-a1d751/maas-trlp-sub-test-model-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__6dd28790\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"fdfe5ac0855997fa\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-a1d751/maas-trlp-sub-test-model-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__6dd28790\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"fdfe5ac0855997fa\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-a1d751/maas-trlp-sub-test-model-a1d751\"]}],\"name\":\"b054987892c955e1d106dccbc458226a6328c226c09a2075550d9a35d2d6e3a4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w3-a1d751/models/facebook/opt-125m/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"37b98d0f2b528bd5adf68cd626d0bcbb32ae39493dca90dfc95c91c903cb7a9b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_500_per_1m__3c5ebddf\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"9f3f1bc278673cf2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-a1d751/maas-trlp-sub-test-model-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_500_per_1m__3c5ebddf\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"9f3f1bc278673cf2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-a1d751/maas-trlp-sub-test-model-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__6dd28790\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"fdfe5ac0855997fa\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-a1d751/maas-trlp-sub-test-model-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__6dd28790\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"fdfe5ac0855997fa\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-a1d751/maas-trlp-sub-test-model-a1d751\"]}],\"name\":\"aa0eb8235785812dd27690bb9a938fe5b32045914dff123e9378cf1bf90996a6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w3-a1d751/models/facebook/opt-125m/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f1aeb859c1579aea92c81f985aec98129102bab0482185da8dd5e38bfdab1f31\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_500_per_1m__3c5ebddf\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"9f3f1bc278673cf2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-a1d751/maas-trlp-sub-test-model-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_500_per_1m__3c5ebddf\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"9f3f1bc278673cf2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-a1d751/maas-trlp-sub-test-model-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__6dd28790\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"fdfe5ac0855997fa\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-a1d751/maas-trlp-sub-test-model-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__6dd28790\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"fdfe5ac0855997fa\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-a1d751/maas-trlp-sub-test-model-a1d751\"]}],\"name\":\"6aa791d210e1f26083ea6e82b46ed8801291f17c0406c9508e404ae9421e045d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w3-a1d751/models/facebook/opt-125m/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f37aa79ec4a1199a49abd3f63dd4c9505bbd959bba56de7e4c8dad6c144af205\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_500_per_1m__3c5ebddf\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"9f3f1bc278673cf2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-a1d751/maas-trlp-sub-test-model-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_500_per_1m__3c5ebddf\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"9f3f1bc278673cf2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-a1d751/maas-trlp-sub-test-model-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__6dd28790\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"fdfe5ac0855997fa\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-a1d751/maas-trlp-sub-test-model-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__6dd28790\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"fdfe5ac0855997fa\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-a1d751/maas-trlp-sub-test-model-a1d751\"]}],\"name\":\"ee86408dcc7c307eeb7e62f03ad79696c1aed2e21d972e66f5a46e737a42c8e1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d382a9a5e68a63cf824ae7421c24f285af4eba4b4e83a5df42b6213da00221b7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_500_per_1m__3c5ebddf\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"9f3f1bc278673cf2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-a1d751/maas-trlp-sub-test-model-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_500_per_1m__3c5ebddf\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"9f3f1bc278673cf2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-a1d751/maas-trlp-sub-test-model-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__6dd28790\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"fdfe5ac0855997fa\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-a1d751/maas-trlp-sub-test-model-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__6dd28790\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"fdfe5ac0855997fa\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-a1d751/maas-trlp-sub-test-model-a1d751\"]}],\"name\":\"271e920a6bd7d30bded719b07e051f15b025a118a8675eaf26d6baadbe4d283b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"30ba4ccdfea25c5f1ebce6f1499d547e64179efb055f133b434843801331620f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_500_per_1m__3c5ebddf\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"9f3f1bc278673cf2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-a1d751/maas-trlp-sub-test-model-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_500_per_1m__3c5ebddf\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"9f3f1bc278673cf2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-a1d751/maas-trlp-sub-test-model-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__6dd28790\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"fdfe5ac0855997fa\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-a1d751/maas-trlp-sub-test-model-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__6dd28790\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"fdfe5ac0855997fa\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-a1d751/maas-trlp-sub-test-model-a1d751\"]}],\"name\":\"00d9079f672c491f076316c8c4b048c87702c283bdebf80e975d415f1df6d2ee\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w3-a1d751/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"649eae6f669005f50b60c0a593259354e3a301dc59d4543707d5cc441ea578ed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_500_per_1m__3c5ebddf\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"9f3f1bc278673cf2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-a1d751/maas-trlp-sub-test-model-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_500_per_1m__3c5ebddf\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"9f3f1bc278673cf2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-a1d751/maas-trlp-sub-test-model-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__6dd28790\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"fdfe5ac0855997fa\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-a1d751/maas-trlp-sub-test-model-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__6dd28790\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"fdfe5ac0855997fa\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-a1d751/maas-trlp-sub-test-model-a1d751\"]}],\"name\":\"e0a0969004be7bfb9d1683a46a3327aa5144255b817ecc80e408763e6c41f64c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9593847662171f6a7915c575284c678f049381a1160493b136f5566f61950b7f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_500_per_1m__3c5ebddf\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"9f3f1bc278673cf2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-a1d751/maas-trlp-sub-test-model-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_500_per_1m__3c5ebddf\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"9f3f1bc278673cf2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-a1d751/maas-trlp-sub-test-model-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__6dd28790\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"fdfe5ac0855997fa\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-a1d751/maas-trlp-sub-test-model-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__6dd28790\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"fdfe5ac0855997fa\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-a1d751/maas-trlp-sub-test-model-a1d751\"]}],\"name\":\"6c679088602dd9ea796b046684f1d25f72a7bc96a91c5c604003243da035aa90\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1db7db8718ec954ecf16b0d35140cb8a1c89f0173590ed683bbb861f8380c6f1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_500_per_1m__3c5ebddf\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"9f3f1bc278673cf2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-a1d751/maas-trlp-sub-test-model-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_500_per_1m__3c5ebddf\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"9f3f1bc278673cf2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-a1d751/maas-trlp-sub-test-model-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__6dd28790\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"fdfe5ac0855997fa\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-a1d751/maas-trlp-sub-test-model-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__6dd28790\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"fdfe5ac0855997fa\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-a1d751/maas-trlp-sub-test-model-a1d751\"]}],\"name\":\"fe031e9e78874e208226b8d363abc95f5f91493550d1e9fbb78ca7091c5e267f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9ed0ddd0e1ea68b359e326fba62a585324a528f116f0bf6d3f085360f79ed877\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-a1d751\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-a1d751\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]}],\"name\":\"7017ce065aadb4ec3cd123f3de90d4b298418b4cb0d6f2943ce905f0b6fa1973\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3e1c5c0bad150c663f60d190f6837f1f47449a9fb1dd0f8b15a5a049a5785836\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-a1d751\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-a1d751\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]}],\"name\":\"4b9629b6a0dc02e424027c37c202c248a532fff8b8cebe3888b35f432e4237a0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"45692dd8f986fdd88aa79ac3fde6dd1db9cc5cbaa9003e3fe62a6a019e62eb23\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-a1d751\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-a1d751\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]}],\"name\":\"8762492ec17ca2d96d70f7661ea91bc6dd105b52e7f7927e5f87422dad69cdf1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"54678c70bb572c34d6f6ed39e879f5beb1891cc61c4ee64dec6d9d3d0ed9c115\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-a1d751\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-a1d751\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]}],\"name\":\"6e67ae0eecb22274f490861a930e85a9d3cf386bb0d1179f4c67c60e1ed8eb2c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"afffab50bac2693d1a47a43cedfba11a37634e625c51a64f41e14d037dc9bc9a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-a1d751\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-a1d751\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]}],\"name\":\"5df45cb848791fb94dcb78fb658eb490c82f995f9d95444c8a546b5cddad1a1b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0b94d900a5cdf5c531935a5db6b720c905f8b8e2c62caaf31136dacaca42afc8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_500_per_1m__3c5ebddf\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"9f3f1bc278673cf2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-a1d751/maas-trlp-sub-test-model-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_500_per_1m__3c5ebddf\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"9f3f1bc278673cf2\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-a1d751/maas-trlp-sub-test-model-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__6dd28790\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"fdfe5ac0855997fa\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-a1d751/maas-trlp-sub-test-model-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__6dd28790\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"fdfe5ac0855997fa\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-a1d751/maas-trlp-sub-test-model-a1d751\"]}],\"name\":\"95a9fdd052d64ba5b84de723c48968a3ca284a89256c7757f5ce2db19a3f11c6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w3-a1d751/models/facebook/opt-125m')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-shared-b-w3-a1d751"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-shared-b-w3-a1d751\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:32:14.354Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/228ec96802a09009d984b3728e4e96175fefb32ba2e3b918071e85b3f8ec79d0","error":"authconfigs.authorino.kuadrant.io \"228ec96802a09009d984b3728e4e96175fefb32ba2e3b918071e85b3f8ec79d0\" not found"}
{"level":"error","ts":"2026-11-02T22:32:14.409Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/5f8a52baf63f9e4c9ea31b6e22c9076262e33bc06968bbcb213439af05ae3a21","error":"authconfigs.authorino.kuadrant.io \"5f8a52baf63f9e4c9ea31b6e22c9076262e33bc06968bbcb213439af05ae3a21\" not found"}
{"level":"error","ts":"2026-11-02T22:32:14.541Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/a8ba5320fff14c281f32c2b0a9e757f0e205aace00c294b0d13fa46185724d35","error":"authconfigs.authorino.kuadrant.io \"a8ba5320fff14c281f32c2b0a9e757f0e205aace00c294b0d13fa46185724d35\" not found"}
{"level":"error","ts":"2026-11-02T22:32:14.543Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-shared-a-w3-97995b","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T21:54:08Z","generation":6,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"b9ce997b-e593-4e5a-96e1-266d4780e128\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:28:17Z"}],"name":"kuadrant-e2e-shared-a-w3-97995b","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-a-w3-97995b","uid":"b9ce997b-e593-4e5a-96e1-266d4780e128"}],"resourceVersion":"130980","uid":"657ba0c9-d22d-4183-a7c2-c392b8af6143"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9de3aeb3807fb0a63865dbb0cb6cac00d8acc0a489a9165c369fb079f576e503\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-97995b-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_50_per_1m__4ef9cd7b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4b0bfb845da32fd8\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w3-97995b/maas-trlp-sub-test-model-97995b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_50_per_1m__4ef9cd7b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4b0bfb845da32fd8\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w3-97995b/maas-trlp-sub-test-model-97995b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_75_per_1m__5ea482ad\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"daa756b1654a5b10\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w3-97995b/maas-trlp-sub-test-model-97995b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_75_per_1m__5ea482ad\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"daa756b1654a5b10\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w3-97995b/maas-trlp-sub-test-model-97995b\"]}],\"name\":\"565ed9688c39a2be659eeac47153bce243f1c8cd7f37489c36111faa965f90ba\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w3-97995b/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9de3aeb3807fb0a63865dbb0cb6cac00d8acc0a489a9165c369fb079f576e503\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-97995b-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_50_per_1m__4ef9cd7b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4b0bfb845da32fd8\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w3-97995b/maas-trlp-sub-test-model-97995b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_50_per_1m__4ef9cd7b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4b0bfb845da32fd8\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w3-97995b/maas-trlp-sub-test-model-97995b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_75_per_1m__5ea482ad\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"daa756b1654a5b10\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w3-97995b/maas-trlp-sub-test-model-97995b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_75_per_1m__5ea482ad\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"daa756b1654a5b10\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w3-97995b/maas-trlp-sub-test-model-97995b\"]}],\"name\":\"24e40cd6ec8b29ff4943e44b88c242cd569d7509cda070d913d0495e8477f7be\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w3-97995b/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9de3aeb3807fb0a63865dbb0cb6cac00d8acc0a489a9165c369fb079f576e503\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-97995b-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_50_per_1m__4ef9cd7b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4b0bfb845da32fd8\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w3-97995b/maas-trlp-sub-test-model-97995b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_50_per_1m__4ef9cd7b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4b0bfb845da32fd8\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w3-97995b/maas-trlp-sub-test-model-97995b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_75_per_1m__5ea482ad\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"daa756b1654a5b10\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w3-97995b/maas-trlp-sub-test-model-97995b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_75_per_1m__5ea482ad\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"daa756b1654a5b10\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w3-97995b/maas-trlp-sub-test-model-97995b\"]}],\"name\":\"dff5b6d0f22c8d3d836e629a03ac80823cd7b71d41674ff051a4f4e90eb78fb5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w3-97995b/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9de3aeb3807fb0a63865dbb0cb6cac00d8acc0a489a9165c369fb079f576e503\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-97995b-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_50_per_1m__4ef9cd7b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4b0bfb845da32fd8\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w3-97995b/maas-trlp-sub-test-model-97995b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_50_per_1m__4ef9cd7b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4b0bfb845da32fd8\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w3-97995b/maas-trlp-sub-test-model-97995b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_75_per_1m__5ea482ad\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"daa756b1654a5b10\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w3-97995b/maas-trlp-sub-test-model-97995b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_75_per_1m__5ea482ad\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"daa756b1654a5b10\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w3-97995b/maas-trlp-sub-test-model-97995b\"]}],\"name\":\"83d66bd4aa23be5045fa246f453ae1878d78270049b4d3d01b341ba95ce3e856\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w3-97995b/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9de3aeb3807fb0a63865dbb0cb6cac00d8acc0a489a9165c369fb079f576e503\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-97995b-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_50_per_1m__4ef9cd7b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4b0bfb845da32fd8\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w3-97995b/maas-trlp-sub-test-model-97995b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_50_per_1m__4ef9cd7b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4b0bfb845da32fd8\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w3-97995b/maas-trlp-sub-test-model-97995b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_75_per_1m__5ea482ad\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"daa756b1654a5b10\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w3-97995b/maas-trlp-sub-test-model-97995b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_75_per_1m__5ea482ad\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"daa756b1654a5b10\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w3-97995b/maas-trlp-sub-test-model-97995b\"]}],\"name\":\"bda1edd31814a0488531fb4dd5adaaaec12b84667033b60d558374d0e7c81cc1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w3-97995b/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9de3aeb3807fb0a63865dbb0cb6cac00d8acc0a489a9165c369fb079f576e503\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-97995b-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_50_per_1m__4ef9cd7b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4b0bfb845da32fd8\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w3-97995b/maas-trlp-sub-test-model-97995b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_50_per_1m__4ef9cd7b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4b0bfb845da32fd8\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w3-97995b/maas-trlp-sub-test-model-97995b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_75_per_1m__5ea482ad\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"daa756b1654a5b10\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w3-97995b/maas-trlp-sub-test-model-97995b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_75_per_1m__5ea482ad\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"daa756b1654a5b10\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w3-97995b/maas-trlp-sub-test-model-97995b\"]}],\"name\":\"9100031231cfd5633f8f00326357cc522f630decd55a02902ed5e43fd9af348e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w3-97995b/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9de3aeb3807fb0a63865dbb0cb6cac00d8acc0a489a9165c369fb079f576e503\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-97995b-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_50_per_1m__4ef9cd7b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4b0bfb845da32fd8\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w3-97995b/maas-trlp-sub-test-model-97995b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_50_per_1m__4ef9cd7b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4b0bfb845da32fd8\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w3-97995b/maas-trlp-sub-test-model-97995b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_75_per_1m__5ea482ad\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"daa756b1654a5b10\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w3-97995b/maas-trlp-sub-test-model-97995b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_75_per_1m__5ea482ad\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"daa756b1654a5b10\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w3-97995b/maas-trlp-sub-test-model-97995b\"]}],\"name\":\"47aff0132ef320dec9d2a0610ae47e5c539557133ccffef66d9b8c7977778b1b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w3-97995b/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9de3aeb3807fb0a63865dbb0cb6cac00d8acc0a489a9165c369fb079f576e503\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-97995b-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_50_per_1m__4ef9cd7b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4b0bfb845da32fd8\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w3-97995b/maas-trlp-sub-test-model-97995b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_50_per_1m__4ef9cd7b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4b0bfb845da32fd8\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w3-97995b/maas-trlp-sub-test-model-97995b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_75_per_1m__5ea482ad\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"daa756b1654a5b10\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w3-97995b/maas-trlp-sub-test-model-97995b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_75_per_1m__5ea482ad\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"daa756b1654a5b10\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w3-97995b/maas-trlp-sub-test-model-97995b\"]}],\"name\":\"e65650f912e0880ad9ecfeb29e81ce93ff5a69f6e6590dd0e3aa9f10617ae6e0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w3-97995b/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"feca5257a3a136afa9ca4bb6226e83b9e72a014fd57c59db758c454f118180b2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-97995b-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-97995b\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-97995b\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]}],\"name\":\"697447b051af365a79e3fa7acf7f1f6f64b9bd844855783e0433ae28eb9de042\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ed2994aa9701d5383eb1f805c9c89ccec8a7d0b77fb131a5ca742fa37c73a14b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-97995b-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_50_per_1m__4ef9cd7b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4b0bfb845da32fd8\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w3-97995b/maas-trlp-sub-test-model-97995b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_50_per_1m__4ef9cd7b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4b0bfb845da32fd8\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w3-97995b/maas-trlp-sub-test-model-97995b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_75_per_1m__5ea482ad\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"daa756b1654a5b10\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w3-97995b/maas-trlp-sub-test-model-97995b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_75_per_1m__5ea482ad\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"daa756b1654a5b10\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w3-97995b/maas-trlp-sub-test-model-97995b\"]}],\"name\":\"68031bfda00da44546eee02421b29d0de6657cae50508d670e166e45419111b6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-a-w3-97995b/models/facebook/opt-125m/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7a7d519d00fa2e97e5f400a44c82c2e18e0c409b5a9afbb4d9d294659141b972\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-97995b-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_50_per_1m__4ef9cd7b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4b0bfb845da32fd8\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w3-97995b/maas-trlp-sub-test-model-97995b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_50_per_1m__4ef9cd7b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4b0bfb845da32fd8\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w3-97995b/maas-trlp-sub-test-model-97995b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_75_per_1m__5ea482ad\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"daa756b1654a5b10\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w3-97995b/maas-trlp-sub-test-model-97995b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_75_per_1m__5ea482ad\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"daa756b1654a5b10\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w3-97995b/maas-trlp-sub-test-model-97995b\"]}],\"name\":\"1f4dd462af4c99a7e3d0cad047fd4117b9bd33823c153b2c67e8632589d2c31b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-a-w3-97995b/models/facebook/opt-125m/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8ce2cbfc67213d98707c4ceb948a0bc47d762da419d2877baa87368e52adeb7b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-97995b-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_50_per_1m__4ef9cd7b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4b0bfb845da32fd8\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w3-97995b/maas-trlp-sub-test-model-97995b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_50_per_1m__4ef9cd7b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4b0bfb845da32fd8\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w3-97995b/maas-trlp-sub-test-model-97995b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_75_per_1m__5ea482ad\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"daa756b1654a5b10\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w3-97995b/maas-trlp-sub-test-model-97995b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_75_per_1m__5ea482ad\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"daa756b1654a5b10\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w3-97995b/maas-trlp-sub-test-model-97995b\"]}],\"name\":\"88b5ba94e6e26d62f29ceb39fd1b3b5f62ed1825296f84afbe67f94f7f0a48dc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-a-w3-97995b/models/facebook/opt-125m/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5727d2fd0019c6bfa39a149d096736a5b6470b2cc5bf597b76fa7b9fb568b099\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-97995b-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_50_per_1m__4ef9cd7b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4b0bfb845da32fd8\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w3-97995b/maas-trlp-sub-test-model-97995b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_50_per_1m__4ef9cd7b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4b0bfb845da32fd8\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w3-97995b/maas-trlp-sub-test-model-97995b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_75_per_1m__5ea482ad\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"daa756b1654a5b10\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w3-97995b/maas-trlp-sub-test-model-97995b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_75_per_1m__5ea482ad\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"daa756b1654a5b10\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w3-97995b/maas-trlp-sub-test-model-97995b\"]}],\"name\":\"b11a892c6f8134c4af7069b5663a488957a65d1ec274482c603b23c972a6df5a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-a-w3-97995b/models/facebook/opt-125m/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"29e64f93e9761c53580c183981bf81fb67b5649bbe34948dec541fd02a8b9939\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-97995b-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_50_per_1m__4ef9cd7b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4b0bfb845da32fd8\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w3-97995b/maas-trlp-sub-test-model-97995b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_50_per_1m__4ef9cd7b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4b0bfb845da32fd8\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w3-97995b/maas-trlp-sub-test-model-97995b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_75_per_1m__5ea482ad\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"daa756b1654a5b10\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w3-97995b/maas-trlp-sub-test-model-97995b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_75_per_1m__5ea482ad\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"daa756b1654a5b10\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w3-97995b/maas-trlp-sub-test-model-97995b\"]}],\"name\":\"12515b64ab6f198e54b3adb168893377e22bba966b25981ed8754bcbd19ff7fd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7452998b42ae4dea69dddcc474a389491d89642261d52ffb8b2401267d4fd23a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-97995b-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_50_per_1m__4ef9cd7b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4b0bfb845da32fd8\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w3-97995b/maas-trlp-sub-test-model-97995b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_50_per_1m__4ef9cd7b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4b0bfb845da32fd8\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w3-97995b/maas-trlp-sub-test-model-97995b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_75_per_1m__5ea482ad\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"daa756b1654a5b10\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w3-97995b/maas-trlp-sub-test-model-97995b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_75_per_1m__5ea482ad\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"daa756b1654a5b10\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w3-97995b/maas-trlp-sub-test-model-97995b\"]}],\"name\":\"002be0fead060e19f100ac56b16479b833d1a76a36c178ab0ac6bee1e117b54e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9eab454af32c78b750dd8a7f0f51e46caf9c5a6d593a08102680ec455da7f941\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-97995b-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_50_per_1m__4ef9cd7b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4b0bfb845da32fd8\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w3-97995b/maas-trlp-sub-test-model-97995b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_50_per_1m__4ef9cd7b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4b0bfb845da32fd8\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w3-97995b/maas-trlp-sub-test-model-97995b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_75_per_1m__5ea482ad\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"daa756b1654a5b10\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w3-97995b/maas-trlp-sub-test-model-97995b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_75_per_1m__5ea482ad\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"daa756b1654a5b10\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w3-97995b/maas-trlp-sub-test-model-97995b\"]}],\"name\":\"8957cb0ea5616db4e85fa3c4d240c34cacf6c78c2b5adece5eea327c50303d2f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-a-w3-97995b/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3ea0c1283049b0b2e2ae47d4fdbeeb04aae52608076de47123cc9c6c1a7b685a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-97995b-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_50_per_1m__4ef9cd7b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4b0bfb845da32fd8\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w3-97995b/maas-trlp-sub-test-model-97995b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_50_per_1m__4ef9cd7b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4b0bfb845da32fd8\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w3-97995b/maas-trlp-sub-test-model-97995b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_75_per_1m__5ea482ad\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"daa756b1654a5b10\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w3-97995b/maas-trlp-sub-test-model-97995b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_75_per_1m__5ea482ad\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"daa756b1654a5b10\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w3-97995b/maas-trlp-sub-test-model-97995b\"]}],\"name\":\"08adfddc8873dff06bcb253386ec97029daca63cd5dab407c52eed6eeb523f41\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ddd153ffe5f2008b5c0d76c6d4ced2a6aaaea3fc84c2bb12b6f75d72f6ffdcf8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-97995b-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_50_per_1m__4ef9cd7b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4b0bfb845da32fd8\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w3-97995b/maas-trlp-sub-test-model-97995b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_50_per_1m__4ef9cd7b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4b0bfb845da32fd8\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w3-97995b/maas-trlp-sub-test-model-97995b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_75_per_1m__5ea482ad\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"daa756b1654a5b10\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w3-97995b/maas-trlp-sub-test-model-97995b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_75_per_1m__5ea482ad\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"daa756b1654a5b10\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w3-97995b/maas-trlp-sub-test-model-97995b\"]}],\"name\":\"ad83cbcfed1b1916836effabcdfddfceeadeb1c44756049aa621fa63988216cd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"96a831079b0b478b2f950e00a3b6488601f3db32cc01341caf7b7679a46be3b8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-97995b-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_50_per_1m__4ef9cd7b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4b0bfb845da32fd8\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w3-97995b/maas-trlp-sub-test-model-97995b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_50_per_1m__4ef9cd7b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4b0bfb845da32fd8\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w3-97995b/maas-trlp-sub-test-model-97995b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_75_per_1m__5ea482ad\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"daa756b1654a5b10\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w3-97995b/maas-trlp-sub-test-model-97995b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_75_per_1m__5ea482ad\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"daa756b1654a5b10\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w3-97995b/maas-trlp-sub-test-model-97995b\"]}],\"name\":\"a523abbb0fd98c9040af18b7a86d4b2d847b6dcfcf96781cd952abb78d94bda2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"64610b2b1b14c01fb91d85773d211a6d8b173cb847914d22204a29dbf00c051b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-97995b-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-97995b\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-97995b\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]}],\"name\":\"ab3f8e403d48e2edf0d20cf1af9316112053ce238e3ab9db5309e4506ca81358\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7acb8a78dba64f5ca2cb229b1a6a6e5100dfd1fe0185742cdf2493f937286eba\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-97995b-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-97995b\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-97995b\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]}],\"name\":\"277f6eb1de4fbfe33e49087e7995e2fc70745c603dfb4e7bd0387ba87a05fa73\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"abffb2b80b2e83749e48ad9bc9e2b132b4526ff5c2ddee7e3c63dcaac739cb58\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-97995b-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-97995b\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-97995b\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]}],\"name\":\"9fc807dc86717cc414f321c16b0d44d999a6c047d0871e8e85085f494ab58344\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"861bd69371a3568d3786b56a91d3af9c85fd73ef3e549606a38eed24c8a99b89\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-97995b-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-97995b\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-97995b\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]}],\"name\":\"1abcc31fbef3280fc20850d49e96774344d45c72d9af2ad2be2a524b9041e48d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6de91d16ed05414ab83195af7a0e61dc3b464cde05b3f5b5c1cb41079af7d577\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-97995b-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-97995b\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-97995b\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]}],\"name\":\"4a5b0c3ba4d080fdf6969433dffaaa078a2cac0527e231c6975641dbc9a0fa7c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e8df393789582296e5c92b134371d265557ec06b8f530a82d60afcfdfc27de8b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-97995b-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_50_per_1m__4ef9cd7b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4b0bfb845da32fd8\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w3-97995b/maas-trlp-sub-test-model-97995b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_50_per_1m__4ef9cd7b\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"4b0bfb845da32fd8\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w3-97995b/maas-trlp-sub-test-model-97995b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_75_per_1m__5ea482ad\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"daa756b1654a5b10\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w3-97995b/maas-trlp-sub-test-model-97995b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_75_per_1m__5ea482ad\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"daa756b1654a5b10\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-w3-97995b/maas-trlp-sub-test-model-97995b\"]}],\"name\":\"fd8d56463d64bf50329ae79335828423b5b89f38f1a76f7397ec15a3abcc8fe1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w3-97995b/models/facebook/opt-125m')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-shared-a-w3-97995b"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-shared-a-w3-97995b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:32:14.595Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/be088898c71049f4ea232cae6dd479dfab1a9947fba6b17e7353ce14e639507c","error":"authconfigs.authorino.kuadrant.io \"be088898c71049f4ea232cae6dd479dfab1a9947fba6b17e7353ce14e639507c\" not found"}
{"level":"error","ts":"2026-11-02T22:32:14.650Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/884ebceaf8f5da21059151f97834277770ed77023feb57f83fc8c75e495f8d1c","error":"authconfigs.authorino.kuadrant.io \"884ebceaf8f5da21059151f97834277770ed77023feb57f83fc8c75e495f8d1c\" not found"}
{"level":"error","ts":"2026-11-02T22:32:14.652Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to delete envoyfilter object","gateway":"openshift-ingress/e2e-worker-w0-0c9014","envoyfilter":"openshift-ingress/kuadrant-e2e-worker-w0-0c9014","error":"envoyfilters.networking.istio.io \"kuadrant-e2e-worker-w0-0c9014\" not found"}
{"level":"error","ts":"2026-11-02T22:32:14.704Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/fe65e47ea66e64f823a934786806a737bfe3ca692bad4019774d91daeb2348d1","error":"authconfigs.authorino.kuadrant.io \"fe65e47ea66e64f823a934786806a737bfe3ca692bad4019774d91daeb2348d1\" not found"}
{"level":"error","ts":"2026-11-02T22:32:14.759Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/0ad1aa31e975e4b569a9617aed9c37982646578e71674b0d96896f60dc232a90","error":"authconfigs.authorino.kuadrant.io \"0ad1aa31e975e4b569a9617aed9c37982646578e71674b0d96896f60dc232a90\" not found"}
{"level":"error","ts":"2026-11-02T22:32:14.813Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/59093ab44195ceb3a72fd7400b422644d3d7c840cd3e838bafbbcf827cbcc073","error":"authconfigs.authorino.kuadrant.io \"59093ab44195ceb3a72fd7400b422644d3d7c840cd3e838bafbbcf827cbcc073\" not found"}
{"level":"error","ts":"2026-11-02T22:32:14.867Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/b0bfe3b1d3a080ff25e482046cf0d1df0ca30a090ef9f8424787467410af7627","error":"authconfigs.authorino.kuadrant.io \"b0bfe3b1d3a080ff25e482046cf0d1df0ca30a090ef9f8424787467410af7627\" not found"}
{"level":"error","ts":"2026-11-02T22:32:14.922Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/e1cab00a309f6035001c6bed21b280b9cd6d81b83072c8f351fbe860f69886ad","error":"authconfigs.authorino.kuadrant.io \"e1cab00a309f6035001c6bed21b280b9cd6d81b83072c8f351fbe860f69886ad\" not found"}
{"level":"error","ts":"2026-11-02T22:32:14.976Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/4b932ff2b149c42a260b63c5bdd2b0515a398d1964de7381e0735756ee620b8e","error":"authconfigs.authorino.kuadrant.io \"4b932ff2b149c42a260b63c5bdd2b0515a398d1964de7381e0735756ee620b8e\" not found"}
{"level":"error","ts":"2026-11-02T22:32:15.031Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/cbaea0f78f7b655ed1c234a9fbf7020e12e29bee546d39c314b814aa1692620f","error":"authconfigs.authorino.kuadrant.io \"cbaea0f78f7b655ed1c234a9fbf7020e12e29bee546d39c314b814aa1692620f\" not found"}
{"level":"error","ts":"2026-11-02T22:32:15.086Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/ea4599ace477623ac871dedf5650245e6a589cd60cb7c50944431b6bd5453ebc","error":"authconfigs.authorino.kuadrant.io \"ea4599ace477623ac871dedf5650245e6a589cd60cb7c50944431b6bd5453ebc\" not found"}
{"level":"error","ts":"2026-11-02T22:32:15.140Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/86115b8156c50eab2036378ac37ec53b33537f0eef44a4aa5d81752c24254c82","error":"authconfigs.authorino.kuadrant.io \"86115b8156c50eab2036378ac37ec53b33537f0eef44a4aa5d81752c24254c82\" not found"}
{"level":"error","ts":"2026-11-02T22:32:15.195Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/96d049688a520cd26e12f2232f544b815eac1611ab00713e2f641e57b40e5f84","error":"authconfigs.authorino.kuadrant.io \"96d049688a520cd26e12f2232f544b815eac1611ab00713e2f641e57b40e5f84\" not found"}
{"level":"error","ts":"2026-11-02T22:32:15.251Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/06c24ca69f585351676e3a47fdf7a96df9b9a8fe85641e1c3348c8cfdfe446cb","error":"authconfigs.authorino.kuadrant.io \"06c24ca69f585351676e3a47fdf7a96df9b9a8fe85641e1c3348c8cfdfe446cb\" not found"}
{"level":"error","ts":"2026-11-02T22:32:15.306Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/b8e8a49e358e54b12e2aba59e563ba17bcf32315bebde13a721f3b7ebfae18ba","error":"authconfigs.authorino.kuadrant.io \"b8e8a49e358e54b12e2aba59e563ba17bcf32315bebde13a721f3b7ebfae18ba\" not found"}
{"level":"error","ts":"2026-11-02T22:32:15.361Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/0e0bbf1b6879cb3f68f7ea7f2afda47c74a88c5d3cb97fdf3e110cdc54718649","error":"authconfigs.authorino.kuadrant.io \"0e0bbf1b6879cb3f68f7ea7f2afda47c74a88c5d3cb97fdf3e110cdc54718649\" not found"}
{"level":"error","ts":"2026-11-02T22:32:15.415Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/fbfa7264341556b62c34307c6c836c7e015aeca2df10913c89f8c2d9d38fd28d","error":"authconfigs.authorino.kuadrant.io \"fbfa7264341556b62c34307c6c836c7e015aeca2df10913c89f8c2d9d38fd28d\" not found"}
{"level":"error","ts":"2026-11-02T22:32:15.471Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/69645d92530f5991fb0c1154aa418715dafc9eb9b4b827c33aa742687b00c4fc","error":"authconfigs.authorino.kuadrant.io \"69645d92530f5991fb0c1154aa418715dafc9eb9b4b827c33aa742687b00c4fc\" not found"}
{"level":"error","ts":"2026-11-02T22:32:15.525Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/7da280ddad70ebcc1b84b8a595244d0682cd0302755439371683331c4562cfe5","error":"authconfigs.authorino.kuadrant.io \"7da280ddad70ebcc1b84b8a595244d0682cd0302755439371683331c4562cfe5\" not found"}
{"level":"error","ts":"2026-11-02T22:32:15.580Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/4dcc64ddad4ef375730fe33c8b8925944bf0c1750f66d8a3347219a51dd190d3","error":"authconfigs.authorino.kuadrant.io \"4dcc64ddad4ef375730fe33c8b8925944bf0c1750f66d8a3347219a51dd190d3\" not found"}
{"level":"error","ts":"2026-11-02T22:32:15.635Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/bcf1ddf402fe28df1f45e616a2e2380b51177c45a7f8dcdd03bc2aa6b5814d26","error":"authconfigs.authorino.kuadrant.io \"bcf1ddf402fe28df1f45e616a2e2380b51177c45a7f8dcdd03bc2aa6b5814d26\" not found"}
{"level":"error","ts":"2026-11-02T22:32:15.689Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/93867ab0bab47561de7ff57c3a2f54a4e134cfb5a3ee35d78ee703589d669077","error":"authconfigs.authorino.kuadrant.io \"93867ab0bab47561de7ff57c3a2f54a4e134cfb5a3ee35d78ee703589d669077\" not found"}
{"level":"error","ts":"2026-11-02T22:32:15.744Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/29a6e78291fb6eb1600fcc523c35316897713ec3a1f3092074998de0701a2bff","error":"authconfigs.authorino.kuadrant.io \"29a6e78291fb6eb1600fcc523c35316897713ec3a1f3092074998de0701a2bff\" not found"}
{"level":"error","ts":"2026-11-02T22:32:15.799Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/463f896d9e9b5a3f2518e764053718a018fbe93828587f90cc4250e5a67a2236","error":"authconfigs.authorino.kuadrant.io \"463f896d9e9b5a3f2518e764053718a018fbe93828587f90cc4250e5a67a2236\" not found"}
{"level":"error","ts":"2026-11-02T22:32:15.853Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/3d645f3ac772a0cc5a9a71b4e6a542a2b2ab9962190903cb5d89d3e8e45b7f9d","error":"authconfigs.authorino.kuadrant.io \"3d645f3ac772a0cc5a9a71b4e6a542a2b2ab9962190903cb5d89d3e8e45b7f9d\" not found"}
{"level":"error","ts":"2026-11-02T22:32:15.908Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/4cc208f8f31098b1cdf91b5776a85b52bae0339e659b20995e8ad11208703993","error":"authconfigs.authorino.kuadrant.io \"4cc208f8f31098b1cdf91b5776a85b52bae0339e659b20995e8ad11208703993\" not found"}
{"level":"error","ts":"2026-11-02T22:32:15.963Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/327ad026e5a9c61ed15c52c9e2fb0c219e4d9a636a17ed736f525f2b42ebfd6d","error":"authconfigs.authorino.kuadrant.io \"327ad026e5a9c61ed15c52c9e2fb0c219e4d9a636a17ed736f525f2b42ebfd6d\" not found"}
{"level":"error","ts":"2026-11-02T22:32:16.017Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/f713c09235fdc689702761ce6f8fb3c2c03ea75f66382e5121160a24cf7aee9d","error":"authconfigs.authorino.kuadrant.io \"f713c09235fdc689702761ce6f8fb3c2c03ea75f66382e5121160a24cf7aee9d\" not found"}
{"level":"error","ts":"2026-11-02T22:32:16.072Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/8cb0b0d9cbe25e4182aea7d2ed6f3ca636a7d0c9be364f722b182dde26da45e1","error":"authconfigs.authorino.kuadrant.io \"8cb0b0d9cbe25e4182aea7d2ed6f3ca636a7d0c9be364f722b182dde26da45e1\" not found"}
{"level":"error","ts":"2026-11-02T22:32:16.126Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/ea78fba3abdfbae2cfbad8389b4c97d45d924dfb8eebd29422ca7a2b62f9564f","error":"authconfigs.authorino.kuadrant.io \"ea78fba3abdfbae2cfbad8389b4c97d45d924dfb8eebd29422ca7a2b62f9564f\" not found"}
{"level":"error","ts":"2026-11-02T22:32:16.181Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/6b6f55f762b51c1f46156308a7f509359377c543fd3789f104b3416ff46e3216","error":"authconfigs.authorino.kuadrant.io \"6b6f55f762b51c1f46156308a7f509359377c543fd3789f104b3416ff46e3216\" not found"}
{"level":"error","ts":"2026-11-02T22:32:16.236Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/669fd13dfb6f84f6e255bbee071a63253e1d5bd80a372cb6a445299b3c53a1a6","error":"authconfigs.authorino.kuadrant.io \"669fd13dfb6f84f6e255bbee071a63253e1d5bd80a372cb6a445299b3c53a1a6\" not found"}
{"level":"error","ts":"2026-11-02T22:32:16.291Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/ad6b1369f6065e5d01605f83113ef1c7c93ed4b3fa8d01ad81d870c4a418f675","error":"authconfigs.authorino.kuadrant.io \"ad6b1369f6065e5d01605f83113ef1c7c93ed4b3fa8d01ad81d870c4a418f675\" not found"}
{"level":"error","ts":"2026-11-02T22:32:16.347Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/0dcf2663d1fa4c3fb5056f3703d9d1a316345e3f4ea0e2503f77738258a9e6a2","error":"authconfigs.authorino.kuadrant.io \"0dcf2663d1fa4c3fb5056f3703d9d1a316345e3f4ea0e2503f77738258a9e6a2\" not found"}
{"level":"error","ts":"2026-11-02T22:32:16.402Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/fe169ab2014a705a54df2fda4ec719f7132fd6bba54202f7531ce8df8da2bdf6","error":"authconfigs.authorino.kuadrant.io \"fe169ab2014a705a54df2fda4ec719f7132fd6bba54202f7531ce8df8da2bdf6\" not found"}
{"level":"error","ts":"2026-11-02T22:32:16.456Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/bdc9387e460a2dc1a85bc42d8ce6440788e8331159ace91b443c9628ef7c1fed","error":"authconfigs.authorino.kuadrant.io \"bdc9387e460a2dc1a85bc42d8ce6440788e8331159ace91b443c9628ef7c1fed\" not found"}
{"level":"error","ts":"2026-11-02T22:32:16.511Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/1cd65b24c576b1e8f7a954fffca2225dfb109bf5a068107003d4f72206723e55","error":"authconfigs.authorino.kuadrant.io \"1cd65b24c576b1e8f7a954fffca2225dfb109bf5a068107003d4f72206723e55\" not found"}
{"level":"error","ts":"2026-11-02T22:32:16.566Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/2ab986aa56245948b966f417e9db684ac2bae70862e05b68a996c57de4d7c4c9","error":"authconfigs.authorino.kuadrant.io \"2ab986aa56245948b966f417e9db684ac2bae70862e05b68a996c57de4d7c4c9\" not found"}
{"level":"error","ts":"2026-11-02T22:32:16.620Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/d2e0eee1c8e9f13da0b4cd4af8a834f482ac80e1620cc44747922a7c61d6a51b","error":"authconfigs.authorino.kuadrant.io \"d2e0eee1c8e9f13da0b4cd4af8a834f482ac80e1620cc44747922a7c61d6a51b\" not found"}
{"level":"error","ts":"2026-11-02T22:32:16.675Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/dcddce6770eda2db3f8f60d8b51b5ed927194e11c56d328f35000b6f5e92dbdf","error":"authconfigs.authorino.kuadrant.io \"dcddce6770eda2db3f8f60d8b51b5ed927194e11c56d328f35000b6f5e92dbdf\" not found"}
{"level":"error","ts":"2026-11-02T22:32:16.729Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/00c4d48b9f06a2f5dbb9cbe22ae3dcc9e10401b038e62058849dcebe2769e4f1","error":"authconfigs.authorino.kuadrant.io \"00c4d48b9f06a2f5dbb9cbe22ae3dcc9e10401b038e62058849dcebe2769e4f1\" not found"}
{"level":"error","ts":"2026-11-02T22:32:16.784Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/03938d68f68953b697b7b9ec3a9bb3205251dab0d8c28c8488a51872990c74d6","error":"authconfigs.authorino.kuadrant.io \"03938d68f68953b697b7b9ec3a9bb3205251dab0d8c28c8488a51872990c74d6\" not found"}
{"level":"error","ts":"2026-11-02T22:32:16.839Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/a24eea90cd520665ff61391c71ddaf8965158b1b42c4e6f9fe99dd03dfa7c401","error":"authconfigs.authorino.kuadrant.io \"a24eea90cd520665ff61391c71ddaf8965158b1b42c4e6f9fe99dd03dfa7c401\" not found"}
{"level":"error","ts":"2026-11-02T22:32:16.894Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/096fbc9d544918ac5b9d60464268ef3b1f03546e96ed130c743da74445576f52","error":"authconfigs.authorino.kuadrant.io \"096fbc9d544918ac5b9d60464268ef3b1f03546e96ed130c743da74445576f52\" not found"}
{"level":"error","ts":"2026-11-02T22:32:16.948Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/ece9796b491eeaad9788ab6c426bb54d8cbb85433a9010ef2c4d3f579cca0db0","error":"authconfigs.authorino.kuadrant.io \"ece9796b491eeaad9788ab6c426bb54d8cbb85433a9010ef2c4d3f579cca0db0\" not found"}
{"level":"error","ts":"2026-11-02T22:32:17.003Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/fbf5e5a312486cd624620a8628b976f89d3b75ffa1d3e47224c08e003294432f","error":"authconfigs.authorino.kuadrant.io \"fbf5e5a312486cd624620a8628b976f89d3b75ffa1d3e47224c08e003294432f\" not found"}
{"level":"error","ts":"2026-11-02T22:32:17.061Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-b-w3-a1d751","namespace":"openshift-ingress","uid":"2c7a0593-2f35-427a-b6f0-958582546c18","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-b-w3-a1d751\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:32:17.121Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-a-w3-97995b","namespace":"openshift-ingress","uid":"9405e4ea-22ff-4c46-bbc0-f492e0e403dc","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-a-w3-97995b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:32:17.130Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-worker-w0-0c9014-maas-auth","namespace":"openshift-ingress","error":"authpolicies.kuadrant.io \"e2e-worker-w0-0c9014-maas-auth\" not found"}
{"level":"error","ts":"2026-11-02T22:32:17.413Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-sub-test-model-a1d751","namespace":"ai-tenant-e2e-shared-b-w3-a1d751","uid":"6679e32c-53e2-4b45-b721-ad14049a0f70","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-sub-test-model-a1d751\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:32:17.588Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-sub-test-model-97995b","namespace":"ai-tenant-e2e-shared-a-w3-97995b","uid":"b79b6833-88bb-4969-be9f-5ba42b171234","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-sub-test-model-97995b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:32:17.588Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T22:32:17.588Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T22:32:17.668Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"sub-test-model-97995b-kserve-route","namespace":"ai-tenant-e2e-shared-a-w3-97995b","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"sub-test-model-97995b-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:32:17.749Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"sub-test-model-a1d751-kserve-route","namespace":"ai-tenant-e2e-shared-b-w3-a1d751","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"sub-test-model-a1d751-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:32:17.765Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-worker-w0-0c9014","error":"gateways.gateway.networking.k8s.io \"e2e-worker-w0-0c9014\" not found"}
{"level":"info","ts":"2026-11-02T22:32:24.708Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["HTTPRoute","TokenRateLimitPolicy","EnvoyFilter","Limitador","ConfigMap","AuthConfig","AuthPolicy","Gateway"],"eventTypes":{"delete":59,"update":10}}
{"level":"info","ts":"2026-11-02T22:32:24.897Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T22:32:25.230Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T22:32:25.353Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:32:25.353Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T22:32:25.966Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:32:25.967Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:32:25.967Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T22:32:25.969Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:32:25.972Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-02T22:32:25.972Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T22:32:25.973Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:32:27.887Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T22:32:27.887Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T22:32:28.323Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthPolicy"],"eventTypes":{"update":1}}
{"level":"info","ts":"2026-11-02T22:32:29.367Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:32:29.370Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:32:29.370Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-02T22:32:29.484Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-02T22:28:17Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:30:34Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:30:34Z"}],"name":"3ea0c1283049b0b2e2ae47d4fdbeeb04aae52608076de47123cc9c6c1a7b685a","namespace":"kuadrant-system","resourceVersion":"136141","uid":"3f1a4752-22d1-4273-bc8a-1b45b07b4b1f"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["3ea0c1283049b0b2e2ae47d4fdbeeb04aae52608076de47123cc9c6c1a7b685a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-97995b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-97995b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:28:17Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:28:17Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["3ea0c1283049b0b2e2ae47d4fdbeeb04aae52608076de47123cc9c6c1a7b685a"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"3ea0c1283049b0b2e2ae47d4fdbeeb04aae52608076de47123cc9c6c1a7b685a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:32:29.554Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-97995b","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-97995b#rule-1"},"creationTimestamp":"2026-11-02T21:54:07Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:30:34Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:30:34Z"}],"name":"6de91d16ed05414ab83195af7a0e61dc3b464cde05b3f5b5c1cb41079af7d577","namespace":"kuadrant-system","resourceVersion":"136152","uid":"a4f9446c-17f0-4b21-8887-734403122d6a"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["6de91d16ed05414ab83195af7a0e61dc3b464cde05b3f5b5c1cb41079af7d577"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-97995b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-97995b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:30:34Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:30:34Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["6de91d16ed05414ab83195af7a0e61dc3b464cde05b3f5b5c1cb41079af7d577"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"6de91d16ed05414ab83195af7a0e61dc3b464cde05b3f5b5c1cb41079af7d577\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:32:29.624Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-97995b","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-97995b#rule-4"},"creationTimestamp":"2026-11-02T21:54:07Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:30:32Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:30:32Z"}],"name":"861bd69371a3568d3786b56a91d3af9c85fd73ef3e549606a38eed24c8a99b89","namespace":"kuadrant-system","resourceVersion":"136075","uid":"89ab541a-5df9-4304-8a04-21e122f37f9e"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["861bd69371a3568d3786b56a91d3af9c85fd73ef3e549606a38eed24c8a99b89"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-97995b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-97995b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:54:07Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:54:07Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["861bd69371a3568d3786b56a91d3af9c85fd73ef3e549606a38eed24c8a99b89"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"861bd69371a3568d3786b56a91d3af9c85fd73ef3e549606a38eed24c8a99b89\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:32:29.686Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-02T22:28:17Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:30:32Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:30:33Z"}],"name":"5727d2fd0019c6bfa39a149d096736a5b6470b2cc5bf597b76fa7b9fb568b099","namespace":"kuadrant-system","resourceVersion":"136085","uid":"9b90c07b-553e-4e4c-8de2-5d796174497d"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["5727d2fd0019c6bfa39a149d096736a5b6470b2cc5bf597b76fa7b9fb568b099"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-97995b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-97995b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:28:17Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:28:17Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["5727d2fd0019c6bfa39a149d096736a5b6470b2cc5bf597b76fa7b9fb568b099"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"5727d2fd0019c6bfa39a149d096736a5b6470b2cc5bf597b76fa7b9fb568b099\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:32:29.750Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-02T22:28:17Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:30:33Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:30:33Z"}],"name":"96a831079b0b478b2f950e00a3b6488601f3db32cc01341caf7b7679a46be3b8","namespace":"kuadrant-system","resourceVersion":"136133","uid":"5dc726c8-64c0-4672-b766-2580ba81c088"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["96a831079b0b478b2f950e00a3b6488601f3db32cc01341caf7b7679a46be3b8"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-97995b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-97995b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:28:17Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:28:17Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["96a831079b0b478b2f950e00a3b6488601f3db32cc01341caf7b7679a46be3b8"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"96a831079b0b478b2f950e00a3b6488601f3db32cc01341caf7b7679a46be3b8\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:32:29.812Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-02T22:28:17Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:30:33Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:30:33Z"}],"name":"8ce2cbfc67213d98707c4ceb948a0bc47d762da419d2877baa87368e52adeb7b","namespace":"kuadrant-system","resourceVersion":"136113","uid":"9461b97d-1a68-4341-943b-ac19e310da7a"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["8ce2cbfc67213d98707c4ceb948a0bc47d762da419d2877baa87368e52adeb7b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-97995b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-97995b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:28:17Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:28:17Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["8ce2cbfc67213d98707c4ceb948a0bc47d762da419d2877baa87368e52adeb7b"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"8ce2cbfc67213d98707c4ceb948a0bc47d762da419d2877baa87368e52adeb7b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:32:29.874Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-02T22:28:17Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:30:33Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:30:33Z"}],"name":"29e64f93e9761c53580c183981bf81fb67b5649bbe34948dec541fd02a8b9939","namespace":"kuadrant-system","resourceVersion":"136116","uid":"d19c2bc9-0d93-4762-a24f-89d331a3b27e"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["29e64f93e9761c53580c183981bf81fb67b5649bbe34948dec541fd02a8b9939"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-97995b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-97995b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:28:18Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:28:18Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["29e64f93e9761c53580c183981bf81fb67b5649bbe34948dec541fd02a8b9939"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"29e64f93e9761c53580c183981bf81fb67b5649bbe34948dec541fd02a8b9939\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:32:29.936Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-02T22:28:17Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:30:33Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:30:33Z"}],"name":"7a7d519d00fa2e97e5f400a44c82c2e18e0c409b5a9afbb4d9d294659141b972","namespace":"kuadrant-system","resourceVersion":"136102","uid":"4fc4d283-17d3-49fc-ada4-b5986c34e137"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["7a7d519d00fa2e97e5f400a44c82c2e18e0c409b5a9afbb4d9d294659141b972"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-97995b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-97995b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:30:33Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:30:33Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["7a7d519d00fa2e97e5f400a44c82c2e18e0c409b5a9afbb4d9d294659141b972"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"7a7d519d00fa2e97e5f400a44c82c2e18e0c409b5a9afbb4d9d294659141b972\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:32:30.000Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-02T22:28:18Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:30:33Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:30:33Z"}],"name":"ddd153ffe5f2008b5c0d76c6d4ced2a6aaaea3fc84c2bb12b6f75d72f6ffdcf8","namespace":"kuadrant-system","resourceVersion":"136123","uid":"8431ba07-137a-4c34-80b5-9d428e133d9e"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["ddd153ffe5f2008b5c0d76c6d4ced2a6aaaea3fc84c2bb12b6f75d72f6ffdcf8"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-97995b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-97995b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:28:18Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:28:18Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["ddd153ffe5f2008b5c0d76c6d4ced2a6aaaea3fc84c2bb12b6f75d72f6ffdcf8"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"ddd153ffe5f2008b5c0d76c6d4ced2a6aaaea3fc84c2bb12b6f75d72f6ffdcf8\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:32:30.061Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-02T22:28:18Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:30:33Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:30:34Z"}],"name":"e8df393789582296e5c92b134371d265557ec06b8f530a82d60afcfdfc27de8b","namespace":"kuadrant-system","resourceVersion":"136139","uid":"ee3f9dc9-1592-4c60-ad25-28f37e30aca2"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["e8df393789582296e5c92b134371d265557ec06b8f530a82d60afcfdfc27de8b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-97995b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-97995b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:28:18Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:28:18Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["e8df393789582296e5c92b134371d265557ec06b8f530a82d60afcfdfc27de8b"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"e8df393789582296e5c92b134371d265557ec06b8f530a82d60afcfdfc27de8b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:32:30.123Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-02T22:28:18Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:30:32Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:30:32Z"}],"name":"9de3aeb3807fb0a63865dbb0cb6cac00d8acc0a489a9165c369fb079f576e503","namespace":"kuadrant-system","resourceVersion":"136082","uid":"da942a40-8d31-436f-aa98-6cc547215105"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["9de3aeb3807fb0a63865dbb0cb6cac00d8acc0a489a9165c369fb079f576e503"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-97995b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-97995b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:28:18Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:28:18Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["9de3aeb3807fb0a63865dbb0cb6cac00d8acc0a489a9165c369fb079f576e503"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"9de3aeb3807fb0a63865dbb0cb6cac00d8acc0a489a9165c369fb079f576e503\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:32:30.188Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-02T22:28:18Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:30:33Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:30:33Z"}],"name":"ed2994aa9701d5383eb1f805c9c89ccec8a7d0b77fb131a5ca742fa37c73a14b","namespace":"kuadrant-system","resourceVersion":"136131","uid":"07a7ade4-1218-4ff1-979e-f3f879d5fd42"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["ed2994aa9701d5383eb1f805c9c89ccec8a7d0b77fb131a5ca742fa37c73a14b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-97995b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-97995b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:28:18Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:28:18Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["ed2994aa9701d5383eb1f805c9c89ccec8a7d0b77fb131a5ca742fa37c73a14b"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"ed2994aa9701d5383eb1f805c9c89ccec8a7d0b77fb131a5ca742fa37c73a14b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:32:30.249Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-97995b","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-97995b#rule-3"},"creationTimestamp":"2026-11-02T21:54:07Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:30:33Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:30:33Z"}],"name":"abffb2b80b2e83749e48ad9bc9e2b132b4526ff5c2ddee7e3c63dcaac739cb58","namespace":"kuadrant-system","resourceVersion":"136107","uid":"3d148990-75e7-4b0f-8e0d-c5bae3e9e89e"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["abffb2b80b2e83749e48ad9bc9e2b132b4526ff5c2ddee7e3c63dcaac739cb58"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-97995b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-97995b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:30:33Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:30:33Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["abffb2b80b2e83749e48ad9bc9e2b132b4526ff5c2ddee7e3c63dcaac739cb58"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"abffb2b80b2e83749e48ad9bc9e2b132b4526ff5c2ddee7e3c63dcaac739cb58\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:32:30.312Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-97995b","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-97995b#rule-5"},"creationTimestamp":"2026-11-02T21:54:07Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:30:33Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:30:33Z"}],"name":"7acb8a78dba64f5ca2cb229b1a6a6e5100dfd1fe0185742cdf2493f937286eba","namespace":"kuadrant-system","resourceVersion":"136119","uid":"5111a353-6a37-4a0a-bfc1-cede96724922"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["7acb8a78dba64f5ca2cb229b1a6a6e5100dfd1fe0185742cdf2493f937286eba"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-97995b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-97995b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:03:45Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:03:45Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["7acb8a78dba64f5ca2cb229b1a6a6e5100dfd1fe0185742cdf2493f937286eba"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"7acb8a78dba64f5ca2cb229b1a6a6e5100dfd1fe0185742cdf2493f937286eba\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:32:30.376Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-97995b","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-97995b#rule-6"},"creationTimestamp":"2026-11-02T21:54:08Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:30:33Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:30:33Z"}],"name":"feca5257a3a136afa9ca4bb6226e83b9e72a014fd57c59db758c454f118180b2","namespace":"kuadrant-system","resourceVersion":"136104","uid":"723bca8b-1d42-4c5c-80dd-8efa3359954d"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["feca5257a3a136afa9ca4bb6226e83b9e72a014fd57c59db758c454f118180b2"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-97995b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-97995b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:54:08Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:54:08Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["feca5257a3a136afa9ca4bb6226e83b9e72a014fd57c59db758c454f118180b2"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"feca5257a3a136afa9ca4bb6226e83b9e72a014fd57c59db758c454f118180b2\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:32:30.437Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-02T22:28:17Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:30:33Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:30:33Z"}],"name":"7452998b42ae4dea69dddcc474a389491d89642261d52ffb8b2401267d4fd23a","namespace":"kuadrant-system","resourceVersion":"136091","uid":"e80192b0-4611-40ae-bcf8-327bc00f0bf9"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["7452998b42ae4dea69dddcc474a389491d89642261d52ffb8b2401267d4fd23a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-97995b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-97995b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:28:17Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:28:17Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["7452998b42ae4dea69dddcc474a389491d89642261d52ffb8b2401267d4fd23a"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"7452998b42ae4dea69dddcc474a389491d89642261d52ffb8b2401267d4fd23a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:32:30.499Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-97995b","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-97995b#rule-2"},"creationTimestamp":"2026-11-02T21:54:07Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:30:33Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:30:34Z"}],"name":"64610b2b1b14c01fb91d85773d211a6d8b173cb847914d22204a29dbf00c051b","namespace":"kuadrant-system","resourceVersion":"136135","uid":"fe278c19-5f46-42de-861c-4acd306183f5"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["64610b2b1b14c01fb91d85773d211a6d8b173cb847914d22204a29dbf00c051b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-97995b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-97995b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:54:08Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:54:08Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["64610b2b1b14c01fb91d85773d211a6d8b173cb847914d22204a29dbf00c051b"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"64610b2b1b14c01fb91d85773d211a6d8b173cb847914d22204a29dbf00c051b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:32:30.563Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-02T22:28:17Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:30:33Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:30:33Z"}],"name":"9eab454af32c78b750dd8a7f0f51e46caf9c5a6d593a08102680ec455da7f941","namespace":"kuadrant-system","resourceVersion":"136126","uid":"460e064d-0417-4c55-a097-b8fa8a21524b"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["9eab454af32c78b750dd8a7f0f51e46caf9c5a6d593a08102680ec455da7f941"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-97995b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-w3-97995b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:28:18Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:28:18Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["9eab454af32c78b750dd8a7f0f51e46caf9c5a6d593a08102680ec455da7f941"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"9eab454af32c78b750dd8a7f0f51e46caf9c5a6d593a08102680ec455da7f941\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:32:30.757Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-a-w3-97995b-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-a-w3-97995b-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:32:35.717Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","AuthPolicy","TokenRateLimitPolicy","Limitador","ConfigMap"],"eventTypes":{"update":27}}
{"level":"info","ts":"2026-11-02T22:32:35.895Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T22:32:36.257Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T22:32:36.365Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:32:36.365Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T22:32:36.855Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:32:36.858Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:32:36.858Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T22:32:36.868Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:32:36.868Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:32:36.872Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T22:32:36.934Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T22:32:38.131Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T22:32:38.131Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T22:32:45.168Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","Limitador","AuthPolicy","ConfigMap","EnvoyFilter"],"eventTypes":{"update":10}}
{"level":"info","ts":"2026-11-02T22:32:45.290Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T22:32:45.562Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T22:32:45.723Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:32:45.723Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T22:32:46.246Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:32:46.248Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:32:46.251Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T22:32:46.252Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:32:46.253Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:32:46.253Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-02T22:32:46.357Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:32:46.357Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T22:32:48.112Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T22:32:48.112Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T22:32:48.548Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthPolicy","TokenRateLimitPolicy"],"eventTypes":{"delete":1,"update":1}}
{"level":"info","ts":"2026-11-02T22:32:49.538Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:32:49.538Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:32:49.541Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T22:32:49.543Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:32:49.543Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-11-02T22:32:49.651Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:32:49.651Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T22:32:49.654Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-a1d751","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-a1d751#rule-3"},"creationTimestamp":"2026-11-02T21:56:05Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:31:30Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:31:30Z"}],"name":"45692dd8f986fdd88aa79ac3fde6dd1db9cc5cbaa9003e3fe62a6a019e62eb23","namespace":"kuadrant-system","resourceVersion":"137413","uid":"4081dca2-c716-4a09-bb0c-70e1b2deee2b"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["45692dd8f986fdd88aa79ac3fde6dd1db9cc5cbaa9003e3fe62a6a019e62eb23"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-a1d751.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-a1d751.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:56:05Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:56:05Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["45692dd8f986fdd88aa79ac3fde6dd1db9cc5cbaa9003e3fe62a6a019e62eb23"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"45692dd8f986fdd88aa79ac3fde6dd1db9cc5cbaa9003e3fe62a6a019e62eb23\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:32:49.717Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route","routeRule":"v1-messages-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route#v1-messages-path"},"creationTimestamp":"2026-11-02T22:29:53Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:31:30Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:31:30Z"}],"name":"9593847662171f6a7915c575284c678f049381a1160493b136f5566f61950b7f","namespace":"kuadrant-system","resourceVersion":"137418","uid":"5ddcce1b-8f52-4f65-b0af-9854d0a72bb3"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["9593847662171f6a7915c575284c678f049381a1160493b136f5566f61950b7f"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-a1d751.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-a1d751.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:29:53Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:29:53Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["9593847662171f6a7915c575284c678f049381a1160493b136f5566f61950b7f"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"9593847662171f6a7915c575284c678f049381a1160493b136f5566f61950b7f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:32:49.783Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route","routeRule":"v1-responses-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route#v1-responses-path"},"creationTimestamp":"2026-11-02T22:29:48Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:31:31Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:31:31Z"}],"name":"649eae6f669005f50b60c0a593259354e3a301dc59d4543707d5cc441ea578ed","namespace":"kuadrant-system","resourceVersion":"137439","uid":"1659e8a4-9489-4422-a662-49770e782732"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["649eae6f669005f50b60c0a593259354e3a301dc59d4543707d5cc441ea578ed"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-a1d751.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-a1d751.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:29:48Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:29:48Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["649eae6f669005f50b60c0a593259354e3a301dc59d4543707d5cc441ea578ed"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"649eae6f669005f50b60c0a593259354e3a301dc59d4543707d5cc441ea578ed\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:32:49.847Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route","routeRule":"v1-chat-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route#v1-chat-completions-publisher-path"},"creationTimestamp":"2026-11-02T22:29:54Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:31:31Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:31:31Z"}],"name":"b12682b1a488a7777939851e73abef802241193375e49cf718828297da8cb2c2","namespace":"kuadrant-system","resourceVersion":"137437","uid":"27517ca6-bf37-4f36-959e-6554caf66766"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["b12682b1a488a7777939851e73abef802241193375e49cf718828297da8cb2c2"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-a1d751.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-a1d751.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:29:55Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:29:55Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["b12682b1a488a7777939851e73abef802241193375e49cf718828297da8cb2c2"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"b12682b1a488a7777939851e73abef802241193375e49cf718828297da8cb2c2\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:32:49.908Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route","routeRule":"v1-publisher-path-catch-all","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route#v1-publisher-path-catch-all"},"creationTimestamp":"2026-11-02T22:29:46Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:31:31Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:31:32Z"}],"name":"30ba4ccdfea25c5f1ebce6f1499d547e64179efb055f133b434843801331620f","namespace":"kuadrant-system","resourceVersion":"137461","uid":"c32c56a9-c00e-41fe-bac7-cced4aa5c57d"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["30ba4ccdfea25c5f1ebce6f1499d547e64179efb055f133b434843801331620f"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-a1d751.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-a1d751.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:31:32Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:31:32Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["30ba4ccdfea25c5f1ebce6f1499d547e64179efb055f133b434843801331620f"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"30ba4ccdfea25c5f1ebce6f1499d547e64179efb055f133b434843801331620f\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:32:49.969Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-a1d751","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-a1d751#rule-4"},"creationTimestamp":"2026-11-02T21:56:05Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:31:30Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:31:30Z"}],"name":"54678c70bb572c34d6f6ed39e879f5beb1891cc61c4ee64dec6d9d3d0ed9c115","namespace":"kuadrant-system","resourceVersion":"137411","uid":"301b42cb-d54b-4cbe-b86c-8070a5ffb9d9"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["54678c70bb572c34d6f6ed39e879f5beb1891cc61c4ee64dec6d9d3d0ed9c115"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-a1d751.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-a1d751.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:31:30Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:31:30Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["54678c70bb572c34d6f6ed39e879f5beb1891cc61c4ee64dec6d9d3d0ed9c115"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"54678c70bb572c34d6f6ed39e879f5beb1891cc61c4ee64dec6d9d3d0ed9c115\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:32:50.030Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route","routeRule":"v1-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route#v1-model-routing"},"creationTimestamp":"2026-11-02T22:29:53Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:31:30Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:31:31Z"}],"name":"fd6cf0f18f21a2b21b869fb35862696f9d65f6371aaab90e03f0600806862db9","namespace":"kuadrant-system","resourceVersion":"137427","uid":"ac15f6a5-e2e7-4f88-a47d-1b81656344fe"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["fd6cf0f18f21a2b21b869fb35862696f9d65f6371aaab90e03f0600806862db9"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-a1d751.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-a1d751.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:29:53Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:29:53Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["fd6cf0f18f21a2b21b869fb35862696f9d65f6371aaab90e03f0600806862db9"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"fd6cf0f18f21a2b21b869fb35862696f9d65f6371aaab90e03f0600806862db9\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:32:50.082Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-shared-a-w3-97995b","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T21:54:08Z","generation":8,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"b9ce997b-e593-4e5a-96e1-266d4780e128\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:32:37Z"}],"name":"kuadrant-e2e-shared-a-w3-97995b","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-a-w3-97995b","uid":"b9ce997b-e593-4e5a-96e1-266d4780e128"}],"resourceVersion":"139141","uid":"657ba0c9-d22d-4183-a7c2-c392b8af6143"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9de3aeb3807fb0a63865dbb0cb6cac00d8acc0a489a9165c369fb079f576e503\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-97995b-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]}],\"name\":\"565ed9688c39a2be659eeac47153bce243f1c8cd7f37489c36111faa965f90ba\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w3-97995b/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9de3aeb3807fb0a63865dbb0cb6cac00d8acc0a489a9165c369fb079f576e503\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-97995b-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]}],\"name\":\"24e40cd6ec8b29ff4943e44b88c242cd569d7509cda070d913d0495e8477f7be\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w3-97995b/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9de3aeb3807fb0a63865dbb0cb6cac00d8acc0a489a9165c369fb079f576e503\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-97995b-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]}],\"name\":\"dff5b6d0f22c8d3d836e629a03ac80823cd7b71d41674ff051a4f4e90eb78fb5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w3-97995b/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9de3aeb3807fb0a63865dbb0cb6cac00d8acc0a489a9165c369fb079f576e503\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-97995b-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]}],\"name\":\"83d66bd4aa23be5045fa246f453ae1878d78270049b4d3d01b341ba95ce3e856\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w3-97995b/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9de3aeb3807fb0a63865dbb0cb6cac00d8acc0a489a9165c369fb079f576e503\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-97995b-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]}],\"name\":\"bda1edd31814a0488531fb4dd5adaaaec12b84667033b60d558374d0e7c81cc1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w3-97995b/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9de3aeb3807fb0a63865dbb0cb6cac00d8acc0a489a9165c369fb079f576e503\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-97995b-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]}],\"name\":\"9100031231cfd5633f8f00326357cc522f630decd55a02902ed5e43fd9af348e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w3-97995b/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9de3aeb3807fb0a63865dbb0cb6cac00d8acc0a489a9165c369fb079f576e503\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-97995b-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]}],\"name\":\"47aff0132ef320dec9d2a0610ae47e5c539557133ccffef66d9b8c7977778b1b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w3-97995b/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9de3aeb3807fb0a63865dbb0cb6cac00d8acc0a489a9165c369fb079f576e503\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-97995b-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]}],\"name\":\"e65650f912e0880ad9ecfeb29e81ce93ff5a69f6e6590dd0e3aa9f10617ae6e0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w3-97995b/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"feca5257a3a136afa9ca4bb6226e83b9e72a014fd57c59db758c454f118180b2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-97995b-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-97995b\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-97995b\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]}],\"name\":\"697447b051af365a79e3fa7acf7f1f6f64b9bd844855783e0433ae28eb9de042\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ed2994aa9701d5383eb1f805c9c89ccec8a7d0b77fb131a5ca742fa37c73a14b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-97995b-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]}],\"name\":\"68031bfda00da44546eee02421b29d0de6657cae50508d670e166e45419111b6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-a-w3-97995b/models/facebook/opt-125m/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7a7d519d00fa2e97e5f400a44c82c2e18e0c409b5a9afbb4d9d294659141b972\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-97995b-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]}],\"name\":\"1f4dd462af4c99a7e3d0cad047fd4117b9bd33823c153b2c67e8632589d2c31b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-a-w3-97995b/models/facebook/opt-125m/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8ce2cbfc67213d98707c4ceb948a0bc47d762da419d2877baa87368e52adeb7b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-97995b-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]}],\"name\":\"88b5ba94e6e26d62f29ceb39fd1b3b5f62ed1825296f84afbe67f94f7f0a48dc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-a-w3-97995b/models/facebook/opt-125m/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5727d2fd0019c6bfa39a149d096736a5b6470b2cc5bf597b76fa7b9fb568b099\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-97995b-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]}],\"name\":\"b11a892c6f8134c4af7069b5663a488957a65d1ec274482c603b23c972a6df5a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-a-w3-97995b/models/facebook/opt-125m/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"29e64f93e9761c53580c183981bf81fb67b5649bbe34948dec541fd02a8b9939\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-97995b-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]}],\"name\":\"12515b64ab6f198e54b3adb168893377e22bba966b25981ed8754bcbd19ff7fd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7452998b42ae4dea69dddcc474a389491d89642261d52ffb8b2401267d4fd23a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-97995b-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]}],\"name\":\"002be0fead060e19f100ac56b16479b833d1a76a36c178ab0ac6bee1e117b54e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9eab454af32c78b750dd8a7f0f51e46caf9c5a6d593a08102680ec455da7f941\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-97995b-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]}],\"name\":\"8957cb0ea5616db4e85fa3c4d240c34cacf6c78c2b5adece5eea327c50303d2f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-a-w3-97995b/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3ea0c1283049b0b2e2ae47d4fdbeeb04aae52608076de47123cc9c6c1a7b685a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-97995b-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]}],\"name\":\"08adfddc8873dff06bcb253386ec97029daca63cd5dab407c52eed6eeb523f41\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ddd153ffe5f2008b5c0d76c6d4ced2a6aaaea3fc84c2bb12b6f75d72f6ffdcf8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-97995b-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]}],\"name\":\"ad83cbcfed1b1916836effabcdfddfceeadeb1c44756049aa621fa63988216cd\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"96a831079b0b478b2f950e00a3b6488601f3db32cc01341caf7b7679a46be3b8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-97995b-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]}],\"name\":\"a523abbb0fd98c9040af18b7a86d4b2d847b6dcfcf96781cd952abb78d94bda2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"64610b2b1b14c01fb91d85773d211a6d8b173cb847914d22204a29dbf00c051b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-97995b-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-97995b\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-97995b\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]}],\"name\":\"ab3f8e403d48e2edf0d20cf1af9316112053ce238e3ab9db5309e4506ca81358\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7acb8a78dba64f5ca2cb229b1a6a6e5100dfd1fe0185742cdf2493f937286eba\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-97995b-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-97995b\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-97995b\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]}],\"name\":\"277f6eb1de4fbfe33e49087e7995e2fc70745c603dfb4e7bd0387ba87a05fa73\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"abffb2b80b2e83749e48ad9bc9e2b132b4526ff5c2ddee7e3c63dcaac739cb58\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-97995b-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-97995b\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-97995b\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]}],\"name\":\"9fc807dc86717cc414f321c16b0d44d999a6c047d0871e8e85085f494ab58344\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"861bd69371a3568d3786b56a91d3af9c85fd73ef3e549606a38eed24c8a99b89\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-97995b-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-97995b\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-97995b\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]}],\"name\":\"1abcc31fbef3280fc20850d49e96774344d45c72d9af2ad2be2a524b9041e48d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6de91d16ed05414ab83195af7a0e61dc3b464cde05b3f5b5c1cb41079af7d577\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-97995b-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-97995b\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-97995b\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]}],\"name\":\"4a5b0c3ba4d080fdf6969433dffaaa078a2cac0527e231c6975641dbc9a0fa7c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e8df393789582296e5c92b134371d265557ec06b8f530a82d60afcfdfc27de8b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-97995b-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-a-w3-97995b/sub-test-model-97995b-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]}],\"name\":\"fd8d56463d64bf50329ae79335828423b5b89f38f1a76f7397ec15a3abcc8fe1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-w3-97995b/models/facebook/opt-125m')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-shared-a-w3-97995b"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-shared-a-w3-97995b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:32:50.104Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route","routeRule":"v1-catch-all-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route#v1-catch-all-path"},"creationTimestamp":"2026-11-02T22:29:46Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:31:30Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:31:30Z"}],"name":"1db7db8718ec954ecf16b0d35140cb8a1c89f0173590ed683bbb861f8380c6f1","namespace":"kuadrant-system","resourceVersion":"137399","uid":"e75ed44a-3411-483b-856b-2178ec0c304e"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["1db7db8718ec954ecf16b0d35140cb8a1c89f0173590ed683bbb861f8380c6f1"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-a1d751.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-a1d751.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:29:46Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:29:46Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["1db7db8718ec954ecf16b0d35140cb8a1c89f0173590ed683bbb861f8380c6f1"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"1db7db8718ec954ecf16b0d35140cb8a1c89f0173590ed683bbb861f8380c6f1\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:32:50.165Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route","routeRule":"v1-completions-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route#v1-completions-publisher-path"},"creationTimestamp":"2026-11-02T22:29:52Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:31:30Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:31:31Z"}],"name":"8023c7d6d2d950131dbdfdd9ebb5c95e52dfae5d4dfaf93b8b4ae57eb45d2bcf","namespace":"kuadrant-system","resourceVersion":"137425","uid":"0c9b904d-42ea-44d3-b939-698516051890"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["8023c7d6d2d950131dbdfdd9ebb5c95e52dfae5d4dfaf93b8b4ae57eb45d2bcf"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-a1d751.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-a1d751.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:29:52Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:29:52Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["8023c7d6d2d950131dbdfdd9ebb5c95e52dfae5d4dfaf93b8b4ae57eb45d2bcf"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"8023c7d6d2d950131dbdfdd9ebb5c95e52dfae5d4dfaf93b8b4ae57eb45d2bcf\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:32:50.227Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-a1d751","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-a1d751#rule-5"},"creationTimestamp":"2026-11-02T21:56:04Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:31:30Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:31:30Z"}],"name":"3e1c5c0bad150c663f60d190f6837f1f47449a9fb1dd0f8b15a5a049a5785836","namespace":"kuadrant-system","resourceVersion":"137416","uid":"a098d031-ef40-45f0-9409-028aa66f8120"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["3e1c5c0bad150c663f60d190f6837f1f47449a9fb1dd0f8b15a5a049a5785836"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-a1d751.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-a1d751.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:31:30Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:31:30Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["3e1c5c0bad150c663f60d190f6837f1f47449a9fb1dd0f8b15a5a049a5785836"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"3e1c5c0bad150c663f60d190f6837f1f47449a9fb1dd0f8b15a5a049a5785836\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:32:50.289Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route","routeRule":"v1-chat-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route#v1-chat-completions-path"},"creationTimestamp":"2026-11-02T22:29:46Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:31:31Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:31:31Z"}],"name":"f37aa79ec4a1199a49abd3f63dd4c9505bbd959bba56de7e4c8dad6c144af205","namespace":"kuadrant-system","resourceVersion":"137435","uid":"cc61ff96-7880-4efb-b734-af72e601c73b"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f37aa79ec4a1199a49abd3f63dd4c9505bbd959bba56de7e4c8dad6c144af205"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-a1d751.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-a1d751.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:29:46Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:29:46Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["f37aa79ec4a1199a49abd3f63dd4c9505bbd959bba56de7e4c8dad6c144af205"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"f37aa79ec4a1199a49abd3f63dd4c9505bbd959bba56de7e4c8dad6c144af205\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:32:50.350Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route","routeRule":"v1-messages-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route#v1-messages-publisher-path"},"creationTimestamp":"2026-11-02T22:29:51Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:31:30Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:31:30Z"}],"name":"f1aeb859c1579aea92c81f985aec98129102bab0482185da8dd5e38bfdab1f31","namespace":"kuadrant-system","resourceVersion":"137421","uid":"687b994a-e252-4e05-bb39-9d0190b6bd8d"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["f1aeb859c1579aea92c81f985aec98129102bab0482185da8dd5e38bfdab1f31"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-a1d751.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-a1d751.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:29:51Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:29:51Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["f1aeb859c1579aea92c81f985aec98129102bab0482185da8dd5e38bfdab1f31"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"f1aeb859c1579aea92c81f985aec98129102bab0482185da8dd5e38bfdab1f31\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:32:50.411Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route","routeRule":"v1-catch-all-model-routing","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route#v1-catch-all-model-routing"},"creationTimestamp":"2026-11-02T22:29:48Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:31:31Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:31:31Z"}],"name":"0b94d900a5cdf5c531935a5db6b720c905f8b8e2c62caaf31136dacaca42afc8","namespace":"kuadrant-system","resourceVersion":"137445","uid":"2b7d9280-1e34-48ff-9da9-f0084930785a"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["0b94d900a5cdf5c531935a5db6b720c905f8b8e2c62caaf31136dacaca42afc8"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-a1d751.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-a1d751.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:29:48Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:29:48Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["0b94d900a5cdf5c531935a5db6b720c905f8b8e2c62caaf31136dacaca42afc8"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"0b94d900a5cdf5c531935a5db6b720c905f8b8e2c62caaf31136dacaca42afc8\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:32:50.474Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route","routeRule":"v1-completions-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route#v1-completions-path"},"creationTimestamp":"2026-11-02T22:29:54Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:31:30Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:31:31Z"}],"name":"d382a9a5e68a63cf824ae7421c24f285af4eba4b4e83a5df42b6213da00221b7","namespace":"kuadrant-system","resourceVersion":"137430","uid":"6966b4b3-91dd-4c59-b73c-202cddcae580"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["d382a9a5e68a63cf824ae7421c24f285af4eba4b4e83a5df42b6213da00221b7"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-a1d751.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-a1d751.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:29:55Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:29:55Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["d382a9a5e68a63cf824ae7421c24f285af4eba4b4e83a5df42b6213da00221b7"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"d382a9a5e68a63cf824ae7421c24f285af4eba4b4e83a5df42b6213da00221b7\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:32:50.538Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route","routeRule":"v1-responses-publisher-path","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route#v1-responses-publisher-path"},"creationTimestamp":"2026-11-02T22:29:53Z","generation":2,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:31:31Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:31:31Z"}],"name":"37b98d0f2b528bd5adf68cd626d0bcbb32ae39493dca90dfc95c91c903cb7a9b","namespace":"kuadrant-system","resourceVersion":"137444","uid":"d6bfae05-608e-41c5-af37-c847d6c59d72"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["37b98d0f2b528bd5adf68cd626d0bcbb32ae39493dca90dfc95c91c903cb7a9b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-a1d751.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-a1d751.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:29:53Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:29:53Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["37b98d0f2b528bd5adf68cd626d0bcbb32ae39493dca90dfc95c91c903cb7a9b"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"37b98d0f2b528bd5adf68cd626d0bcbb32ae39493dca90dfc95c91c903cb7a9b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:32:50.600Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-a1d751","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-a1d751#rule-6"},"creationTimestamp":"2026-11-02T21:56:04Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:31:31Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:31:31Z"}],"name":"e5c3e46343f841520ecdb272dac135e882471a34b6fbd1dfe102bb1535df2522","namespace":"kuadrant-system","resourceVersion":"137433","uid":"1e0502b2-6db1-4a4d-bfe1-c79135d9ea24"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["e5c3e46343f841520ecdb272dac135e882471a34b6fbd1dfe102bb1535df2522"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-a1d751.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-a1d751.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:56:05Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:56:05Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["e5c3e46343f841520ecdb272dac135e882471a34b6fbd1dfe102bb1535df2522"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"e5c3e46343f841520ecdb272dac135e882471a34b6fbd1dfe102bb1535df2522\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:32:50.662Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-a1d751","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-a1d751#rule-1"},"creationTimestamp":"2026-11-02T21:56:04Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:31:30Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:31:30Z"}],"name":"afffab50bac2693d1a47a43cedfba11a37634e625c51a64f41e14d037dc9bc9a","namespace":"kuadrant-system","resourceVersion":"137404","uid":"c0be45a3-ed76-4af8-9dbb-733e24ec7512"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["afffab50bac2693d1a47a43cedfba11a37634e625c51a64f41e14d037dc9bc9a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-a1d751.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-a1d751.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T22:01:40Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T22:01:40Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["afffab50bac2693d1a47a43cedfba11a37634e625c51a64f41e14d037dc9bc9a"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"afffab50bac2693d1a47a43cedfba11a37634e625c51a64f41e14d037dc9bc9a\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:32:50.724Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to update authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-a1d751","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-a1d751#rule-2"},"creationTimestamp":"2026-11-02T21:56:04Z","generation":4,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:conditions":{},"f:summary":{".":{},"f:festivalWristbandEnabled":{},"f:hostsReady":{},"f:numAuthorizationPolicies":{},"f:numHostsReady":{},"f:numIdentitySources":{},"f:numMetadataSources":{},"f:numResponseItems":{},"f:ready":{}}}},"manager":"authorino","operation":"Update","subresource":"status","time":"2026-11-02T22:31:30Z"},{"apiVersion":"authorino.kuadrant.io/v1beta3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:HTTPRouteRule.gateway.networking.k8s.io":{}},"f:labels":{".":{},"f:kuadrant.io/auth":{},"f:kuadrant.io/managed":{}}},"f:spec":{".":{},"f:authentication":{".":{},"f:api-keys":{".":{},"f:credentials":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:openshift-identities":{".":{},"f:credentials":{},"f:kubernetesTokenReview":{".":{},"f:audiences":{}},"f:metrics":{},"f:priority":{}}},"f:authorization":{".":{},"f:auth-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{}},"f:deny-api-key-management":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{},"f:when":{}},"f:deny-client-identity-headers":{".":{},"f:metrics":{},"f:patternMatching":{".":{},"f:patterns":{}},"f:priority":{}},"f:guardrail-checks-known":{".":{},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:require-group-membership":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}},"f:subscription-valid":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:metrics":{},"f:opa":{".":{},"f:allValues":{},"f:rego":{}},"f:priority":{},"f:when":{}}},"f:hosts":{},"f:metadata":{".":{},"f:apiKeyValidation":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:subscription-info":{".":{},"f:cache":{".":{},"f:key":{".":{},"f:selector":{}},"f:ttl":{}},"f:http":{".":{},"f:body":{".":{},"f:expression":{}},"f:contentType":{},"f:credentials":{},"f:method":{},"f:url":{}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:response":{".":{},"f:success":{".":{},"f:dynamicMetadata":{".":{},"f:identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:groups":{".":{},"f:expression":{}},"f:groups_str":{".":{},"f:expression":{}},"f:keyId":{".":{},"f:expression":{}},"f:keyName":{".":{},"f:expression":{}},"f:selected_subscription":{".":{},"f:expression":{}},"f:selected_subscription_id":{".":{},"f:expression":{}},"f:selected_subscription_key":{".":{},"f:expression":{}},"f:subscription_error":{".":{},"f:expression":{}},"f:subscription_error_message":{".":{},"f:expression":{}},"f:subscription_info":{".":{},"f:expression":{}},"f:userid":{".":{},"f:expression":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}}},"f:headers":{".":{},"f:X-MaaS-Cost-Center":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Group-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Identity":{".":{},"f:json":{".":{},"f:properties":{".":{},"f:claims":{".":{},"f:expression":{}},"f:source":{".":{},"f:value":{}}}},"f:metrics":{},"f:priority":{},"f:when":{}},"f:X-MaaS-KeyName":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Subscription-Rate-Limit-Id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username":{".":{},"f:metrics":{},"f:plain":{".":{},"f:selector":{}},"f:priority":{},"f:when":{}},"f:X-MaaS-Username-Token":{".":{},"f:key":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{},"f:when":{}},"f:x-gateway-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-gateway-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-fairness-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-llm-d-inference-objective":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}},"f:x-maas-organization-id":{".":{},"f:metrics":{},"f:plain":{".":{},"f:expression":{}},"f:priority":{}}}},"f:unauthenticated":{".":{},"f:body":{".":{},"f:value":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}}},"f:message":{".":{},"f:value":{}}},"f:unauthorized":{".":{},"f:body":{".":{},"f:expression":{}},"f:code":{},"f:headers":{".":{},"f:content-type":{".":{},"f:value":{}},"f:x-ext-auth-reason":{".":{},"f:expression":{}}}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:31:30Z"}],"name":"9ed0ddd0e1ea68b359e326fba62a585324a528f116f0bf6d3f085360f79ed877","namespace":"kuadrant-system","resourceVersion":"137423","uid":"7d869b8f-a359-4202-a87e-3038dfe25980"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer ****"}]},"openshift-identities":{"credentials":{},"kubernetesTokenReview":{"audiences":["https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/53365"]},"priority":2}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer \", \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"deny-api-key-management":{"patternMatching":{"patterns":[{"predicate":"false"}]},"when":[{"predicate":"(request.headers.authorization.matches(\"^Bearer ****\")) && (request.path == \"/maas-api/v1/api-keys\" || request.path.startsWith(\"/maas-api/v1/api-keys/\"))"}]},"deny-client-identity-headers":{"patternMatching":{"patterns":[{"predicate":"!(\"x-maas-username\" in request.headers)"},{"predicate":"!(\"x-maas-group\" in request.headers)"},{"predicate":"!(\"x-maas-keyname\" in request.headers)"},{"predicate":"!(\"x-maas-subscription-rate-limit-id\" in request.headers)"},{"predicate":"!(\"x-maas-organization-id\" in request.headers)"},{"predicate":"!(\"x-maas-cost-center\" in request.headers)"},{"predicate":"!(\"x-maas-identity\" in request.headers)"},{"predicate":"!(\"x-maas-admin-scope\" in request.headers)"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-aigateway-guardrail-\"))"},{"predicate":"request.headers.all(name, !name.startsWith(\"x-grid-\"))"}]}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata[\"subscription-info\"], \"accessAllowed\", false) == true\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"hosts":["9ed0ddd0e1ea68b359e326fba62a585324a528f116f0bf6d3f085360f79ed877"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"auth.identity.replace(\"Bearer \", \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": auth.identity.replace(\"Bearer \", \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-a1d751.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"auth.identity.matches(\"^(Bearer ****\")"}]},"subscription-info":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : [])),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-w3-a1d751.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.iss) ? (has(auth.identity.groups) && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.groups : []) : (has(auth.identity.user.groups) && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? auth.identity.user.groups : []))).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_id":{"expression":"has(auth.metadata[\"subscription-info\"].rateLimitId) ? auth.metadata[\"subscription-info\"].rateLimitId : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (has(auth.metadata[\"subscription-info\"].resolvedModel) && auth.metadata[\"subscription-info\"].resolvedModel != \"\" ? auth.metadata[\"subscription-info\"].resolvedModel : (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"headers":{"X-MaaS-Cost-Center":{"plain":{"expression":"auth.metadata[\"subscription-info\"].costCenter","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].costCenter) && auth.metadata[\"subscription-info\"].costCenter != \"\""}]},"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Group-Token":{"key":"X-MaaS-Group","plain":{"expression":"has(auth.identity.iss) ? (has(auth.identity.groups) && size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 && auth.identity.user.groups.all(g, g.matches('^[A-Za-z0-9:#._/ -]+$')) ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"X-MaaS-Identity":{"json":{"properties":{"claims":{"expression":"{\"iss\": auth.identity.iss, \"sub\": auth.identity.sub, \"aud\": auth.identity.aud, \"azp\": auth.identity.azp, \"name\": has(auth.identity.name) ? auth.identity.name : \"\", \"given_name\": has(auth.identity.given_name) ? auth.identity.given_name : \"\", \"family_name\": has(auth.identity.family_name) ? auth.identity.family_name : \"\", \"preferred_username\": has(auth.identity.preferred_username) ? auth.identity.preferred_username : \"\", \"email\": has(auth.identity.email) ? auth.identity.email : \"\", \"groups\": has(auth.identity.groups) ? auth.identity.groups : [], \"https://redhat.com/maas/orgs\": \"https://redhat.com/maas/orgs\" in auth.identity ? auth.identity[\"https://redhat.com/maas/orgs\"] : []}","value":null},"source":{"value":"oidc"}}},"when":[{"predicate":"false"}]},"X-MaaS-KeyName":{"key":"x-maas-keyname","plain":{"expression":"auth.metadata.apiKeyValidation.keyName","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Subscription":{"plain":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\""}]},"X-MaaS-Subscription-Rate-Limit-Id":{"plain":{"expression":"auth.metadata[\"subscription-info\"].rateLimitId","value":null},"when":[{"predicate":"has(auth.metadata[\"subscription-info\"].rateLimitId) && auth.metadata[\"subscription-info\"].rateLimitId != \"\""}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer ****\")"}]},"X-MaaS-Username-Token":{"key":"X-MaaS-Username","plain":{"expression":"has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer ****\")"}]},"x-gateway-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-gateway-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-llm-d-inference-fairness-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].fairnessId) ? auth.metadata[\"subscription-info\"].fairnessId : \"\"","value":null}},"x-llm-d-inference-objective":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].objective) ? auth.metadata[\"subscription-info\"].objective : \"\"","value":null}},"x-maas-organization-id":{"plain":{"expression":"has(auth.metadata) && \"subscription-info\" in auth.metadata && has(auth.metadata[\"subscription-info\"].organizationId) ? auth.metadata[\"subscription-info\"].organizationId : \"\"","value":null}}}},"unauthenticated":{"body":{"value":"{\"error\":{\"message\":\"Authentication required\",\"type\":\"authentication_error\",\"code\":401}}"},"code":401,"headers":{"content-type":{"value":"application/json"}},"message":{"value":"Authentication required"}},"unauthorized":{"body":{"expression":"'{\"error\":{\"message\":\"' + (has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"').replace('\\n', '\\\\n').replace('\\r', '\\\\r').replace('\\t', '\\\\t') : \"Access denied\") + '\",\"type\":\"authorization_error\",\"code\":403}}'","value":null},"code":403,"headers":{"content-type":{"value":"application/json"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"conditions":[{"lastTransitionTime":"2026-11-02T21:56:05Z","reason":"HostsLinked","status":"True","type":"Available"},{"lastTransitionTime":"2026-11-02T21:56:05Z","reason":"Reconciled","status":"True","type":"Ready"}],"summary":{"festivalWristbandEnabled":false,"hostsReady":["9ed0ddd0e1ea68b359e326fba62a585324a528f116f0bf6d3f085360f79ed877"],"numAuthorizationPolicies":6,"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numResponseItems":15,"ready":true}}},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"9ed0ddd0e1ea68b359e326fba62a585324a528f116f0bf6d3f085360f79ed877\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:32:50.850Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-b-w3-a1d751-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-b-w3-a1d751-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:32:51.131Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-a-w3-97995b","namespace":"openshift-ingress","uid":"9405e4ea-22ff-4c46-bbc0-f492e0e403dc","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-a-w3-97995b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:32:51.320Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"sub-test-model-97995b-kserve-route","namespace":"ai-tenant-e2e-shared-a-w3-97995b","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"sub-test-model-97995b-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:32:58.233Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","Limitador","ConfigMap","TokenRateLimitPolicy","AuthPolicy","HTTPRoute","EnvoyFilter"],"eventTypes":{"update":24}}
{"level":"info","ts":"2026-11-02T22:32:58.302Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T22:32:58.636Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T22:32:58.823Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:32:58.823Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T22:32:59.252Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:32:59.254Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:32:59.254Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T22:32:59.263Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:32:59.263Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:32:59.266Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T22:32:59.338Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T22:33:00.376Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T22:33:00.376Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T22:33:00.809Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy"],"eventTypes":{"update":1}}
{"level":"info","ts":"2026-11-02T22:33:01.734Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:33:01.736Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:33:01.736Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T22:33:01.736Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"error","ts":"2026-11-02T22:33:01.793Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:33:01.793Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T22:33:02.416Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-shared-b-w3-a1d751","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T21:56:05Z","generation":6,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"b4f450f8-3314-4538-8376-5bc4682213ba\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:32:08Z"}],"name":"kuadrant-e2e-shared-b-w3-a1d751","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-b-w3-a1d751","uid":"b4f450f8-3314-4538-8376-5bc4682213ba"}],"resourceVersion":"138522","uid":"f193cccb-926b-43ad-b8dd-0f35a235191b"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fd6cf0f18f21a2b21b869fb35862696f9d65f6371aaab90e03f0600806862db9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__6dd28790\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"fdfe5ac0855997fa\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-a1d751/maas-trlp-sub-test-model-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__6dd28790\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"fdfe5ac0855997fa\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-a1d751/maas-trlp-sub-test-model-a1d751\"]}],\"name\":\"b4f5dc508462935c59141642eb690c679074d18c598722aa3348703ebb49251c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w3-a1d751/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fd6cf0f18f21a2b21b869fb35862696f9d65f6371aaab90e03f0600806862db9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__6dd28790\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"fdfe5ac0855997fa\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-a1d751/maas-trlp-sub-test-model-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__6dd28790\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"fdfe5ac0855997fa\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-a1d751/maas-trlp-sub-test-model-a1d751\"]}],\"name\":\"ea40f06b359e26e9f95fc2c8e156fb14aec66b3738478bbb9e9e9110be4baf61\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w3-a1d751/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fd6cf0f18f21a2b21b869fb35862696f9d65f6371aaab90e03f0600806862db9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__6dd28790\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"fdfe5ac0855997fa\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-a1d751/maas-trlp-sub-test-model-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__6dd28790\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"fdfe5ac0855997fa\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-a1d751/maas-trlp-sub-test-model-a1d751\"]}],\"name\":\"af1a36d8b543a16bd969a4908547157c03ad6f16a3e06fa7ba81f634b8ac2571\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w3-a1d751/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fd6cf0f18f21a2b21b869fb35862696f9d65f6371aaab90e03f0600806862db9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__6dd28790\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"fdfe5ac0855997fa\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-a1d751/maas-trlp-sub-test-model-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__6dd28790\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"fdfe5ac0855997fa\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-a1d751/maas-trlp-sub-test-model-a1d751\"]}],\"name\":\"b00bb8d8f42b0a1f4760bf5a6416af2cef0f8f8103c38765d8a912de36d2ba3e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w3-a1d751/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fd6cf0f18f21a2b21b869fb35862696f9d65f6371aaab90e03f0600806862db9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__6dd28790\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"fdfe5ac0855997fa\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-a1d751/maas-trlp-sub-test-model-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__6dd28790\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"fdfe5ac0855997fa\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-a1d751/maas-trlp-sub-test-model-a1d751\"]}],\"name\":\"bcb4ee38c297fd81d1ba36ca91c6f43533ae03bcf32de74dee7773bb5b2cb53b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w3-a1d751/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fd6cf0f18f21a2b21b869fb35862696f9d65f6371aaab90e03f0600806862db9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__6dd28790\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"fdfe5ac0855997fa\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-a1d751/maas-trlp-sub-test-model-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__6dd28790\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"fdfe5ac0855997fa\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-a1d751/maas-trlp-sub-test-model-a1d751\"]}],\"name\":\"99d79bd58a3e5e09b5c11b892fea548b7b9173be1aa16ee4751b8ebe6ee5e1f6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w3-a1d751/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fd6cf0f18f21a2b21b869fb35862696f9d65f6371aaab90e03f0600806862db9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__6dd28790\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"fdfe5ac0855997fa\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-a1d751/maas-trlp-sub-test-model-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__6dd28790\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"fdfe5ac0855997fa\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-a1d751/maas-trlp-sub-test-model-a1d751\"]}],\"name\":\"5379ce2935360da6445a4624ebb0fffb1d4681ffb42315b2e61e5399dfb808fb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w3-a1d751/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fd6cf0f18f21a2b21b869fb35862696f9d65f6371aaab90e03f0600806862db9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__6dd28790\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"fdfe5ac0855997fa\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-a1d751/maas-trlp-sub-test-model-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__6dd28790\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"fdfe5ac0855997fa\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-a1d751/maas-trlp-sub-test-model-a1d751\"]}],\"name\":\"24a78e9d4e679465e27f213ebfa01f64bc96922ad78fdc53cff071ac5b6a81dc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w3-a1d751/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e5c3e46343f841520ecdb272dac135e882471a34b6fbd1dfe102bb1535df2522\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-a1d751\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-a1d751\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]}],\"name\":\"4309e9a901e490b5923f5e9c24699d2e857cbb6dc20e790330c076d768763498\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b12682b1a488a7777939851e73abef802241193375e49cf718828297da8cb2c2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__6dd28790\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"fdfe5ac0855997fa\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-a1d751/maas-trlp-sub-test-model-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__6dd28790\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"fdfe5ac0855997fa\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-a1d751/maas-trlp-sub-test-model-a1d751\"]}],\"name\":\"1640fd99e1d2b5698216be3f60d3664af2cabf1f24f0bb1fa79f6e2fe9f23ef6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w3-a1d751/models/facebook/opt-125m/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8023c7d6d2d950131dbdfdd9ebb5c95e52dfae5d4dfaf93b8b4ae57eb45d2bcf\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__6dd28790\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"fdfe5ac0855997fa\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-a1d751/maas-trlp-sub-test-model-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__6dd28790\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"fdfe5ac0855997fa\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-a1d751/maas-trlp-sub-test-model-a1d751\"]}],\"name\":\"b054987892c955e1d106dccbc458226a6328c226c09a2075550d9a35d2d6e3a4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w3-a1d751/models/facebook/opt-125m/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"37b98d0f2b528bd5adf68cd626d0bcbb32ae39493dca90dfc95c91c903cb7a9b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__6dd28790\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"fdfe5ac0855997fa\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-a1d751/maas-trlp-sub-test-model-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__6dd28790\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"fdfe5ac0855997fa\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-a1d751/maas-trlp-sub-test-model-a1d751\"]}],\"name\":\"aa0eb8235785812dd27690bb9a938fe5b32045914dff123e9378cf1bf90996a6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w3-a1d751/models/facebook/opt-125m/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f1aeb859c1579aea92c81f985aec98129102bab0482185da8dd5e38bfdab1f31\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__6dd28790\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"fdfe5ac0855997fa\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-a1d751/maas-trlp-sub-test-model-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__6dd28790\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"fdfe5ac0855997fa\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-a1d751/maas-trlp-sub-test-model-a1d751\"]}],\"name\":\"6aa791d210e1f26083ea6e82b46ed8801291f17c0406c9508e404ae9421e045d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w3-a1d751/models/facebook/opt-125m/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f37aa79ec4a1199a49abd3f63dd4c9505bbd959bba56de7e4c8dad6c144af205\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__6dd28790\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"fdfe5ac0855997fa\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-a1d751/maas-trlp-sub-test-model-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__6dd28790\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"fdfe5ac0855997fa\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-a1d751/maas-trlp-sub-test-model-a1d751\"]}],\"name\":\"ee86408dcc7c307eeb7e62f03ad79696c1aed2e21d972e66f5a46e737a42c8e1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d382a9a5e68a63cf824ae7421c24f285af4eba4b4e83a5df42b6213da00221b7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__6dd28790\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"fdfe5ac0855997fa\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-a1d751/maas-trlp-sub-test-model-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__6dd28790\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"fdfe5ac0855997fa\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-a1d751/maas-trlp-sub-test-model-a1d751\"]}],\"name\":\"271e920a6bd7d30bded719b07e051f15b025a118a8675eaf26d6baadbe4d283b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"30ba4ccdfea25c5f1ebce6f1499d547e64179efb055f133b434843801331620f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__6dd28790\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"fdfe5ac0855997fa\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-a1d751/maas-trlp-sub-test-model-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__6dd28790\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"fdfe5ac0855997fa\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-a1d751/maas-trlp-sub-test-model-a1d751\"]}],\"name\":\"00d9079f672c491f076316c8c4b048c87702c283bdebf80e975d415f1df6d2ee\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w3-a1d751/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"649eae6f669005f50b60c0a593259354e3a301dc59d4543707d5cc441ea578ed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__6dd28790\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"fdfe5ac0855997fa\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-a1d751/maas-trlp-sub-test-model-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__6dd28790\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"fdfe5ac0855997fa\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-a1d751/maas-trlp-sub-test-model-a1d751\"]}],\"name\":\"e0a0969004be7bfb9d1683a46a3327aa5144255b817ecc80e408763e6c41f64c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9593847662171f6a7915c575284c678f049381a1160493b136f5566f61950b7f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__6dd28790\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"fdfe5ac0855997fa\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-a1d751/maas-trlp-sub-test-model-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__6dd28790\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"fdfe5ac0855997fa\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-a1d751/maas-trlp-sub-test-model-a1d751\"]}],\"name\":\"6c679088602dd9ea796b046684f1d25f72a7bc96a91c5c604003243da035aa90\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1db7db8718ec954ecf16b0d35140cb8a1c89f0173590ed683bbb861f8380c6f1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__6dd28790\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"fdfe5ac0855997fa\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-a1d751/maas-trlp-sub-test-model-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__6dd28790\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"fdfe5ac0855997fa\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-a1d751/maas-trlp-sub-test-model-a1d751\"]}],\"name\":\"fe031e9e78874e208226b8d363abc95f5f91493550d1e9fbb78ca7091c5e267f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9ed0ddd0e1ea68b359e326fba62a585324a528f116f0bf6d3f085360f79ed877\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-a1d751\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-a1d751\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]}],\"name\":\"7017ce065aadb4ec3cd123f3de90d4b298418b4cb0d6f2943ce905f0b6fa1973\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3e1c5c0bad150c663f60d190f6837f1f47449a9fb1dd0f8b15a5a049a5785836\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-a1d751\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-a1d751\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]}],\"name\":\"4b9629b6a0dc02e424027c37c202c248a532fff8b8cebe3888b35f432e4237a0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"45692dd8f986fdd88aa79ac3fde6dd1db9cc5cbaa9003e3fe62a6a019e62eb23\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-a1d751\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-a1d751\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]}],\"name\":\"8762492ec17ca2d96d70f7661ea91bc6dd105b52e7f7927e5f87422dad69cdf1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"54678c70bb572c34d6f6ed39e879f5beb1891cc61c4ee64dec6d9d3d0ed9c115\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-a1d751\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-a1d751\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]}],\"name\":\"6e67ae0eecb22274f490861a930e85a9d3cf386bb0d1179f4c67c60e1ed8eb2c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"afffab50bac2693d1a47a43cedfba11a37634e625c51a64f41e14d037dc9bc9a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-a1d751\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-a1d751\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]}],\"name\":\"5df45cb848791fb94dcb78fb658eb490c82f995f9d95444c8a546b5cddad1a1b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0b94d900a5cdf5c531935a5db6b720c905f8b8e2c62caaf31136dacaca42afc8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__6dd28790\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"fdfe5ac0855997fa\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-a1d751/maas-trlp-sub-test-model-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_750_per_1m__6dd28790\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"fdfe5ac0855997fa\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-w3-a1d751/maas-trlp-sub-test-model-a1d751\"]}],\"name\":\"95a9fdd052d64ba5b84de723c48968a3ca284a89256c7757f5ce2db19a3f11c6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w3-a1d751/models/facebook/opt-125m')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-shared-b-w3-a1d751"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-shared-b-w3-a1d751\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:33:02.825Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-sub-test-model-a1d751","namespace":"ai-tenant-e2e-shared-b-w3-a1d751","uid":"6679e32c-53e2-4b45-b721-ad14049a0f70","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-sub-test-model-a1d751\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:33:10.043Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["EnvoyFilter","AuthPolicy","Limitador","ConfigMap","TokenRateLimitPolicy"],"eventTypes":{"update":5}}
{"level":"info","ts":"2026-11-02T22:33:10.112Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T22:33:10.425Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T22:33:10.537Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:33:10.537Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T22:33:10.943Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:33:10.951Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:33:10.954Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T22:33:10.958Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:33:10.958Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T22:33:10.958Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-11-02T22:33:11.011Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:33:11.011Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T22:33:12.198Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T22:33:12.198Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T22:33:12.629Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway","HTTPRoute","TokenRateLimitPolicy"],"eventTypes":{"delete":2,"update":1}}
{"level":"info","ts":"2026-11-02T22:33:13.567Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:33:13.567Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:33:13.570Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T22:33:13.573Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:33:13.573Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T22:33:13.578Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-11-02T22:33:13.637Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:33:13.637Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T22:33:13.693Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/ed2994aa9701d5383eb1f805c9c89ccec8a7d0b77fb131a5ca742fa37c73a14b","error":"authconfigs.authorino.kuadrant.io \"ed2994aa9701d5383eb1f805c9c89ccec8a7d0b77fb131a5ca742fa37c73a14b\" not found"}
{"level":"error","ts":"2026-11-02T22:33:13.748Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/3ea0c1283049b0b2e2ae47d4fdbeeb04aae52608076de47123cc9c6c1a7b685a","error":"authconfigs.authorino.kuadrant.io \"3ea0c1283049b0b2e2ae47d4fdbeeb04aae52608076de47123cc9c6c1a7b685a\" not found"}
{"level":"error","ts":"2026-11-02T22:33:13.803Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/ddd153ffe5f2008b5c0d76c6d4ced2a6aaaea3fc84c2bb12b6f75d72f6ffdcf8","error":"authconfigs.authorino.kuadrant.io \"ddd153ffe5f2008b5c0d76c6d4ced2a6aaaea3fc84c2bb12b6f75d72f6ffdcf8\" not found"}
{"level":"error","ts":"2026-11-02T22:33:13.857Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/e8df393789582296e5c92b134371d265557ec06b8f530a82d60afcfdfc27de8b","error":"authconfigs.authorino.kuadrant.io \"e8df393789582296e5c92b134371d265557ec06b8f530a82d60afcfdfc27de8b\" not found"}
{"level":"error","ts":"2026-11-02T22:33:13.912Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/5727d2fd0019c6bfa39a149d096736a5b6470b2cc5bf597b76fa7b9fb568b099","error":"authconfigs.authorino.kuadrant.io \"5727d2fd0019c6bfa39a149d096736a5b6470b2cc5bf597b76fa7b9fb568b099\" not found"}
{"level":"error","ts":"2026-11-02T22:33:13.967Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/7a7d519d00fa2e97e5f400a44c82c2e18e0c409b5a9afbb4d9d294659141b972","error":"authconfigs.authorino.kuadrant.io \"7a7d519d00fa2e97e5f400a44c82c2e18e0c409b5a9afbb4d9d294659141b972\" not found"}
{"level":"error","ts":"2026-11-02T22:33:14.022Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/9de3aeb3807fb0a63865dbb0cb6cac00d8acc0a489a9165c369fb079f576e503","error":"authconfigs.authorino.kuadrant.io \"9de3aeb3807fb0a63865dbb0cb6cac00d8acc0a489a9165c369fb079f576e503\" not found"}
{"level":"error","ts":"2026-11-02T22:33:14.077Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/29e64f93e9761c53580c183981bf81fb67b5649bbe34948dec541fd02a8b9939","error":"authconfigs.authorino.kuadrant.io \"29e64f93e9761c53580c183981bf81fb67b5649bbe34948dec541fd02a8b9939\" not found"}
{"level":"error","ts":"2026-11-02T22:33:14.183Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/96a831079b0b478b2f950e00a3b6488601f3db32cc01341caf7b7679a46be3b8","error":"authconfigs.authorino.kuadrant.io \"96a831079b0b478b2f950e00a3b6488601f3db32cc01341caf7b7679a46be3b8\" not found"}
{"level":"error","ts":"2026-11-02T22:33:14.186Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-shared-b-w3-a1d751","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T21:56:05Z","generation":7,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"b4f450f8-3314-4538-8376-5bc4682213ba\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:32:59Z"}],"name":"kuadrant-e2e-shared-b-w3-a1d751","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-b-w3-a1d751","uid":"b4f450f8-3314-4538-8376-5bc4682213ba"}],"resourceVersion":"139541","uid":"f193cccb-926b-43ad-b8dd-0f35a235191b"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fd6cf0f18f21a2b21b869fb35862696f9d65f6371aaab90e03f0600806862db9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]}],\"name\":\"b4f5dc508462935c59141642eb690c679074d18c598722aa3348703ebb49251c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w3-a1d751/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fd6cf0f18f21a2b21b869fb35862696f9d65f6371aaab90e03f0600806862db9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]}],\"name\":\"ea40f06b359e26e9f95fc2c8e156fb14aec66b3738478bbb9e9e9110be4baf61\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w3-a1d751/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fd6cf0f18f21a2b21b869fb35862696f9d65f6371aaab90e03f0600806862db9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]}],\"name\":\"af1a36d8b543a16bd969a4908547157c03ad6f16a3e06fa7ba81f634b8ac2571\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w3-a1d751/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fd6cf0f18f21a2b21b869fb35862696f9d65f6371aaab90e03f0600806862db9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]}],\"name\":\"b00bb8d8f42b0a1f4760bf5a6416af2cef0f8f8103c38765d8a912de36d2ba3e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w3-a1d751/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fd6cf0f18f21a2b21b869fb35862696f9d65f6371aaab90e03f0600806862db9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]}],\"name\":\"bcb4ee38c297fd81d1ba36ca91c6f43533ae03bcf32de74dee7773bb5b2cb53b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w3-a1d751/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fd6cf0f18f21a2b21b869fb35862696f9d65f6371aaab90e03f0600806862db9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]}],\"name\":\"99d79bd58a3e5e09b5c11b892fea548b7b9173be1aa16ee4751b8ebe6ee5e1f6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w3-a1d751/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fd6cf0f18f21a2b21b869fb35862696f9d65f6371aaab90e03f0600806862db9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]}],\"name\":\"5379ce2935360da6445a4624ebb0fffb1d4681ffb42315b2e61e5399dfb808fb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w3-a1d751/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fd6cf0f18f21a2b21b869fb35862696f9d65f6371aaab90e03f0600806862db9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]}],\"name\":\"24a78e9d4e679465e27f213ebfa01f64bc96922ad78fdc53cff071ac5b6a81dc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w3-a1d751/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e5c3e46343f841520ecdb272dac135e882471a34b6fbd1dfe102bb1535df2522\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-a1d751\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-a1d751\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]}],\"name\":\"4309e9a901e490b5923f5e9c24699d2e857cbb6dc20e790330c076d768763498\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b12682b1a488a7777939851e73abef802241193375e49cf718828297da8cb2c2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]}],\"name\":\"1640fd99e1d2b5698216be3f60d3664af2cabf1f24f0bb1fa79f6e2fe9f23ef6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w3-a1d751/models/facebook/opt-125m/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8023c7d6d2d950131dbdfdd9ebb5c95e52dfae5d4dfaf93b8b4ae57eb45d2bcf\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]}],\"name\":\"b054987892c955e1d106dccbc458226a6328c226c09a2075550d9a35d2d6e3a4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w3-a1d751/models/facebook/opt-125m/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"37b98d0f2b528bd5adf68cd626d0bcbb32ae39493dca90dfc95c91c903cb7a9b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]}],\"name\":\"aa0eb8235785812dd27690bb9a938fe5b32045914dff123e9378cf1bf90996a6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w3-a1d751/models/facebook/opt-125m/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f1aeb859c1579aea92c81f985aec98129102bab0482185da8dd5e38bfdab1f31\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]}],\"name\":\"6aa791d210e1f26083ea6e82b46ed8801291f17c0406c9508e404ae9421e045d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w3-a1d751/models/facebook/opt-125m/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f37aa79ec4a1199a49abd3f63dd4c9505bbd959bba56de7e4c8dad6c144af205\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]}],\"name\":\"ee86408dcc7c307eeb7e62f03ad79696c1aed2e21d972e66f5a46e737a42c8e1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d382a9a5e68a63cf824ae7421c24f285af4eba4b4e83a5df42b6213da00221b7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]}],\"name\":\"271e920a6bd7d30bded719b07e051f15b025a118a8675eaf26d6baadbe4d283b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"30ba4ccdfea25c5f1ebce6f1499d547e64179efb055f133b434843801331620f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]}],\"name\":\"00d9079f672c491f076316c8c4b048c87702c283bdebf80e975d415f1df6d2ee\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/ai-tenant-e2e-shared-b-w3-a1d751/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"649eae6f669005f50b60c0a593259354e3a301dc59d4543707d5cc441ea578ed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]}],\"name\":\"e0a0969004be7bfb9d1683a46a3327aa5144255b817ecc80e408763e6c41f64c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9593847662171f6a7915c575284c678f049381a1160493b136f5566f61950b7f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]}],\"name\":\"6c679088602dd9ea796b046684f1d25f72a7bc96a91c5c604003243da035aa90\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"1db7db8718ec954ecf16b0d35140cb8a1c89f0173590ed683bbb861f8380c6f1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]}],\"name\":\"fe031e9e78874e208226b8d363abc95f5f91493550d1e9fbb78ca7091c5e267f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9ed0ddd0e1ea68b359e326fba62a585324a528f116f0bf6d3f085360f79ed877\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-a1d751\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-a1d751\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]}],\"name\":\"7017ce065aadb4ec3cd123f3de90d4b298418b4cb0d6f2943ce905f0b6fa1973\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3e1c5c0bad150c663f60d190f6837f1f47449a9fb1dd0f8b15a5a049a5785836\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-a1d751\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-a1d751\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]}],\"name\":\"4b9629b6a0dc02e424027c37c202c248a532fff8b8cebe3888b35f432e4237a0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"45692dd8f986fdd88aa79ac3fde6dd1db9cc5cbaa9003e3fe62a6a019e62eb23\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-a1d751\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-a1d751\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]}],\"name\":\"8762492ec17ca2d96d70f7661ea91bc6dd105b52e7f7927e5f87422dad69cdf1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"54678c70bb572c34d6f6ed39e879f5beb1891cc61c4ee64dec6d9d3d0ed9c115\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-a1d751\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-a1d751\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]}],\"name\":\"6e67ae0eecb22274f490861a930e85a9d3cf386bb0d1179f4c67c60e1ed8eb2c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"afffab50bac2693d1a47a43cedfba11a37634e625c51a64f41e14d037dc9bc9a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-a1d751\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-w3-a1d751\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]}],\"name\":\"5df45cb848791fb94dcb78fb658eb490c82f995f9d95444c8a546b5cddad1a1b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0b94d900a5cdf5c531935a5db6b720c905f8b8e2c62caaf31136dacaca42afc8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-w3-a1d751-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__4204117f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-w3-a1d751/sub-test-model-a1d751-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-w3-a1d751\"]}],\"name\":\"95a9fdd052d64ba5b84de723c48968a3ca284a89256c7757f5ce2db19a3f11c6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-w3-a1d751/models/facebook/opt-125m')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-shared-b-w3-a1d751"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-shared-b-w3-a1d751\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:33:14.238Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/9eab454af32c78b750dd8a7f0f51e46caf9c5a6d593a08102680ec455da7f941","error":"authconfigs.authorino.kuadrant.io \"9eab454af32c78b750dd8a7f0f51e46caf9c5a6d593a08102680ec455da7f941\" not found"}
{"level":"error","ts":"2026-11-02T22:33:14.293Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/8ce2cbfc67213d98707c4ceb948a0bc47d762da419d2877baa87368e52adeb7b","error":"authconfigs.authorino.kuadrant.io \"8ce2cbfc67213d98707c4ceb948a0bc47d762da419d2877baa87368e52adeb7b\" not found"}
{"level":"error","ts":"2026-11-02T22:33:14.300Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-shared-a-w3-97995b","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T21:54:08Z","generation":9,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"b9ce997b-e593-4e5a-96e1-266d4780e128\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T22:32:46Z"}],"name":"kuadrant-e2e-shared-a-w3-97995b","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-a-w3-97995b","uid":"b9ce997b-e593-4e5a-96e1-266d4780e128"}],"resourceVersion":"139311","uid":"657ba0c9-d22d-4183-a7c2-c392b8af6143"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"feca5257a3a136afa9ca4bb6226e83b9e72a014fd57c59db758c454f118180b2\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-97995b-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-97995b\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-97995b\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]}],\"name\":\"697447b051af365a79e3fa7acf7f1f6f64b9bd844855783e0433ae28eb9de042\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"64610b2b1b14c01fb91d85773d211a6d8b173cb847914d22204a29dbf00c051b\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-97995b-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-97995b\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-97995b\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]}],\"name\":\"ab3f8e403d48e2edf0d20cf1af9316112053ce238e3ab9db5309e4506ca81358\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7acb8a78dba64f5ca2cb229b1a6a6e5100dfd1fe0185742cdf2493f937286eba\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-97995b-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-97995b\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-97995b\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]}],\"name\":\"277f6eb1de4fbfe33e49087e7995e2fc70745c603dfb4e7bd0387ba87a05fa73\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"abffb2b80b2e83749e48ad9bc9e2b132b4526ff5c2ddee7e3c63dcaac739cb58\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-97995b-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-97995b\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-97995b\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]}],\"name\":\"9fc807dc86717cc414f321c16b0d44d999a6c047d0871e8e85085f494ab58344\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"861bd69371a3568d3786b56a91d3af9c85fd73ef3e549606a38eed24c8a99b89\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-97995b-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-97995b\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-97995b\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]}],\"name\":\"1abcc31fbef3280fc20850d49e96774344d45c72d9af2ad2be2a524b9041e48d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6de91d16ed05414ab83195af7a0e61dc3b464cde05b3f5b5c1cb41079af7d577\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-w3-97995b-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-97995b\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f78dec3c\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-w3-97995b\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-w3-97995b\"]}],\"name\":\"4a5b0c3ba4d080fdf6969433dffaaa078a2cac0527e231c6975641dbc9a0fa7c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-shared-a-w3-97995b"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-shared-a-w3-97995b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:33:14.348Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/7452998b42ae4dea69dddcc474a389491d89642261d52ffb8b2401267d4fd23a","error":"authconfigs.authorino.kuadrant.io \"7452998b42ae4dea69dddcc474a389491d89642261d52ffb8b2401267d4fd23a\" not found"}
{"level":"error","ts":"2026-11-02T22:33:14.522Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-b-w3-a1d751","namespace":"openshift-ingress","uid":"2c7a0593-2f35-427a-b6f0-958582546c18","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-b-w3-a1d751\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:33:14.812Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T22:33:14.812Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T22:33:14.898Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"sub-test-model-a1d751-kserve-route","namespace":"ai-tenant-e2e-shared-b-w3-a1d751","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"sub-test-model-a1d751-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:33:19.625Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","EnvoyFilter","HTTPRoute","Limitador","ConfigMap","AuthConfig"],"eventTypes":{"delete":12,"update":6}}
{"level":"info","ts":"2026-11-02T22:33:19.746Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T22:33:19.940Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T22:33:20.040Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:33:20.040Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T22:33:20.490Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:33:20.492Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:33:20.492Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T22:33:20.523Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:33:20.529Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:33:20.535Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T22:33:20.639Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T22:33:21.505Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T22:33:21.505Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T22:33:26.139Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","Limitador"],"eventTypes":{"update":2}}
{"level":"info","ts":"2026-11-02T22:33:26.248Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T22:33:26.666Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T22:33:26.843Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:33:26.843Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T22:33:27.145Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:33:27.146Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:33:27.148Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-02T22:33:27.148Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T22:33:27.629Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T22:33:27.629Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T22:33:31.938Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","Limitador","Gateway","ConfigMap","HTTPRoute"],"eventTypes":{"delete":1,"update":9}}
{"level":"info","ts":"2026-11-02T22:33:32.007Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T22:33:32.257Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T22:33:32.543Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:33:32.543Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T22:33:32.874Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:33:32.875Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:33:32.875Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T22:33:32.885Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:33:32.890Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:33:32.892Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T22:33:32.954Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T22:33:34.210Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T22:33:34.210Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T22:33:38.810Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","EnvoyFilter","Limitador","ConfigMap","AuthConfig"],"eventTypes":{"delete":12,"update":9}}
{"level":"info","ts":"2026-11-02T22:33:38.878Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T22:33:39.164Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T22:33:39.235Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:33:39.235Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T22:33:39Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-shared-a-w3-97995b","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-a-w3-97995b","reconcileID":"29aeee21-66e3-471c-9d79-e9028a14d080","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-shared-a-w3-97995b","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T22:33:39.744Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:33:39.749Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-02T22:33:39.749Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T22:33:39Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-a-w3-97995b","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T22:33:39Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T22:33:39Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-11-02T22:33:39Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T22:33:39.757Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:33:39.757Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T22:33:39.764Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:33:39Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-11-02T22:33:39Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-shared-a-w3-97995b","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-a-w3-97995b","reconcileID":"29aeee21-66e3-471c-9d79-e9028a14d080","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-shared-a-w3-97995b","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T22:33:39Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-a-w3-97995b","event":"DELETE"}
{"level":"info","ts":"2026-11-02T22:33:39Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-02T22:33:39Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-shared-a-w3-97995b\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-02T22:33:39Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"error","ts":"2026-11-02T22:33:40.684Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-a-w3-97995b","namespace":"openshift-ingress","uid":"9405e4ea-22ff-4c46-bbc0-f492e0e403dc","error":"tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-a-w3-97995b\" not found"}
{"level":"info","ts":"2026-11-02T22:33:40.804Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T22:33:40.804Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T22:33:40.924Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-a-w3-97995b","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-shared-a-w3-97995b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:33:47.446Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","EnvoyFilter","ConfigMap","Kuadrant","Limitador","Gateway","HTTPRoute"],"eventTypes":{"delete":2,"update":10}}
{"level":"info","ts":"2026-11-02T22:33:47.579Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:33:47.599Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T22:33:47.836Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T22:33:47.851Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T22:33:47.865Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:33:47.936Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:33:47.936Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T22:33:48.468Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:33:48.470Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:33:48.470Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T22:33:48.523Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:33:48.523Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:33:48.525Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T22:33:48.588Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T22:33:49.358Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T22:33:49.358Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T22:33:49.732Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["EnvoyFilter","Gateway","AuthPolicy"],"eventTypes":{"delete":5}}
{"level":"info","ts":"2026-11-02T22:33:50.463Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:33:50.463Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:33:50.467Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T22:33:50.472Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:33:50.472Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T22:33:50.523Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-11-02T22:33:50.526Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:33:50.526Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T22:33:50.580Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/7acb8a78dba64f5ca2cb229b1a6a6e5100dfd1fe0185742cdf2493f937286eba","error":"authconfigs.authorino.kuadrant.io \"7acb8a78dba64f5ca2cb229b1a6a6e5100dfd1fe0185742cdf2493f937286eba\" not found"}
{"level":"error","ts":"2026-11-02T22:33:50.634Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/861bd69371a3568d3786b56a91d3af9c85fd73ef3e549606a38eed24c8a99b89","error":"authconfigs.authorino.kuadrant.io \"861bd69371a3568d3786b56a91d3af9c85fd73ef3e549606a38eed24c8a99b89\" not found"}
{"level":"error","ts":"2026-11-02T22:33:50.689Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/feca5257a3a136afa9ca4bb6226e83b9e72a014fd57c59db758c454f118180b2","error":"authconfigs.authorino.kuadrant.io \"feca5257a3a136afa9ca4bb6226e83b9e72a014fd57c59db758c454f118180b2\" not found"}
{"level":"error","ts":"2026-11-02T22:33:50.744Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/abffb2b80b2e83749e48ad9bc9e2b132b4526ff5c2ddee7e3c63dcaac739cb58","error":"authconfigs.authorino.kuadrant.io \"abffb2b80b2e83749e48ad9bc9e2b132b4526ff5c2ddee7e3c63dcaac739cb58\" not found"}
{"level":"error","ts":"2026-11-02T22:33:50.798Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/6de91d16ed05414ab83195af7a0e61dc3b464cde05b3f5b5c1cb41079af7d577","error":"authconfigs.authorino.kuadrant.io \"6de91d16ed05414ab83195af7a0e61dc3b464cde05b3f5b5c1cb41079af7d577\" not found"}
{"level":"error","ts":"2026-11-02T22:33:50.852Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/64610b2b1b14c01fb91d85773d211a6d8b173cb847914d22204a29dbf00c051b","error":"authconfigs.authorino.kuadrant.io \"64610b2b1b14c01fb91d85773d211a6d8b173cb847914d22204a29dbf00c051b\" not found"}
{"level":"error","ts":"2026-11-02T22:33:51.027Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-facebook-opt-125m-simulated","namespace":"llm","uid":"da8edb1a-ed61-454d-939f-fc7cd235d9fb","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-facebook-opt-125m-simulated\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:33:51.084Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w3-f51151","namespace":"e2e-models-e2e-worker-w3-f51151","uid":"e3340067-224a-43ad-8020-ca9e00ead152","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w3-f51151\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:33:51.141Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-simulated-simulated-premium","namespace":"llm","uid":"447993be-3c57-4e68-8ffa-6fc998a39c77","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-simulated-simulated-premium\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:33:51.198Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w3-f51151","namespace":"e2e-models-e2e-worker-w3-f51151","uid":"c78aa03a-e3ca-4797-8a09-ab0d9cd88148","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w3-f51151\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:33:51.255Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-b-w3-a1d751","namespace":"openshift-ingress","uid":"2c7a0593-2f35-427a-b6f0-958582546c18","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-b-w3-a1d751\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:33:51.255Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T22:33:51.255Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T22:33:55.751Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","Limitador","ConfigMap","AuthConfig"],"eventTypes":{"delete":6,"update":7}}
{"level":"info","ts":"2026-11-02T22:33:55.819Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T22:33:55.962Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T22:33:56.043Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:33:56.043Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T22:33:56.523Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:33:56.526Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-02T22:33:56.526Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T22:33:56.529Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:33:56.529Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T22:33:56.530Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:33:57.330Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T22:33:57.330Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T22:33:59.857Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","ConfigMap","Limitador"],"eventTypes":{"update":7}}
{"level":"info","ts":"2026-11-02T22:33:59.977Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T22:34:00.058Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T22:34:00.124Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:34:00.125Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T22:34:00.579Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:34:00.624Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-02T22:34:00.624Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T22:34:00.624Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:34:00.624Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T22:34:00.625Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:34:01.409Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T22:34:01.410Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T22:34:02Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-shared-b-w3-a1d751","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-b-w3-a1d751","reconcileID":"23db818f-06a2-4911-8046-b83fa7ee821e","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-shared-b-w3-a1d751","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T22:34:02Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-b-w3-a1d751","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T22:34:02Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T22:34:02Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-11-02T22:34:02Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T22:34:02Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-11-02T22:34:02Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-shared-b-w3-a1d751","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-b-w3-a1d751","reconcileID":"23db818f-06a2-4911-8046-b83fa7ee821e","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-shared-b-w3-a1d751","namespace":"openshift-ingress"}
{"level":"error","ts":"2026-11-02T22:34:02Z","logger":"telemetry-policy-extension-controller","msg":"Reconciler error","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-shared-b-w3-a1d751","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-b-w3-a1d751","reconcileID":"bd79526c-78d2-4f35-8b48-22922a67ec95","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-shared-b-w3-a1d751\" not found","stacktrace":"sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:353\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-02T22:34:02Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-shared-b-w3-a1d751","event":"DELETE"}
{"level":"info","ts":"2026-11-02T22:34:02Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-02T22:34:02Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-shared-b-w3-a1d751\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-02T22:34:02Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T22:34:07.991Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Kuadrant","ConfigMap","Gateway","HTTPRoute","TokenRateLimitPolicy"],"eventTypes":{"delete":2,"update":3}}
{"level":"info","ts":"2026-11-02T22:34:08.123Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:34:08.131Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T22:34:08.345Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T22:34:08.363Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T22:34:08.369Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:34:08.436Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:34:08.436Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T22:34:08.827Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:34:08.828Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:34:08.828Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T22:34:08.838Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:34:08.838Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:34:08.841Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T22:34:08.939Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T22:34:09.593Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T22:34:09.593Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T22:34:09.928Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["EnvoyFilter","Gateway","AuthPolicy"],"eventTypes":{"delete":5}}
{"level":"info","ts":"2026-11-02T22:34:10.560Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:34:10.562Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:34:10.562Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T22:34:10.571Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:34:10.571Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:34:10.573Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"error","ts":"2026-11-02T22:34:10.630Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:34:10.630Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T22:34:10.631Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/afffab50bac2693d1a47a43cedfba11a37634e625c51a64f41e14d037dc9bc9a","error":"authconfigs.authorino.kuadrant.io \"afffab50bac2693d1a47a43cedfba11a37634e625c51a64f41e14d037dc9bc9a\" not found"}
{"level":"error","ts":"2026-11-02T22:34:10.688Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/54678c70bb572c34d6f6ed39e879f5beb1891cc61c4ee64dec6d9d3d0ed9c115","error":"authconfigs.authorino.kuadrant.io \"54678c70bb572c34d6f6ed39e879f5beb1891cc61c4ee64dec6d9d3d0ed9c115\" not found"}
{"level":"error","ts":"2026-11-02T22:34:10.743Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/e5c3e46343f841520ecdb272dac135e882471a34b6fbd1dfe102bb1535df2522","error":"authconfigs.authorino.kuadrant.io \"e5c3e46343f841520ecdb272dac135e882471a34b6fbd1dfe102bb1535df2522\" not found"}
{"level":"error","ts":"2026-11-02T22:34:10.797Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/9ed0ddd0e1ea68b359e326fba62a585324a528f116f0bf6d3f085360f79ed877","error":"authconfigs.authorino.kuadrant.io \"9ed0ddd0e1ea68b359e326fba62a585324a528f116f0bf6d3f085360f79ed877\" not found"}
{"level":"error","ts":"2026-11-02T22:34:10.852Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/3e1c5c0bad150c663f60d190f6837f1f47449a9fb1dd0f8b15a5a049a5785836","error":"authconfigs.authorino.kuadrant.io \"3e1c5c0bad150c663f60d190f6837f1f47449a9fb1dd0f8b15a5a049a5785836\" not found"}
{"level":"error","ts":"2026-11-02T22:34:10.906Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/45692dd8f986fdd88aa79ac3fde6dd1db9cc5cbaa9003e3fe62a6a019e62eb23","error":"authconfigs.authorino.kuadrant.io \"45692dd8f986fdd88aa79ac3fde6dd1db9cc5cbaa9003e3fe62a6a019e62eb23\" not found"}
{"level":"error","ts":"2026-11-02T22:34:11.039Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-facebook-opt-125m-simulated","namespace":"llm","uid":"da8edb1a-ed61-454d-939f-fc7cd235d9fb","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-facebook-opt-125m-simulated\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:34:11.153Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-simulator-w3-f51151","namespace":"e2e-models-e2e-worker-w3-f51151","uid":"e3340067-224a-43ad-8020-ca9e00ead152","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-simulator-w3-f51151\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:34:11.210Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w3-f51151","namespace":"e2e-models-e2e-worker-w3-f51151","uid":"c78aa03a-e3ca-4797-8a09-ab0d9cd88148","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w3-f51151\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:34:11.267Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-simulated-simulated-premium","namespace":"llm","uid":"447993be-3c57-4e68-8ffa-6fc998a39c77","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-simulated-simulated-premium\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:34:11.267Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T22:34:11.267Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T22:34:15.748Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","ConfigMap","Limitador","AuthConfig"],"eventTypes":{"delete":6,"update":6}}
{"level":"info","ts":"2026-11-02T22:34:15.869Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T22:34:16.023Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T22:34:16.163Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:34:16.163Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T22:34:16.447Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:34:16.449Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T22:34:16.451Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:34:16.451Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T22:34:16.471Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-11-02T22:34:16.532Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:34:16.532Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T22:34:17.317Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T22:34:17.317Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T22:34:17.611Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy"],"eventTypes":{"delete":1}}
{"level":"info","ts":"2026-11-02T22:34:18.343Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:34:18.344Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:34:18.344Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T22:34:18.345Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"error","ts":"2026-11-02T22:34:18.453Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:34:18.453Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-11-02T22:34:18.892Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-worker-w3-f51151","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-11-02T21:21:31Z","generation":19,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"8871137c-7f6a-401d-a6db-2983aea5ba22\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:workloadSelector":{".":{},"f:labels":{".":{},"f:gateway.networking.k8s.io/gateway-name":{}}}}},"manager":"manager","operation":"Update","time":"2026-11-02T21:53:12Z"}],"name":"kuadrant-e2e-worker-w3-f51151","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-worker-w3-f51151","uid":"8871137c-7f6a-401d-a6db-2983aea5ba22"}],"resourceVersion":"80294","uid":"c24c0550-6758-4dca-8d2b-3fe32740d122"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a05d7e315cc7cde173ab18a777672d3a18ce0a96f8f52d505404dcf8d1e51c20\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"0e7c31c41adb0d3f9efc929ae631573fe0c783a2fa7edb7a4b135081c2969bbf\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6c73e108ce3d5ef8ece11651aca73aa00bd88530b6aba861d23ca7b6ff89ba5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"aedbd7ef0308fd9494e9a3a1386b732923d5d060acf5a188601898d4867d320f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7b56d8e34a0de188e49dc0ae60057e421eb8bc4643546e49b2fe810120869498\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"b6389ab82133347e2514a4ad1cbd9d34042edc9a4ad044714155dbb2aecf38d4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a942d85d233c0e2e8932f598b5b8c9b97eda0ae826b5a80a742559b36fa56979\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"85e7f37f931469abe1b396a1a44b52a8b72e6a4dc98ed0ebdd61e43f0486de13\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a05d7e315cc7cde173ab18a777672d3a18ce0a96f8f52d505404dcf8d1e51c20\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"ec8a1b6bbf984a67cda63e2d923bfa9d2d66a7537f676f6198c12cbca9103517\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6c73e108ce3d5ef8ece11651aca73aa00bd88530b6aba861d23ca7b6ff89ba5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"5c9b9ac2bc33c747eb54045ee2511e3c8b2ee9737a3f347afb75903f43d74fb7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7b56d8e34a0de188e49dc0ae60057e421eb8bc4643546e49b2fe810120869498\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"f82b9432930517e02d229f4fdbdd8b6700b061d5d333fe35b064a3bb85f58e76\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a942d85d233c0e2e8932f598b5b8c9b97eda0ae826b5a80a742559b36fa56979\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"6d321a24ed09abad642dee549f0c7cbf98ce40481beb85ca79bd3d4eeb89b77e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a05d7e315cc7cde173ab18a777672d3a18ce0a96f8f52d505404dcf8d1e51c20\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"a54bd689e670e5f8bbee0a66c2585a4d4adce9a5a7fc297449ee3b816a0c2695\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6c73e108ce3d5ef8ece11651aca73aa00bd88530b6aba861d23ca7b6ff89ba5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"ad845c31a125851bf4cc5ae7e83bb4a011cf98484d99780ab16df250ca9dd41c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7b56d8e34a0de188e49dc0ae60057e421eb8bc4643546e49b2fe810120869498\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"9eefe22cd9d7f4d324cc07e6422d998261fea96e9069bc938fe66a94e8c8cadb\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a942d85d233c0e2e8932f598b5b8c9b97eda0ae826b5a80a742559b36fa56979\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"b00ec38cf5be980b160374be347b182afaa16e0dc99314a5e990f20cef6d57ed\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a05d7e315cc7cde173ab18a777672d3a18ce0a96f8f52d505404dcf8d1e51c20\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"6d5d9aca320022f0f8b70c3f9b34b5922adf537f5da717ec79924566febf6df1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6c73e108ce3d5ef8ece11651aca73aa00bd88530b6aba861d23ca7b6ff89ba5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"346e75cab49a1cf8ae89d90cfb32099256f44d7909e40cdc730e951946a411e2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7b56d8e34a0de188e49dc0ae60057e421eb8bc4643546e49b2fe810120869498\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"ae0a4172fa23a6e8857123675126f34bcaf4e08f94c05663e2913801fda46401\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a942d85d233c0e2e8932f598b5b8c9b97eda0ae826b5a80a742559b36fa56979\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"ee0931c3dc206732c58bab1add9bf2cb602a2eb21bfa9272c2df596197dceb3e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a05d7e315cc7cde173ab18a777672d3a18ce0a96f8f52d505404dcf8d1e51c20\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"3f6b6643d5731a355a44968b83b24169ff3e0c1b36737d8be7f9d42e1def7c3e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6c73e108ce3d5ef8ece11651aca73aa00bd88530b6aba861d23ca7b6ff89ba5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"cd8ab5f89e71494c8d176f9668b8ed279bd244e6f70d1a5c87603877b4b7182d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7b56d8e34a0de188e49dc0ae60057e421eb8bc4643546e49b2fe810120869498\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"09df06c068a0d1324c44679ca0c022e74cd18bae1497d0087fb2184f9401d63b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a942d85d233c0e2e8932f598b5b8c9b97eda0ae826b5a80a742559b36fa56979\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"821121f5584e938a01b323996203984576204f894f2c9f09f5ececcdc058373e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a05d7e315cc7cde173ab18a777672d3a18ce0a96f8f52d505404dcf8d1e51c20\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"e00f3dfbbce60a718137b415a42cbf1e65a7b226437cc4600d9fa76b264e3b4d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a05d7e315cc7cde173ab18a777672d3a18ce0a96f8f52d505404dcf8d1e51c20\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"7ddf0d6bdcfc6aa206cdc0919b1d5b7545c903aafbb0e16d393016b1a83bd29a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6c73e108ce3d5ef8ece11651aca73aa00bd88530b6aba861d23ca7b6ff89ba5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"fe3b37fdd5d3f9d3bdf7d03b186d964b283bfbe7d3ffa720457517666c3070a2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6c73e108ce3d5ef8ece11651aca73aa00bd88530b6aba861d23ca7b6ff89ba5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"7dd9491b4755b4900c5bc55b4dd9aff38f99899f0236e4d21bf7c94e5769cbb1\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7b56d8e34a0de188e49dc0ae60057e421eb8bc4643546e49b2fe810120869498\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"fa5430186b33e56d19e4d2e0209b4f2215d17b488745cd8061eb5ecaf96ecafa\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7b56d8e34a0de188e49dc0ae60057e421eb8bc4643546e49b2fe810120869498\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"cd88af3d71345ad9b32dfae02550fa9bf6aa0cddfac2d0464a60cd90b9898d74\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a942d85d233c0e2e8932f598b5b8c9b97eda0ae826b5a80a742559b36fa56979\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"2182ac070ac99ffbeb246624e36aa202ce8c626bd38aaa3191f5e60a408bc782\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a942d85d233c0e2e8932f598b5b8c9b97eda0ae826b5a80a742559b36fa56979\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"97e41dd7c810563f2cac2a1c963d220c840d6b756c6c76b0cf97113387aab38b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a05d7e315cc7cde173ab18a777672d3a18ce0a96f8f52d505404dcf8d1e51c20\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"a00edc25239da061cd0457625d6046ede5f9d09507c78c2209e1e992795831c9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6c73e108ce3d5ef8ece11651aca73aa00bd88530b6aba861d23ca7b6ff89ba5a\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"fbd557cfa232fb43236e5864400cd1522fbf21d014450df4a714ea2d3608e863\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7b56d8e34a0de188e49dc0ae60057e421eb8bc4643546e49b2fe810120869498\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"f809ccd15563984c9befad8f50ee38613b9c34eda0af01f561e75be88cba33ab\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a942d85d233c0e2e8932f598b5b8c9b97eda0ae826b5a80a742559b36fa56979\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"749b6bc66485455bb3cc5a0d552c38935bb446a6be85e306d894e6cbb4d92c08\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/messages'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b31ddb7ef02e35e9d172430b50a004a3047564232880010bd3e581bf0dc547f8\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"a1ec0f0592798b3996117a17734b0936906621077ceec69c81d8fb77e89a142a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/me'\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"75a5abd89bb4e6258c7f7c7be472e6131799539dbbb87686c1010afe2791e45e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"3ca8a6339da3e4298e514bea168ac30f6c718d158fa0efc5e0fd85f06754a528\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"72bb4e3923485ca35015ee8655bc43ee332eea77f2cd8effbd48b21828f89f80\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"879fe62fbbe8b0a130140cda7f546611c758fb8fa416f173d2b0cf3da17d7941\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ed162da516e04d5229dc1d49e1c785e9db374ba4ba028ecabbdccdcb33acd1f0\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"b43372d2a0820427086903362809a4a0c757cd1d6f593ba48a755e5fb972575d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f9603ac54a5668b179c6ba3dcda3951e57253a5ad5ad80214b563f50337f3a9c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"7caf859dfb9739029a8c1b13adba06164610495beddbda8e01fd7b432b15f4c3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"775fdec32977b769224a6d9530e33a1b93a2948f54e3f459e979da99f7def4ea\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"5cebae68b5e59e34a98c9c038f83d877f079732894ec3403d349e0b7ae0c9099\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6ab1b21b6f75f2c1ef86f9bcf36a6c25244e88430832e3ac86a839cf10bb8dcd\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"15ecb8224cf6049c2e831c815cc4f0aed954432b967d01d55ea637294f3ea87e\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"8b2fbdc0f4b402fd19fb549b70da796c6867a52206fa0420df2d6debc0db70b7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"7cb303fae9824d31834d539772c1840fd2991481566b7d07635c9284c524ae4d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a649343311197c716e0b6f502bb8ad21ecf4e207e16ffc6e0b74b1dc4f05f7fb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"699e8723136e653d04a8800a9289a3543f733ebfd0f99efbedfd18d22de4c281\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a6267fc785126adca5b68df13f95ef1fa08e1d72b66fbff01b54f8d61edaf7ba\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"9a72bfcef40a8da2865b02b6123c023d9f4f17c11a2ff674e3ed24af23e468e2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a6d41f4e9f57ec1e6bb4423e49991033d85f00a2a3303e02b25d1eedb67be3c9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"ad4137b1e753fd100088742941c8aaee9eaddc158bbaf221eb0d7318bdb8dfb5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6610d72af8a18be17c09082b4389a248d739315be17e0e146375e82e8d76261d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"66a5afc61110ab52ae4b9c9d79944467f91c4a2bd7b954ed8f59e651c215c630\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"aea6441051c6a7490e44d5f7bab0e4bf7cf461c9597675611789e8d9141a446c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"c871ffab27f7ed925d56fae005e70fd3716aab799f0484d7d44519e915491d11\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"be7879d2a6daa00da89abfe5895a77787208f1af5b8582c79c8dd2849ef7906c\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"461ea56b8a105dbd1d386b531c80b5a86960df99b24b6f6668520921b280a609\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7f4456bc894bf7ab59ba02c25915a8db007a89ffdd1efcace437a7761c68b3f9\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"aedfea0f1dceed2b1af07ebf6e7dbc55cdc958ea5a084291f6216a19f63eae8a\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f23dfebb92a3f3d59997030cce08899533ec20be47590cd866dd896392db04de\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"f42d6cbc7a49b6c1c4f0668dc536500321a8f658d1ab1a3a8b2ad8c0a95b272c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"c57cda59d33d438c637a64dce8619a9616880a275363557ccc83d2cbc4920e14\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"1a3df8e6f6ad36c3eb928970ca2e746005e16b25405fc6eb9f44977b07d56905\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"086314a2fc965880bf769a18d3353909b6a1e5544e7eb514174994ba24387652\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"8e63847006a8d1952318fe3b6d2707027991d1c00d7959d051b3baf72690aecf\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f1def6d908410a124665ecd632ae01e5ba977920643dab1a35d25277292bae55\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"1199947fd30f0d1dab3db5846b8d27e36b6284be94834b798e4004120ec52532\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"676709317386301aa762cc48b7aa0064bc03adc00abbddfda8d0294046751d34\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"8a51327014eb82d6df6700b3f79ae6010cc76b2ee750f56ac5cb49c5b6f975ed\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d8557b9861d48e5714a954e0a885ecc7e55e6b9f034fc9f24f4c5c2f6dafce5e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"91c8ce1078dc4a26a7cb0af054981aa28b4768dcd87a9a167f98e9b4e4b60325\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d63de28626482cf5fa2aaf12cb9aa3def86d637d4c98f193819331c36fa73b21\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"fae01409c891b630fc644ebf1b8bc640438a1fc79de2b0750d34e2a6388d4ca6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f86615df74e8d3814df8817b06dc7578a4b0af0817397c5bdddb1daaaeb1df4e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"2d972852e655bb76327ea47e134854d589cf64538813171d00544a81dc138f4f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ca57331ce8d0c8497c210605ffe8878f757d572164898f4f870b89fcf2f9f1ed\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"1ef135f8dcdcaa663d4184fa6364518f7001a744380301035f254e16acdad0b7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"06c1a51758821d18e14577dc995b939fe472579672223b3bf0c1a312b23f23c4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"a90d5652afa4bbc65c24ada88ebb0df97a9c759ab0004d0c85d28f7e4c012bb9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/premium-w3-f51151/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"acbe19c11dc0fe08b370bbe647de6ecce77849e75c774c3e46f4a7af09e2861f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"b1fa0497afe070203ab9c23aef75e896659b83c8305ca7a56664d1717528e732\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7b5f8cd8dfbddc7109fd206805e23a6ae21c18bf406c0001927759ff1a39122f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"64238089f4803f45c8353b0d5d05ac6a23d6a3647106591fdc2bd5299c0b0759\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fd143bc18213c3c4682bcced572bcf84c1cbc8cd87ea188e96c990f164fd5ade\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"3ede2f522e381a5e5b8affa5afed6ede7d3894cf263c247dca9b3f3f3ad4a676\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cf25727b6a9419d97ed5dc9613d3b6a26e590c05f01b5c4038461accc96bc026\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"fb213d7be796970427643a4a818af11356ba854b3a0477e3c48bc2ef3332c7d5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cb9167704c77a112808785ad099bc015c57786c61e7befec251b029ce378a0c6\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"ef8b5b3a53f3de47fd70ccb56be2422e84d7fb1f10a03b64c032baca50a33c79\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"9a4beabc5e6770b1db0aae064836730685e70fcacd601193f69aafe8156d41a4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"667e44e20cda74056b10928af7322c52f17d044dda1b5aded34df466201c3e4d\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/premium-w3-f51151/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"fdd358955bc325dacf4ae3d584d9dfaa236b2605d42014543bcddb868221d0fa\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"0a4335c7c536062bc1f3c4f55fad89ef387858062864c877a3014c384192a4f5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"91d11ef27666b7f1f85063266e00a4add2242586a1e8a4bac5447b3f4ec7925d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"26827917812d006281f7f7ba6e53d3573012708364624693432b2cbdd0f434b5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"79bf752ac34000e70b4860b3a87054e1aab2babf35019e7e24d203c82f5f1c70\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"e8683890d73b71f6556b533ec6f92b30804817a025abb3d3c716a89f9b3f85d9\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"707f7a9a5bb373d466ca8ba9e6220842edd61bdf74768cdb8760aca4648a21b3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"b90f395e8ebaa67a3ab9ee2a967d88bbf981033415dedacddf2e76a8347bfd39\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/premium-w3-f51151/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a40304ff6b4a0f6c57da3d4a6bcc549a18c94ce2ed3356df2ce4c4621e7d5231\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"ff65bd9a43408c55f0593fcb41763d9030c7823704d875b6050eb2c39b500d75\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"ab3c6da9622dba177dfaf10df58f987a09c5bd12e35f73cca3f03ce632140cd4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"9ec2510ba7c20be712eae31e88eb54985eedbb6ce61783804c05db0582107bc2\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/premium-w3-f51151/v1/messages')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"5d4b7dc290bd7cb2c0c574a9869b31b45107252e6aaf512691b5c665967d6821\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"f6fff5f3b2673f2810cddb2b65518e70b74aad58e6c27ef1faf828a9cdef8c14\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d896bcdf40d08e0bef242ce04aa58467e96c672450af890adda6941c53a574d3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"69bd1c4b3e1b36f5d5d62283b221b7026a4e53da339ac7c470f75cb4334435f6\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"16bf1b94bcdc2b222ee7ef5dfdb45298f40e57fcf65f862a63a7b2d64b143143\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"ec2b739c69e9a51aedc6a2ee8ed6e7bbcb37f4eff66695b2c6d1bf4950a2ecb3\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3fdafb69d9c72b7e3c78e50b30f01adec907957097c6a1e811ceff68d93d7c23\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"a31568314e38d20d12f5921c57463100edd3022d5f9f3c0b36033d9a4dee9193\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/e2e-models-e2e-worker-w3-f51151/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e11ba50523ae86c5c06c5b76176154ed9ba57c3ed13fa43133b1ac7249ce345f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"67192e2ead59827b5990f7b4cbc2aece4271402ddcdfaa76f7cf95d2d4552c43\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b6344fa6f672d55d2eb4fbf6449de24a41dbf664f8e9d3c01ecde50e9d46e233\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"3c429336b45d9712bfdb0d99ecd41baa0dde1570067b941b5927e1894931c254\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/health')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d1f3365185f5fcfe92899c5f49af1b579baab97128b8afee3eed4350859c3f14\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"2f17c508c987cffd0b45ebd164fcee3ad66819a39900f83fbeda518ccf619183\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"85124e62247f9234752fedfc382ba93d6f839dab53f49c16951446afa3e613aa\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"6d2c4320e5eae8e51596e1c62f1c7494e1c5f9cd5d374e73b3ddae65dd071a92\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api/v1')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"461f0fb3ed9e91195eaa488b65b6f04cb4bff62087edbcf0d4c2186d180ba0ab\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-worker-w3-f51151\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"994b30d96390325263d89c2da7554eadd9d4fd1811371afabaf057df68e19205\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"d13670b5b1696edcb191c925fa86dd729eeb7447f2230e160d9cc03e0117604d\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/simulator-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"f70585dfa8966b9748a8978bfdf51d589a9d85f553359b47bfa09ad8bb266b02\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/simulator-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"18b02d50add3a7c29ec6127eedab648f22d172b48224a97365a7798a612dcd01\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.tokens_1000_per_1m__36aff31d\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.selected_subscription_id\",\"value\":\"auth.identity.selected_subscription_id\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_id == \\\"1809e74a69f85826\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/premium-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:e2e-models-e2e-worker-w3-f51151/maas-trlp-premium-w3-f51151\"]}],\"name\":\"1e0c9c02fbbf3d69df4286ba8224f5543dfc90c1df5aa687b5b6f1c00dce4d56\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/premium-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3f0daf8882dbe2b0594c2bb310f151a319cec601c5028d24f0d4557684bfb5f1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"4d8ba792ec63f5d46b5589f993126734f136e3569a1b7639aaea8768dc2c0f57\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-w3-f51151')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"a8ad3ccfafcc25ea959dd98788332d9514ad2d762423f3039adff91a3381329f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-worker-w3-f51151-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f714fbae\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\") && !(request.path == \\\"/v1/me\\\")\"]}],\"scope\":\"e2e-models-e2e-worker-w3-f51151/distinct-2-w3-f51151-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-worker-w3-f51151\"]}],\"name\":\"b159e4d34dc2a1f6fe05bc0d616c2ebb2d3306defc93bfb6d4035e2f842e1b91\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/e2e-models-e2e-worker-w3-f51151/models/e2e/distinct-2-w3-f51151')\"]}}],\"requestData\":{\"metrics.labels.cost_center\":\"has(auth.identity.subscription_info.costCenter) ? auth.identity.subscription_info.costCenter : \\\"\\\"\",\"metrics.labels.model\":\"responseBodyJSON(\\\"/model\\\")\",\"metrics.labels.organization_id\":\"has(auth.identity.subscription_info.organizationId) ? auth.identity.subscription_info.organizationId : \\\"\\\"\",\"metrics.labels.subscription\":\"auth.identity.selected_subscription\"},\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"2s\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"8ebb4eb0910cf689981e50c7ff78df3070398ede17c3276d9048bdce3d30f806"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"workloadSelector":{"labels":{"gateway.networking.k8s.io/gateway-name":"e2e-worker-w3-f51151"}}},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-worker-w3-f51151\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-11-02T22:34:19.066Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-w3-f51151","namespace":"e2e-models-e2e-worker-w3-f51151","uid":"c78aa03a-e3ca-4797-8a09-ab0d9cd88148","error":"tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-w3-f51151\" not found"}
{"level":"error","ts":"2026-11-02T22:34:19.282Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"simulator-w3-f51151-kserve-route","namespace":"e2e-models-e2e-worker-w3-f51151","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"simulator-w3-f51151-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:34:23.593Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["EnvoyFilter","Limitador","HTTPRoute","AuthPolicy","ConfigMap","TokenRateLimitPolicy"],"eventTypes":{"delete":1,"update":5}}
{"level":"info","ts":"2026-11-02T22:34:23.714Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T22:34:23.929Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T22:34:24.059Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:34:24.059Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T22:34:24.342Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:34:24.343Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:34:24.343Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T22:34:24.345Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:34:24.347Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T22:34:24.348Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:34:24.448Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T22:34:28.475Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T22:34:28.475Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T22:34:32.786Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","HTTPRoute","AuthPolicy","ConfigMap","Limitador","EnvoyFilter","TokenRateLimitPolicy"],"eventTypes":{"update":60}}
{"level":"info","ts":"2026-11-02T22:34:32.857Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T22:34:32.968Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T22:34:33.033Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:34:33.033Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T22:34:33.472Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:34:33.535Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:34:33.536Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:34:33.538Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:34:33.538Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T22:34:33.552Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-02T22:34:33.552Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T22:34:34.121Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T22:34:34.121Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T22:34:34.181Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-worker-w3-f51151","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-worker-w3-f51151\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:34:34Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-worker-w3-f51151","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-worker-w3-f51151","reconcileID":"9babc75a-7b85-47f7-9c05-8229bd0e026e","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-worker-w3-f51151","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T22:34:34Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-worker-w3-f51151","event":"UPDATE"}
{"level":"info","ts":"2026-11-02T22:34:34Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"info","ts":"2026-11-02T22:34:34Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy marked for deletion"}
{"level":"info","ts":"2026-11-02T22:34:34Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T22:34:34Z","logger":"telemetry-policy-extension-controller","msg":"cleared policy","subscriptions":0,"mutators":4}
{"level":"info","ts":"2026-11-02T22:34:34Z","logger":"telemetry-policy-extension-controller","msg":"update object","controller":"telemetry-policy-extension-controller","object":{"name":"maas-telemetry-e2e-worker-w3-f51151","namespace":"openshift-ingress"},"namespace":"openshift-ingress","name":"maas-telemetry-e2e-worker-w3-f51151","reconcileID":"9babc75a-7b85-47f7-9c05-8229bd0e026e","kind":"v1alpha1.TelemetryPolicy","name":"maas-telemetry-e2e-worker-w3-f51151","namespace":"openshift-ingress"}
{"level":"info","ts":"2026-11-02T22:34:34Z","logger":"telemetry-policy-extension-controller","msg":"reconciling request","namespace":"openshift-ingress","name":"maas-telemetry-e2e-worker-w3-f51151","event":"DELETE"}
{"level":"info","ts":"2026-11-02T22:34:34Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies started"}
{"level":"error","ts":"2026-11-02T22:34:34Z","logger":"telemetry-policy-extension-controller","msg":"telemetrypolicy not found","error":"TelemetryPolicy.extensions.kuadrant.io \"maas-telemetry-e2e-worker-w3-f51151\" not found","stacktrace":"github.com/kuadrant/kuadrant-operator/cmd/extensions/telemetry-policy/internal/controller.(*TelemetryPolicyReconciler).Reconcile\n\t/workspace/cmd/extensions/telemetry-policy/internal/controller/telemetrypolicy_reconciler.go:40\ngithub.com/kuadrant/kuadrant-operator/pkg/extension/controller.(*ExtensionController).Reconcile\n\t/workspace/pkg/extension/controller/controller.go:160\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"info","ts":"2026-11-02T22:34:34Z","logger":"telemetry-policy-extension-controller","msg":"reconciling telemetrypolicies completed"}
{"level":"info","ts":"2026-11-02T22:34:38.456Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthPolicy","Kuadrant","ConfigMap","TokenRateLimitPolicy","Gateway","Limitador","HTTPRoute"],"eventTypes":{"delete":2,"update":7}}
{"level":"info","ts":"2026-11-02T22:34:38.554Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:34:38.575Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T22:34:38.828Z","logger":"kuadrant-operator.DeveloperPortalReconciler","msg":"developer portal reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T22:34:38.839Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T22:34:38.963Z","logger":"kuadrant-operator.AuthorinoReconciler","msg":"authorino resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:34:38.964Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:34:38.964Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T22:34:39.175Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:34:39.176Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:34:39.176Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T22:34:39.223Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:34:39.223Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:34:39.224Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-11-02T22:34:39.287Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T22:34:39.831Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T22:34:39.832Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T22:34:44.154Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["EnvoyFilter","TokenRateLimitPolicy","HTTPRoute","Gateway","Limitador","ConfigMap","AuthConfig"],"eventTypes":{"delete":7,"update":10}}
{"level":"info","ts":"2026-11-02T22:34:44.273Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T22:34:44.305Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T22:34:44.436Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:34:44.436Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T22:34:44.657Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:34:44.661Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:34:44.663Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-02T22:34:44.663Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T22:34:44.665Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:34:44.665Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T22:34:44.668Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:34:45.192Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T22:34:45.192Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-11-02T22:34:47.488Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","Limitador","ConfigMap"],"eventTypes":{"update":4}}
{"level":"info","ts":"2026-11-02T22:34:47.555Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-11-02T22:34:47.670Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-11-02T22:34:47.760Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-11-02T22:34:47.760Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-11-02T22:34:48.235Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-11-02T22:34:48.237Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-11-02T22:34:48.237Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-11-02T22:34:48.239Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-11-02T22:34:48.239Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-11-02T22:34:48.245Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-11-02T22:34:48.685Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-11-02T22:34:48.685Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-11-02T22:34:48.744Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-worker-w3-f51151","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-worker-w3-f51151\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-11-02T22:34:54.913Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","Gateway","HTTPRoute"],"eventTypes":{"delete":4,"update":2}}